Findings Citing § 200.303

Reference Number: 2021-015 Category of Finding: Special Tests and Provisions – Refunding of Federal Share of Medicaid/CHIP Overpayments to Providers Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter C - Medical Assistance Programs, Part 433 - State Fiscal Administration, Subpart F - Refunding of Federal Share of Medicaid Overpayments to Providers: §433.300 Basis (42 CFR 433.300). This subpart implements: (a) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. §433.320 Procedures for refunds to CMS (42 CFR 433.320): (a) Basic requirements: (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of – (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with §433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. Subchapter D – State Children’s Health Insurance Programs (SCHIPs), Part 457 - Allotments and Grants to States, Subpart F - Payment to States: §457.628 Other applicable Federal regulations (42 CFR 457.628): Other regulations applicable to CHIP programs include the following: (a) HHS regulations in §§433.312 through 433.322 of this chapter (related to Overpayments) apply to State's CHIP programs in the same manner as they apply to State's Medicaid programs. Note that while for the Medical Assistance Program, the overpayments of the federal share must be refunded to the Centers for Medicare & Medicaid Services (CMS) via Form CMS-64 Summary, Line 9C1 - Fraud, Waste & Abuse Amounts, for the Children’s Health Insurance Program, the overpayments of the federal share must be refunded to CMS via Form CMS-21 Summary, Line 4 - Adjustments Decreasing Claims - Collections. Condition The Medical Assistance Program reporting of overpayments tested did not reflect the correct federal share because Form CMS-64 included all CHIP overpayments (42 CFR 433.320). All 20 CHIP overpayments tested did not reflect the correct federal share (Federal Financial Participation or FFP rate) and were not correctly reported on Form CMS-21 (42 CFR 433.320 via 42 CFR 457.628). Identification as a Repeat Finding Finding 2020-012 was reported in the immediate prior year. Cause The overpayments for the Medical Assistance Program (Medicaid) and CHIP on the CMS-64 and CMS-21, was due to Health Care Services Claims Processing Accounts Receivable (AR) System’s inability to distinguish between CHIP and Medicaid overpayments. When Audits and Investigations (A&I) identifies an overpayment, they do not distinguish between the two programs. A&I then sends an Action Notice (AN) and the findings of overpayments to the Fiscal Intermediary (FI) to establish an AR on the system with a copy to TPLRD for collection purposes. Once the FI establishes an AR for an overpayment, the overpayment is recorded in the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system (a department-developed application) and is automatically assigned the Medicaid FFP rate in effect upon AR creation. Due to system limitations, the COBRA system automatically assigns the Medicaid FFP rate in effect at AR creation for all overpayments and cannot assign a CHIP FFP rate to a CHIP overpayment. As such, all types of overpayments will utilize the Medicaid FFP rate. Therefore, when it is reported on the CMS-64 and CMS-21, they are allocating all refunds to the CMS-64. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments The incorrect FFP rate being applied to the Children’s Health Insurance Program (CHIP) overpayments was due to the same reason outlined above. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments. Effect Reporting of CHIP overpayments in the Medicaid CMS-64 report and utilizing an incorrect CHIP FFP rate resulted in under/over funding and noncompliance with refunding the Federal share of Medicaid and CHIP overpayments. Questioned Costs Overpayments for Medicaid caused by allocating all CHIP overpayments on the CMS-64 resulted in known questioned costs of $27,994 for the 2020-21 fiscal year. Overpayments for CHIP caused by utilizing the incorrect CHIP FFP rate resulted in known questioned costs of $10,112 for the 2020-21 fiscal year. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. The $27,994 known questioned costs for inaccurate reporting of Medicaid overpayments were identified from a total of $38,717,058 for the 40 Medicaid samples tested. The $10,112 known questioned costs for using the incorrect CHIP FFP rate were identified from a total of $27,994 for the twenty CHIP samples tested. The sample was not a statistically valid sample. Recommendation Health Care Services should have a process in place to ensure that the CMS-64 and CMS-21 reports properly report CHIP and Medicaid overpayments. Health Care Services should update the system to assign the appropriate FFP rate for each overpayment. With this implementation, CHIP overpayments can be appropriately identified with the correct FFP rate and reported on the CMS-21. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-016 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 97.050 Federal Program Title: Presidential Declared Disaster Assistance to Individuals and Households - Other Needs Federal Award Number and Year: 4482DRCASPLW; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - The Public Health and Welfare, Chapter 68, Disaster Relief, Subchapter IV, §5174 Federal assistance to individuals and households: (e) Financial Assistance to Address Other Needs (2) Personal Property, Transportation, and Other Expenses: In accordance with this section, the President, in consultation with the Governor of a State, may provide financial assistance, and, if necessary, direct services, to individuals and households in the State who, as a direct result of a major disaster, have necessary expenses and serious needs in cases in which the individuals and households are unable to meet such expenses or needs through other means. (f) State role (3) Requirements: d. Before approving an application submitted under this section, the President, or the designee of the President, shall institute adequate policies, procedures, and internal controls to prevent waste, fraud, abuse, and program mismanagement for this program and for programs under subsections (c)(1)(B), (c)(4), and (e). The President shall monitor and conduct quality assurance activities on a State or Indian tribal government’s implementation of programs under subsections (c)(1)(B), (c)(4), and (e). If, after approving an application of a State or Indian tribal government submitted under this paragraph, the President determines that the State or Indian tribal government is not administering the program established by this section in a manner satisfactory to the President, the President shall withdraw the approval. Condition During the fiscal year ended June 30, 2021, EDD implemented the Lost Wages Assistance (LWA) program, which was funded through the disaster relief funds from the Federal Emergency Management Agency (FEMA) under the Presidential Memorandum on Authorizing the Other Needs Assistance Program for Major Disaster Declarations Related to Coronavirus Disease 2019 (COVID-19). Under the memorandum, the LWA program was to be administered in accordance with the Robert T. Stafford Disaster Relief and Emergency Assistance Act section 408(e)(2) and (f), Title 42 U.S.C §5174(e)(2), (f). In EDD’s administration of the LWA program, $1,013,541,600 in benefit payments were estimated by EDD to represent potentially fraudulent payments. The estimate was based on data parameters to identify claimants that received benefits which matched imposter fraud for identity or eligibility fraud for misrepresented information. Out of 223 LWA benefit payments tested, 20 claimants were determined to be ineligible for LWA benefits. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of fraud for benefit payments for the following reasons. • There was a significant increase in unemployment claims that overwhelmed EDD’s existing fraud detection processes. • There were insufficient controls in place to prevent or detect fraud associated with benefit payments related to incarceration, identity, and multiple claims from the same address. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to fraudulent claimants. Accordingly, benefit payments were made to fraudulent claimants who were not eligible. Questioned Costs Likely questioned costs were estimated to be $1,013,541,600 for fiscal year 2020-21. Known questioned costs for the 20 claimants determined to be ineligible was $30,000. Context Benefits paid to claimants under the Presidential Declared Disaster Assistance to Individuals and Households - Other Needs for the fiscal year ended June 30, 2021, totaled $6,464,467,210. The LWA program ended in December 2020. The sample was not a statistically valid sample. Recommendation EDD should continue to evaluate and enhance its fraud detection and prevention internal controls, increasing the use of automation features and other analytical tools in an effort to increase efficiency, continue to reduce workload, and enhance detection and timely identification of unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Federal Program: 21.019 Coronavirus Relief Fund Award Number and Year: C139 and C2-069 Name of Federal Agency and Pass-Through Agency: U.S. Department of the Treasury and Kentucky Department for Local Government Compliance Requirements: Activities Allowed/Unallowed, Allowable Costs/Principles Type of Finding: Noncompliance Amount of Questioned Costs: $214,179 Modified Opinion: Adverse This is a repeat finding and was included in prior year audit report as finding 2020-009. The Clark County Fiscal Court submitted payroll expenses that did not qualify for reimbursement from the U.S. Department of Treasury’s Coronavirus Relief Fund (CRF) passed through from the Commonwealth of Kentucky’s Department of Local Government (DLG). During testing, the following questioned costs were noted, totaling $214,179 for year ended June 30, 2021: • FICA employer match calculation was incorrect on report submitted for reimbursement. When calculating FICA on the report submitted the former treasurer and finance officer did not use what was on the actual payroll summaries, but instead used a calculation in Excel. This calculation didn’t consider employe paid insurances that was not to be included in taxable wages that resulted in an overage request in reimbursement, and • There were several instances of the wrong amount being submitted for retirement for an employee, and • There was one month of payroll (October 2020) that was submitted for reimbursement twice. The prior year audit, which ended June 30, 2020, determined there were questioned costs totaling $19,773 and there were $214,179 for the year ended June 30, 2021, resulting in a total of $233,952 in questioned costs for this grant. The fiscal court did not have controls in place to ensure that staff knew the federal program requirements and did not monitor or review documentation to make sure requirements were followed. As a result, the county submitted expenses that did not qualify for reimbursement from the Coronavirus Relief Fund administered by the Commonwealth of Kentucky’s Department for Local Government (DLG). This resulted in $214,179 of questioned costs for the year ended June 30, 2021.The Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”) established the Coronavirus Relief Fund (the “Fund”) and appropriated $150 billion for payments by Treasury to States, tribal governments, and certain local governments. The CARES Act provides that payments from the Fund may only be used to cover costs that— 1. are necessary expenditures incurred due to the public health emergency with respect to the Coronavirus Disease 2019 (COVID-19); 2. we’re not accounted for in the budget most recently approved as of March 27, 2020 (the date of enactment of the CARES Act) for the State or government; and 3. were incurred during the period that begins on March 1, 2020, and ends on December 31, 2021 Additionally, CFR 200.303 states: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” We recommend the county establish and maintain effective internal control over federal awards that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. We also recommend the county contact the Department of Local Government for guidance on how to resolve this issue.

Federal Program: 21.019 Coronavirus Relief Fund Award Number and Year: C139 and C2-069 Name of Federal Agency and Pass-Through Agency: U.S. Department of the Treasury and Kentucky Department for Local Government Compliance Requirements: Activities Allowed/Unallowed, Allowable Costs/Principles Type of Finding: Noncompliance Amount of Questioned Costs: $214,179 Modified Opinion: Adverse This is a repeat finding and was included in prior year audit report as finding 2020-008. The fiscal court did not implement adequate internal controls over federal program, CFDA 21.019, Coronavirus Relief Fund. There were no procedures or review processes in place to ensure that compliance requirements were met for this federal program. The fiscal court did not define, maintain, or periodically evaluate the skills and expertise needed among its members to enable them to ask relevant questions of financial staff related to the federal program oversight. Further, the fiscal court did not maintain an organizational structure that facilitated effective reporting and other communications about internal control over compliance among various functions and positions of management. The fiscal court did not have job descriptions for employees managing federal programs nor did they document significant processes that explain the flow of transactions, controls to address key risk areas, and related reporting responsibilities. The fiscal court staff believed that they had appropriate procedures in place and did not realize that they were not sufficient. The fiscal court budgets for training in every department, however, training is not mandatory and the fiscal court does not ensure that training is sufficient for relevant employees. The fiscal court staff also believed that they were using job descriptions for employees outlined in the “County Budget Preparation and State Local Finance Officer Policy Manual”, however, the positions of employees managing the federal programs are not outlined in the budget manual. Failure to implement internal controls over federal programs creates a greater risk that compliance requirements will not be met and increases the risk of undetected errors in financial reporting, or misappropriation of federal funds due to fraud. Due to the lack of internal controls, the county was noncompliant with federal requirements over CFDA 21.019, resulting in ineligible expenditures. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards (Uniform Guidance) §200.303 Internal Controls The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal Statues, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor non-Federal entity’s compliance with statutes, regulations and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. (e) Take reasonable measures to safeguard protected personally identifiable information and other information the Federal awarding agency or pass-through entity designated as sensitive or the non-Federal entity considers sensitive consistent with applicable Federal, state, local, and tribal laws regarding privacy and obligations of confidentiality. Strong internal controls dictate that management should implement procedures to ensure that there is compliance with requirements related to federal funds received and expended, including providing adequate training to staff overseeing these procedures. To ensure these procedures are properly implemented by staff, the procedures should be in writing and easily accessible for staff to refer to while performing their job duties. Further, management should ensure that staff overseeing controls and compliance related to federal funds are continually and adequately trained to allow them to meet internal control and compliance requirements We recommend the fiscal court, in regard to controls over compliance for CFDA 21.019: 1. Implement procedures to ensure that expenditures related to the federal program meet all federal compliance requirements, including documented review procedures to ensure that all federal expenditures are allowable and fall within the correct period of performance, 2. document job descriptions for all employees and significant processes that explain the flow of transactions, controls to address key risk areas, and related reporting responsibilities, and 3. ensure that all employees receive sufficient training in relevant areas to ensure that they develop and retain sufficient and competent personnel to oversee the federal program compliance.

Criteria Per 2 CFR 200.302 (b)(7) a non-federal entity must establish written procedures for determining the allowability of costs in accordance with Subpart E – Cost Principles and the terms and conditions of the Federal award. Per 2 CFR 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with the Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Article 12 of the Act 83 of May 2, 1941, as amended, establishes that the Authority must have an accounting system that provides for adequate control and statistical records of all income and expenses from, administered or controlled by the Authority. Condition and Context During our review of the internal controls over compliance, we noted that the following: • Authority did not have written procedures or formal policies to ensure compliance over the Allowable Costs and Cost Principles, Period of Performance, Matching and Reporting requirements.• During our test work over internal controls over compliance for activities allowed and cost principles requirements, we noted that the Authority implemented a system of compiling the relevant data elements, including allowed expenditures for all projects. However, there was no control addressing the completeness and accuracy of the allowed expenditures. Cause and Possible Asserted Effect Management did not establish proper internal controls to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. Absence of formal policies and procedures could cause the Authority to fall in noncompliance with federal awards. Also, the Authority’s processes and controls are not designed to ensure proper review of supporting documentation to meet the compliance requirements of the Federal Grant. Not having formal processes and controls caused that in multiple occasions the Grantor returned claims submitted due to lack of support documentation. Questioned Cost There were no questioned costs associated with the finding. Whether the Sampling was a Statistically Valid Sample The sample was not intended to be, and was not, a statistically valid sample. Prior Year Repeat Finding A similar finding was reported in the prior year’s audit as finding 2020-008. Recommendation Management must establish written procedures and formal policies to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. View of Responsible Officials Management acknowledges the findings and has implemented a corrective action plan to enhance compliance with Federal awards. This plan includes developing Standard Operating Procedures (SOPs) for grant management activities, identifying, and documenting existing internal controls, and maintaining constant communication with stakeholders to prevent material non-compliance. Additionally, PREPA will provide training to staff on the new SOPs and establish a monitoring mechanism to continuously assess and improve the effectiveness of these controls. The corrective action plan, supervised by Mr. Ezequiel Nieves from the PREPA Disaster Funding Management Office, is expected to be completed by July 2025. Management is committed to addressing deficiencies, ensuring that processes and controls are robust and effective, and that Federal awards are managed transparently and in full compliance with all regulatory requirements. The estimated date of completion is expected to be in July 2025. Responsible Party - Mr. Ezequiel Nieves - PREPA Disaster Funding Management Office, Finance Department. Effective June 1, 2021, the Authority transitioned the management and operation of its transmission and distribution network as well as certain back-office functions, including billing, collections and accounting, to a third party. The third-party operator is reviewing operating procedures and controls within its responsibilities to make the necessary improvements. Management will work to address these findings with the assistance of the third-party operators, where applicable. Also, effective July 1, 2023, the Authority transitioned the management and operation of its generation assets as well as certain back- office functions to a third party. The third-party operator is reviewing operating procedures and controls within its responsibilities to make the necessary improvements. In addition, the Authority will also be implementing and monitoring corrective actions taken by the new generation segment operator.

FINDING 2021-003 - Subrecipient Monitoring (Repeated from Prior Year Findings 20-004, 19-005, 18-004, and 17-003) Federal Program: Individuals with Disabilities Education Act (IDEA) Improvement Grant - Part D Project No: 20-4631-RN and 21-4631-RN Federal Assistance Listing Number: 84.323A Passed Through: Illinois State Board of Education Federal Agency: U.S. Department of Education Criteria/Specific Requirement: A. The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) require the Regional Office to ensure any subrecipient monitoring using federal funds be consistent with the standards set forth in the Uniform Guidance at 2 CFR 200.332. B. The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.303 Internal Controls states the following: “The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: The ROE does not have effective internal controls over subrecipient monitoring. Furthermore, ROE #47 was not properly monitoring subrecipients in accordance with the Uniform Guidance standards. During audit testing procedures it was determined that ROE #47: Number of Subrecipients a. Did not evaluate the risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward. 2 of 2 b. Did not conduct subrecipient monitoring procedures. 2 of 2 c. Did not determine whether the subrecipient met the 2 CFR 200 Subpart F Audit requirements criteria for a single audit. 2 of 2 Questioned Costs: None Context: The Regional Office of Education #47 expended a total of $1,919,044 of federal awards in fiscal year 2021, of which $879,747 in IDEA –Improvement Grant –Part D were passed-through to subrecipients. Effect: The Regional Office of Education #47 is not in compliance with Title 2 of the Code of Federal Regulations (CFR) Part 200.332 as it relates to subrecipient monitoring requirements. Additionally, the effect of noncompliance can result in questioned costs. Cause: The Regional Office of Education #47 experienced staff turnover and did not formally document policies and procedures that provide controls and structures to ensure all of its subrecipient monitoring accountabilities are conducted and complied with. Recommendation: We recommend that the Regional Office of Education #47 establish and maintain effective internal control over federal awards to ensure subrecipients are properly monitored as required by 2 CFR 200.332. This includes: a. Evaluating the risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward; b. Conducting subrecipient monitoring procedures; and c. Determining whether the subrecipient met the requirement criteria of 2 CFR 200 Subpart F Audit requirements for a single audit. Management’s Response: Management agrees with this finding.

Finding 2021-006 – Lack of Internal Controls Over Major Federal Programs – Disaster Grants – Public Assistance (Presidentially Declared Disasters) PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management FEDERAL AGENCY: U.S. Department of Homeland Security ASSISTANCE LISTING NO: 97.036 FEDERAL PROGRAM NAME: Disaster Grants – Public Assistance (Presidentially Declared Disasters) FEDERAL AWARD NUMBER: DR-4438 FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principals; Period of Performance; Reporting; Special Tests and Provisions QUESTIONED COSTS: $-0- Condition: During the process of documenting the County’s internal controls regarding federal disbursements, we noted that Alfalfa County has not established procedures to ensure compliance with the following requirements: Activities Allowed or Unallowed; Allowable Costs; Period of Performance; Reporting; Special Tests and Provisions. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal expenditures are made in accordance with federal compliance requirements. Effect of Condition: This condition resulted in noncompliance to grant requirements and could lead to a loss of federal funds to the County. Recommendation: OSAI recommends the County gain an understanding of requirements for this program and implement internal control procedures to ensure compliance with requirements. Management Response: Chairman of the Board of County Commissioners: I will research and educate myself on the compliance requirements, so I can take a proactive approach to managing major federal programs. County Commissioner District 2: I did not take office until January 2021; therefore, I was not in office during FEMA disaster #4438 declared in 2019. In any future FEMA declared emergencies, I will exercise due diligence and oversee any and all documents relative to the disaster. County Commissioner District 3: I will research information regarding the federal grants the County receives and discuss them in the County Officers’ meetings. Criteria: 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Further, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.23 states in part: Objectives of an Entity – Compliance Objectives Management conducts activities in accordance with applicable laws and regulations. As part of specifying compliance objectives, the entity determines which laws and regulations apply to the entity. Management is expected to set objectives that incorporate these requirements.

Finding 2021-007 – Noncompliance with Compliance Requirements: Allowable Costs/Cost Principles; Period of Performance; Reporting – Disaster Grants – Public Assistance (Presidentially Declared Disasters) PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management FEDERAL AGENCY: U.S. Department of Home Security ASSISTANCE LISTING NO: 97.036 FEDERAL PROGRAM NAME: Disaster Grants – Public Assistance (Presidentially Declared Disasters) FEDERAL AWARD NUMBER: DR-4438 FEDERAL AWARD YEAR: 2020 and 2021 CONTROL CATEGORY: Allowable Costs/Cost Principals; Period of Performance; Reporting QUESTIONED COSTS: $67,742 Condition: Upon inquiry of county personnel, review of documentation and procedures, and a test of 100% of federal expenditures totaling $592,062, the following weaknesses were noted: Project Worksheet 274 (D3) Questioned Cost - $1,019 • Equipment costs were not calculated with correct Federal Emergency Management Agency (FEMA) rates resulting in $1,019 of unsupported costs. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 419 (D2) Questioned Costs - $6,223 (Activities Allowed/Allowable Costs - $6,223 Period of Performance - $5,467) • One (1) Daily Activity Report in the amount of $5,467 accrued expenditures that occurred after the performance deadline. Additionally, the work performed was not listed on the approved project worksheet. • One (1) Daily Activity Report in the amount of $5,467 contained costs that were not described on the approved project worksheet. • Equipment costs were not calculated with correct FEMA rates resulting in $708 of unsupported costs. • Labor costs were not calculated with appropriate rates resulting in $48 of unsupported costs. • Four (4) Daily Activity Reports were not signed by the preparer. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 420 (D2) Questioned Costs - $5,278 • Equipment costs were not calculated with correct FEMA rates resulting in $4,981 of unsupported costs. • The labor hours reported on the Daily Activity Reports totaling $274 do not agree to the total hours worked reported on the employee timesheet. • Material costs were not calculated with accurate unit prices resulting in $23 of unsupported costs. • Three (3) Daily Activity Reports were not signed by the preparer. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 810 (D1) Questioned Costs - $11,987 • The labor hours reported on the Daily Activity Reports totaling $11,987 do not agree to the total hours worked reported on the employee timesheet. • Three (3) Daily Activity Reports were not signed by the preparer. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 843 (D1) Questioned Costs - $11,482 • Equipment costs were not calculated with correct FEMA rates resulting in $9,106 of unsupported costs. • The labor hours reported on the Daily Activity Reports totaling $2,160 do not agree to the total hours worked reported on the employee timesheet. • Material costs were not calculated with accurate unit prices resulting in $216 of unsupported costs. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 889 (D1) Questioned Costs - $1,870 • The labor hours reported on the Daily Activity Reports totaling $1,680 do not agree to the total hours worked reported on the employee timesheet. • Equipment costs were not calculated with correct FEMA rates resulting in $190 of unsupported costs. • Four (4) Daily Activity Reports were not signed by the preparer. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 995 (D1) Questioned Costs - $8,993 • The labor hours reported on the Daily Activity Reports totaling $8,019 do not agree to the total hours worked reported on the employee timesheet. • Material costs were not calculated with accurate unit prices resulting in $564 of unsupported costs. • Total project costs were not met resulting in $410 unsubstantiated costs. • Three (3) daily activity reports were not signed by the preparer. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. • One (1) quarterly report was not submitted timely. Project Worksheet 1023 (D1) Questioned Costs - $134 • The labor hours reported on the Daily Activity Reports totaling $134 do not agree to the total hours worked reported on the employee timesheet. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 1024 (D1) Questioned Costs - $3,238 • Equipment costs were not calculated with correct FEMA rates resulting in $1,544 of unsupported costs. • The labor hours reported on the Daily Activity Reports totaling $1,362 do not agree to the total hours worked reported on the employee timesheet. • Material costs were not calculated with accurate unit prices resulting in $332 of unsupported costs. • One (1) Daily Activity Report was not signed by the preparer. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 1066 (D1) Questioned Costs - $4,266 • The labor hours reported on the Daily Activity Reports totaling $4,266 do not agree to the total hours worked reported on the employee timesheet. • Three (3) Daily Activity Reports were not signed by the preparer. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 1073 (D1) Questioned Costs - $3,701 • The labor hours reported on the Daily Activity Reports totaling $3,589 do not agree to the total hours worked reported on the employee timesheet. • Material costs were not calculated with accurate unit prices resulting in $112 of unsupported costs. • One (1) Daily Activity Report was not signed by the preparer. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 1077 (D1) Questioned Costs - $5,035 • Equipment costs were not calculated with correct FEMA rates resulting in $2,856 of unsupported costs. • The labor hours reported on the Daily Activity Reports totaling $2,161 do not agree to the total hours worked reported on the employee timesheet. • Material costs were not calculated with accurate unit prices resulting in $18 of unsupported costs. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 1098 (D1) Questioned Costs - $2,934 • The labor hours reported on the Daily Activity Reports totaling $1,680 do not agree to the total hours worked reported on the employee timesheet. • One (1) Daily Activity Report in the amount of $912 contained costs that were not described on the approved project worksheet. • Material costs were not calculated with accurate unit prices resulting in $235 of unsupported costs. • Equipment costs were not calculated with correct FEMA rates resulting in $107 of unsupported costs. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Project Worksheet 1101 (D1) Questioned Costs - $1,582 • The labor hours reported on the Daily Activity Reports totaling $1,582 do not agree to the total hours worked reported on the employee timesheet. • Supporting documentation retained from projects were not reviewed or approved by anyone other than the preparer. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal expenditures are made in accordance with federal compliance requirements. Effect of Condition: These conditions resulted in noncompliance to grant requirements and could result in loss of federal funds to the County. Recommendation: OSAI recommends the County gain an understanding of the compliance requirements for federal programs and implement internal control procedures to ensure compliance with all requirements. We further recommend all documentation be properly maintained for inspection. Management Response: Chairman of the Board of County Commissioners: Because I was not in office during this period, I am not able to say for certain what transpired. I will practice oversight and be involved in the documentation of federal grant expenditures. County Commissioner District 2: I did not take office until January 2021; therefore, I was not in office during FEMA disaster #4438 declared in 2019. In any future FEMA declared emergencies, I will exercise due diligence and oversee any and all documents relative to the disaster. County Commissioner District 3: I will make sure we use the correct FEMA equipment rates. I will review the documents prepared by my administrative assistant. Criteria: 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 CFR § 200.318 (a), General procurement standards, reads as follows: The Non-Federal entity must use its own documented procurement procedures which reflect applicable State, local, and tribal laws and regulations, provided that the procurements conform to applicable Federal law and the standards identified in this part. [….] Title 2 CFR § 200.84 Questioned Cost reads as follows: Questioned cost means a cost that is questioned by the auditor because of an audit finding: (a) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for fund used to match Federal funds; (b) Where the costs, at the time of the audit, are not supported by adequate documentation; or (c) Where the costs incurred appear unreasonable and do not reflect the actions a prudent person would take in the circumstances. Further, GAO Standards – Section 2 – Objectives of an Entity – OV2.23 states in part: Compliance Objectives Management conducts activities in accordance with applicable laws and regulations. As part of specifying compliance objectives, the entity determines which laws and regulations apply to the entity. Management is expected to set objectives that incorporate these requirements. […]

FINDING 2021‐002 – Material Weakness and Material Noncompliance – Allowable Cost Principles Assistance Listing Number: 21.023 Federal Program Name: COVID-19 Emergency Rental Assistance Program Award Year: 2021 Criteria: 2 CFR 200.303 indicates grant recipients should establish and maintain effective internal control that provides reasonable assurance that the entity is managing their federal awards in compliance with Federal statutes, regulations and the terms and conditions of their federal awards. To ensure accurate financial reports and compliance with all rules and regulations with respect to grant awards, the payroll process of the Center should include reviews and approvals at each level to determine and support payroll expenses, including that those expenses are allowable costs, reasonable, necessary, and within budget. Documentation should be maintained to demonstrate that all pay rates were adequately approved and authorized. Additionally, all disbursements should be supported by an invoice or other documentation to substantiate costs incurred, which includes documentation of review and approval. Condition/Context: Our testing of internal controls over compliance and testing of compliance found the following errors: •An employee’s advance draw of $1,550 with associated benefits of approximately $176 was inappropriately charged to the grant. •Timecard approval was lacking in 8 instances of a sample of 21 payroll expenditures. •There was one instance, out of 21 tested, in which a timecard lacked the employee certification. •There were four instances, out of a sample of 60, in which support was not maintained by accounting, however they were provided at a later date upon request. •One instance, out of a sample of 60, in which a $3,500 disbursement lacked proper documentation or other supporting evidence or approval. Cause: The Center did not design and implement internal controls to effectively manage their federal awards. Effect: Without properly designed and implemented controls, errors and unallowed costs could be disbursed with grant funds, which may be subject to return. Questioned Costs: $5,226 Repeat Finding: No Recommendation: We recommend the Center devote sufficient resources to the finance department. This includes training related to federal awards and internal controls. We also recommend management emphasize the importance of developing and following financial and personnel policies and procedures in relation to internal controls and compliance with allowable costs; and that all documentation be retained. Views of responsible officials and planned corrective actions: Management agrees with the audit findings and is implementing the following accounting policies to ensure compliance: •Changing the company payroll draw policy to limit the number of draws annually •Reviewing company time sheet policies with employees •Reviewing disbursement documentation policies to ensure all disbursements contain proper documentation. •Instituting a policy of monthly review of documentation and approvals as part of the monthly close process Timeline: policies have been implemented and reviewed Contact Person(s): Linda Lauch, Executive Director

2021-010 Maintenance of Documentation of Internal Control Over Compliance U.S. Department of Justice, Passed through Illinois Criminal Justice Information Authority Crime Victim Assistance – Assistance Listing Number 16.575 U.S. Department of Health and Human Services COVID-19, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution – Assistance Listing Number 93.498 Criteria: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure that documentation to evidence the operation of the controls, such as supervisory reviews. Condition: The Corporation did not have sufficient documentation that internal controls were in place and operating effectively for control activities required for assessment of activities allowed or unallowed and for allowable costs/cost principles. The Corporation also did not have sufficient documentation that internal controls were in place and operating effectively for monitoring procedures required for cash management and reporting compliance requirements. Although the Corporation provided documentation supporting the costs reported, there was no formal documentation of the control activities for approval of activities allowed or unallowed and allowable costs/cost principles. Formal documentation of the supervisory review of cash management and supervisory review and approval of the information compiled for the reporting compliance requirement was also unavailable. Cause: The Corporation did not maintain documentation evidencing the operation of specific internal controls. Effect: Lack of properly documented evidence of approval of activities allowed or unallowed and allowable costs/cost principles. Lack of properly documented evidence of supervisory review of cash management and reporting policies and procedures could result in the loss of future funding. Questioned costs: None Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: We recommend that management review current processes, polices, and procedures to ensure that approval of activities allowed or unallowed and approval of allowable costs/cost principles are properly documented. We recommend that management review current processes, policies, and procedures to ensure that supervisory review of cash management and reporting compliance requirements are properly documented. View of responsible officials of the auditee: Management agrees with the finding and recommendation.

2021-010 Maintenance of Documentation of Internal Control Over Compliance U.S. Department of Justice, Passed through Illinois Criminal Justice Information Authority Crime Victim Assistance – Assistance Listing Number 16.575 U.S. Department of Health and Human Services COVID-19, Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution – Assistance Listing Number 93.498 Criteria: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure that documentation to evidence the operation of the controls, such as supervisory reviews. Condition: The Corporation did not have sufficient documentation that internal controls were in place and operating effectively for control activities required for assessment of activities allowed or unallowed and for allowable costs/cost principles. The Corporation also did not have sufficient documentation that internal controls were in place and operating effectively for monitoring procedures required for cash management and reporting compliance requirements. Although the Corporation provided documentation supporting the costs reported, there was no formal documentation of the control activities for approval of activities allowed or unallowed and allowable costs/cost principles. Formal documentation of the supervisory review of cash management and supervisory review and approval of the information compiled for the reporting compliance requirement was also unavailable. Cause: The Corporation did not maintain documentation evidencing the operation of specific internal controls. Effect: Lack of properly documented evidence of approval of activities allowed or unallowed and allowable costs/cost principles. Lack of properly documented evidence of supervisory review of cash management and reporting policies and procedures could result in the loss of future funding. Questioned costs: None Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: We recommend that management review current processes, polices, and procedures to ensure that approval of activities allowed or unallowed and approval of allowable costs/cost principles are properly documented. We recommend that management review current processes, policies, and procedures to ensure that supervisory review of cash management and reporting compliance requirements are properly documented. View of responsible officials of the auditee: Management agrees with the finding and recommendation.

PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management and Oklahoma Office and Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD NUMBER: Oklahoma CARES PPE; 4530-DR-OK; SA-2242 FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: $-0- Condition: During the process of documenting the County’s internal controls regarding federal disbursements, we noted that Ottawa County has not established procedures to ensure compliance with the following compliance requirements: Activities Allowed or Unallowed; Allowable Costs/Costs Principles and Period of Performance. Submissions for reimbursement from the Coronavirus Relief Fund were not reviewed by the BOCC for Activities Allowed/Allowed Costs, or to ensure the expenses were incurred during the allowable period of performance. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal expenditures are made in accordance with federal grant compliance requirements. Effect of Condition: This condition could result in noncompliance with grant requirements and could lead to the loss of federal funds to the County. Recommendation: OSAI recommends the County gain an understanding of requirements for this program and implement internal control procedures to ensure compliance with all requirements. Management Response: District 1 County Commissioner: Ottawa County has implemented internal control procedures to ensure compliance with all requirements. District 2 County Commissioner: I was not in office at this time; however, I will work to gain an understanding of grant requirements and implement internal controls to ensure compliance with those requirements. District 3 County Commissioner: I did not take office until January 2023; however, District 3 will work to better understand all requirements of federal programs and implement better procedures to follow all guidelines to ensure compliance. County Clerk: The County Clerk’s office is continuously learning policies and procedures needed to ensure the County’s federal programs have adequate internal controls. The County Clerk’s office will work on getting written internal control policies and procedures in place. Criteria: 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR § 213 states, “Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities.” Additionally, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.23 states in part: Objectives of an Entity – Compliance Objectives Management conducts activities in accordance with applicable laws and regulations. As part of specifying compliance objectives, the entity determines which laws and regulations apply to the entity. Management is expected to set objectives that incorporate these requirements.

Program Information: U.S. Department of the Interior AL # Award Number Award Period Program Name 15.042 A19AV00888 7/1/2020-6/30/2021 Indian School Equalization Program 15.046 A19AV00888 7/1/2020-6/30/2021 Administrative Cost Grants for Indian Schools Criteria: The cost principles in 2 CFR part 200, subpart E (Cost Principles), prescribe the cost accounting requirements associated with the administration of Federal awards by: a. States, local governments, and Indian tribes b. Institutions of higher education (IHEs) c. Nonprofit organizations Except where otherwise authorized by statute, cost must meet the following general criteria in order to be allowable under Federal awards: 4. Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. 7. Be adequately documented. 2 CFR § 200.303 - Internal controls states, the recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: During the testing of 15.042, the following was noted: • 1 of 8 non-payroll samples did not have sufficient supporting documentation. • 9 of 32 payroll samples did not have indication of management approval on the timesheet/timecard. • 5 of 32 payroll samples did not have a Personnel Action Form provided. • 1 of 32 payroll samples did not have management approval of the employee contract. • 1 of 32 payroll samples did not have sufficient supporting documentation. During the testing of 15.046, the following was noted: • Support was not provided for 2 of 30 non-payroll samples. • 1 of 3 Individually Important Items and 1 of 30 payroll samples did not have adequate documentation. • 4 of 30 payroll samples did not have an approved timesheet. [ X ] Compliance Finding [ ] Significant Deficiency [ X ] Material Weakness Cause: Due to turnover in key personnel and lack of internal controls, the School did not have the ability to provide supporting documentation. Effect: Without an effective internal control system an entity’s objective operations, reporting, and compliance, cannot be achieved. In addition, program funds could be expended on activities or costs that are deemed unallowable by the funding agency. Questioned Costs: $1,890 for 15.042, none for 15.046 as the known plus likely questioned costs did not exceed $25,000. Repeat Finding: No. Recommendation: We recommend the School enhances training for grant expenditures on federal cost allowability requirements, strengthen documentation & approval controls, and improve document retention practices. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and has prepared corrective action as detailed in its Corrective Action Plan.

Program Information: U.S. Department of the Interior AL # Award Number Award Period Program Name 15.042 A19AV00888 7/1/2020-6/30/2021 Indian School Equalization Program 15.046 A19AV00888 7/1/2020-6/30/2021 Administrative Cost Grants for Indian Schools Criteria: The cost principles in 2 CFR part 200, subpart E (Cost Principles), prescribe the cost accounting requirements associated with the administration of Federal awards by: a. States, local governments, and Indian tribes b. Institutions of higher education (IHEs) c. Nonprofit organizations Except where otherwise authorized by statute, cost must meet the following general criteria in order to be allowable under Federal awards: 4. Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. 7. Be adequately documented. 2 CFR § 200.303 - Internal controls states, the recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: During the testing of 15.042, the following was noted: • 1 of 8 non-payroll samples did not have sufficient supporting documentation. • 9 of 32 payroll samples did not have indication of management approval on the timesheet/timecard. • 5 of 32 payroll samples did not have a Personnel Action Form provided. • 1 of 32 payroll samples did not have management approval of the employee contract. • 1 of 32 payroll samples did not have sufficient supporting documentation. During the testing of 15.046, the following was noted: • Support was not provided for 2 of 30 non-payroll samples. • 1 of 3 Individually Important Items and 1 of 30 payroll samples did not have adequate documentation. • 4 of 30 payroll samples did not have an approved timesheet. [ X ] Compliance Finding [ ] Significant Deficiency [ X ] Material Weakness Cause: Due to turnover in key personnel and lack of internal controls, the School did not have the ability to provide supporting documentation. Effect: Without an effective internal control system an entity’s objective operations, reporting, and compliance, cannot be achieved. In addition, program funds could be expended on activities or costs that are deemed unallowable by the funding agency. Questioned Costs: $1,890 for 15.042, none for 15.046 as the known plus likely questioned costs did not exceed $25,000. Repeat Finding: No. Recommendation: We recommend the School enhances training for grant expenditures on federal cost allowability requirements, strengthen documentation & approval controls, and improve document retention practices. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and has prepared corrective action as detailed in its Corrective Action Plan.

Program Information: U.S. Department of the Interior AL # Award Number Award Period Program Name 15.042 A19AV00888 7/1/2020-6/30/2021 Indian School Equalization Program Criteria: Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the Federal award identification number), who holds title, the acquisition date, cost of the property, percentage of Federal participation in the project costs for the Federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sales price of the property (2 CFR section 200.313(d)(1)). A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years (2 CFR section 200.313(d)(2)). A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated (2 CFR section 200.313(d)(3)). 2 CFR § 200.303 - Internal controls states, the recipient and subrecipient must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: During the audit, we noted that a physical inventory of the School’s property had not been taken and reconciled with the property records within the last two years. [ X ] Compliance Finding [ ] Significant Deficiency [ X ] Material Weakness Cause: There was turnover in the School’s key accounting staff. Effect: Property records may not be accurate and proper custodianship of the property is compromised. Questioned Costs: N/A. Repeat Finding: Yes, 2020-001. Recommendation: We recommend that the School develop policies and procedures requiring a physical inventory of the School’s property at least once every two years, and reconcile the results of the inventory to the property records. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and has prepared corrective action as detailed in its Corrective Action Plan.

Program Information: U.S. Department of the Interior AL # Award Number Award Period Program Name 15.042 A19AV00888 7/1/2020-6/30/2021 Indian School Equalization Program 15.046 A19AV00888 7/1/2020-6/30/2021 Administrative Cost Grants for Indian Schools Criteria: Non-Federal entities other than States, including those operating Federal programs as subrecipients of States, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable Federal statutes and the procurement requirements identified in 2 CFR part 200. During the review of the School’s procurement policies, the following was noted: • Any purchase of materials, supplies, or equipment having a purchase price exceeding $5,000 shall be purchased only after having requested at least three bids or as needed, advertised for sealed bids for a period of not less than five (5) days. Non-Federal entities other than States, including those operating Federal programs as subrecipients of States, must follow the suspension and debarment standards set out at 2 CFR Part 180, which implements Executive Orders 12549 and 12689, “Debarment and Suspension”, federal awarding agency regulations in Title 2 of the CFR adopting/implementing the OMB guidance in 2 CFR Part 180; program legislation; and the terms and conditions of the award. 2 CFR § 200.303 - Internal controls states, the recipient and subrecipient must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: During the testing of 15.042, the following was noted: • 1 of 1 Individually Important Items tested did not have bidding documentation or sole source justification. • 1 of 1 samples tested did not have bidding documentation or sole source justification. During the testing of 15.046, the following was noted: • 2 of 2 Individually Important Items and 2 of 2 procurement samples did not have bidding documentation or sole source justification. • 1 of 1 Individually Important Items and 1 of 1 suspension and debarment samples did not have verification that a suspension and debarment search was performed. [ X ] Compliance Finding [ ] Significant Deficiency [ X ] Material Weakness Cause: The School was not following its policies for purchases that exceed $5,000. For suspension and debarment, there were ineffective controls in place during the period, along with management oversight. Effect: The School could be overpaying for services or items that could be obtained elsewhere for less. The School could also be engaging with vendors who are suspended or debarred. Questioned Costs: Procurement: 15.042 – None reported as known and likely questioned costs did not exceed $25,000; 15.046 – Known – $75,425. Suspension and debarment: 15.042 and 15.046 – no questioned costs. Repeat Finding: Procurement – Yes, 2020-002 for 15.042; Suspension and Debarment – No Recommendation: We recommend that the School follow its written procurement policies and maintain proper supporting documentation. Additionally, we recommend the School develop procedures to ensure that before contracting with a vendor, a search is performed on https://www.sam.gov, a screen print of the search results is performed, and the results filed in the vendor’s file. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and has prepared corrective action as detailed in its Corrective Action Plan.

Program Information: U.S. Department of the Interior AL # Award Number Award Period Program Name 15.042 A19AV00888 7/1/2020-6/30/2021 Indian School Equalization Program 15.046 A19AV00888 7/1/2020-6/30/2021 Administrative Cost Grants for Indian Schools Criteria: Non-Federal entities other than States, including those operating Federal programs as subrecipients of States, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable Federal statutes and the procurement requirements identified in 2 CFR part 200. During the review of the School’s procurement policies, the following was noted: • Any purchase of materials, supplies, or equipment having a purchase price exceeding $5,000 shall be purchased only after having requested at least three bids or as needed, advertised for sealed bids for a period of not less than five (5) days. Non-Federal entities other than States, including those operating Federal programs as subrecipients of States, must follow the suspension and debarment standards set out at 2 CFR Part 180, which implements Executive Orders 12549 and 12689, “Debarment and Suspension”, federal awarding agency regulations in Title 2 of the CFR adopting/implementing the OMB guidance in 2 CFR Part 180; program legislation; and the terms and conditions of the award. 2 CFR § 200.303 - Internal controls states, the recipient and subrecipient must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: During the testing of 15.042, the following was noted: • 1 of 1 Individually Important Items tested did not have bidding documentation or sole source justification. • 1 of 1 samples tested did not have bidding documentation or sole source justification. During the testing of 15.046, the following was noted: • 2 of 2 Individually Important Items and 2 of 2 procurement samples did not have bidding documentation or sole source justification. • 1 of 1 Individually Important Items and 1 of 1 suspension and debarment samples did not have verification that a suspension and debarment search was performed. [ X ] Compliance Finding [ ] Significant Deficiency [ X ] Material Weakness Cause: The School was not following its policies for purchases that exceed $5,000. For suspension and debarment, there were ineffective controls in place during the period, along with management oversight. Effect: The School could be overpaying for services or items that could be obtained elsewhere for less. The School could also be engaging with vendors who are suspended or debarred. Questioned Costs: Procurement: 15.042 – None reported as known and likely questioned costs did not exceed $25,000; 15.046 – Known – $75,425. Suspension and debarment: 15.042 and 15.046 – no questioned costs. Repeat Finding: Procurement – Yes, 2020-002 for 15.042; Suspension and Debarment – No Recommendation: We recommend that the School follow its written procurement policies and maintain proper supporting documentation. Additionally, we recommend the School develop procedures to ensure that before contracting with a vendor, a search is performed on https://www.sam.gov, a screen print of the search results is performed, and the results filed in the vendor’s file. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and has prepared corrective action as detailed in its Corrective Action Plan.

Program Information: U.S. Department of the Interior AL # Award Number Award Period Program Name 15.046 A19AV00888 7/1/2020-6/30/2021 Administrative Cost Grants for Indian Schools Criteria: Per 25 U.S.C. § 2506(a) (1) (A), School Year 2019-2022 Reporting & Deadline Dates for Grant Schools, the following reports are required to be submitted: • Quarterly SF-425s – due 30 days after each period end. • Annual Report for School Year – due 9/30/21. • Year End Close Out SF-425s – tentative due 7/31/21, final due 9/30/21. • Program evaluation by an impartial third party such as an accrediting agency. 2 CFR § 200.303 - Internal controls states, the recipient and subrecipient must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: During testing the following was noted: • 2 of 2 Close Out SF-425s were not provided for testing. • 1 of 2 Quarterly SF-425s was not submitted on time and 2 of 2 Quarterly SF-425s were not approved by signature. • The Annual Report for the School Year was not approved and timeliness could not be verified. [ X ] Compliance Finding [ ] Significant Deficiency [ X ] Material Weakness Cause: Staff turnover and management oversight resulted in reports not being submitted within the required timeline. Effect: The program may be subject to higher risk status and decreased funding due to failing to comply with the grant award requirements. Questioned Costs: N/A. Repeat Finding: No. Recommendation: We recommend the School adhere to the grant award’s requirements as documented and enforce monitoring procedures at the program level to ensure that compliance requirements are properly followed. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and has prepared corrective action as detailed in its Corrective Action Plan.

Program Information: U.S. Department of the Interior AL # Award Number Award Period Program Name 15.042 A19AV00888 7/1/2020-6/30/2021 Indian School Equalization Program Criteria: Character Investigations by Indian Tribes and Tribal Organizations Compliance Requirements: The Indian Child Protection and Family Violence Prevention Act (25 USC 3201 et seq.) requires Indian tribes and tribal organizations that receive funds under the ISDEAA or the Tribally Controlled Schools Act to conduct an investigation of the character of each individual who is employed or is being considered for employment by such Indian tribe or tribal organization in a position that involves regular contact with, or control over, Indian children. The Act further states that the Indian tribe or tribal organization may employ individuals in those positions only if the individuals meet standards of character, no less stringent than those prescribed under subpart B – Minimum Standards of Character and Suitability for Employment (25 CFR part 63), as the Indian tribe or tribal organization establishes. 2 CFR § 200.303 - Internal controls states, the recipient and subrecipient must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: For 4 of the 4 samples selected for testing, the School did not provide support for review and approval of the Character Investigations. [ ] Compliance Finding [ ] Significant Deficiency [ X ] Material Weakness Cause: Lack of internal controls and management oversight. Effect: Without an effective internal control system an entity’s objective: operations, reporting, and compliance cannot be achieved. Questioned Costs: N/A. Repeat Finding: Yes, 2020-003. Recommendation: We recommend that the School establish effective internal controls for the Character Investigations compliance requirement and adhere to the internal controls. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and has prepared corrective action as detailed in its Corrective Action Plan.

Finding 2021-011 – Lack of Internal Controls Over Major Federal Program – Coronavirus Relief Fund PASS THROUGH GRANTOR: Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U. S. Department of the Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD NUMBER: SA-0187 FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance QUESTIONED COSTS: $-0- Condition: During the process of documenting the County’s internal controls regarding federal disbursements, we noted that Muskogee County has not established procedures to ensure compliance with the following compliance requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; and Period of Performance. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal expenditures are made in accordance with federal grant requirements. Effect of Condition: This condition could result in noncompliance to grant requirements and could lead to a loss of federal funds to the County. Recommendation: OSAI recommends that the County gain an understanding of requirements for these programs and implement a system of internal control procedures to ensure compliance with grant requirements. Management Response: Chairman of the Board of County Commissioners: Muskogee County has hired an internal grant administrator to assist in keeping the county compliant with all local, state, and federal requirements. Efforts will be made going forward to ensure that all grant funds are properly expended. Criteria: 2 CFR § 200.303 Internal Controls (a) reads as follows: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Further, accountability and stewardship should be overall goals in management’s accounting of federal funds. Internal controls should be designed to monitor compliance with laws and regulations pertaining to grant contracts.

Finding 2021-012 – Noncompliance Over Major Federal Program – Coronavirus Relief Fund – Activities Allowed or Unallowed and Allowable Costs/Cost Principles PASS-THROUGH GRANTOR: Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISGING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD NUMBER: SA-0187 FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed and Allowable Costs/Cost Principles QUESTIONED COSTS: $1,089,096 Condition: During the test of 100% of federal expenditures for Coronavirus Relief Fund, program disbursement totaling $1,089,096 were not expended in accordance with the Activities Allowed or Unallowed and Allowable Costs/Cost Principles due to unsubstantiated, duplicated, and ineligible costs as detailed below: Payroll Reimbursements • Unallowable reimbursement in the amount of $1,900 for longevity bonus. • Sick leave totaling $2,285 for a county official. • Duplicate payroll reimbursements totaling $17,668 were reimbursed by another grant. Expenditure Reimbursements • Reimbursements totaling $1,059,350 for hazard runs on behalf of Muskogee EMS District. • Reimbursements totaling $7,879 were not supported with adequate documentation. • Reimbursement in the amount of $14 that exceeded the purchase order amount. Cause of Condition: Policies and procedures have not been designed and implemented to ensure compliance with federal award requirements. Effect of Condition: This condition resulted in noncompliance with federal grant requirements for this program and could result in loss of federal funds. Recommendation: OSAI recommends the County gain an understanding of the requirements for this program and design and implement policies and procedures to ensure compliance with these requirements. Management Response: Chairman of the Board of County Commissioners: Muskogee County has hired an internal grant administrator to assist in keeping the county compliant with all local, state, and federal requirements. Efforts will be made going forward to ensure that all grant funds are properly expended within the allowable period of performance. It should be noted that Oklahoma Office of Management Enterprise Services did not review any of the submitted information to determine eligibility prior to sending reimbursements for items that have now been determined questionable. County Clerk: Documentation was scanned into the Purchase Order’s images and once the Purchase Order was paid, the images were then deleted by the Board of County Commissioners secretary. Images were later recovered by the software system and since the incident, restrictions have been implemented to no longer allow deletions. Criteria: 2 CFR § 200.303(a) - Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR § 200.403 - Factors affecting allowability costs states in part, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (g) Be adequately documented. The Department of the Treasury Federal Register, Vol. 86, No. 10 states, “Fund payments may not be used for expenses that have been or will be reimbursed by another federal program.” Additional guidance provided in the Subrecipient Agreement - Federal Funding Certification executed 6/3/20 between Muskogee County and the State of Oklahoma states in part, “4.Funds provided as direct payment from the State of Oklahoma pursuant to this certification for necessary expenditures that were or will be incurred during the period that begins on March 1, 2020, and ending on December 30, 2020, that are not expended on those necessary expenditures on or before March 31, 2021, by the political subdivision or its grantee(s), must be returned to the State of Oklahoma on or before April 1, 2021.”, 5. Funds provided as a direct payment from the State of Oklahoma pursuant to this certification must adhere to official federal guidance issued or to be issued on what constitutes a necessary expenditure. Any funds expended by a political subdivision or its grantee(s) in any manner that does not adhere to official federal guidance or in violation of this certification shall be returned to the State of Oklahoma Coronavirus Relief Fund. 6. Any local government entity receiving funds pursuant to this certification shall retain documentation of all uses of the funds… 8. Any funds provided pursuant to this certification cannot be used as a revenue replacement for lower than expected tax or other revenue collections. 10. I acknowledge and certify that Recipient has not received, and will not apply for, federal funds from any other source, to reimburse it for the expenditures for which funds are sought pursuant hereto.”

Finding 2021-010 – Lack of Internal Controls Over Schedule of Expenditures of Federal Awards PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management: Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD NUMBER: Oklahoma Cares PPE – Reimbursement 2020; 4530-DR-OK SA-2242 FEDERAL AWARD YEAR: 2020 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: $-0- Condition: During our audit, we identified federal programs that were not listed accurately on the County’s Schedule of Expenditures of Federal Awards (SEFA). Federal expenditures were understated by $532,307. The following misstatements were noted: Expenditures: • The actual expenditures for Coronavirus Relief Fund, ALN 21.019, were $774,579, the County reported $241,966, which understated expenditures by $532,613. • The actual expenditures for Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, were $2,437, the County reported $2,807, which overstated expenditures by $370. • The actual expenditures for FEMA – Public Assistance DR-4438, Disaster Grants – Public Assistance (Presidentially Declared Disasters), ALN 97.036, were $$60,394, the County reported $46,703, which understated expenditures by $13,691. • The actual expenditures of FEMA – Category B DR-4438 ALN 97.067 were $0, the County reported $8,342, which overstated expenditures by $8,342. • The actual expenditures for FEMA – Public Assistance OEM DR – 4453 ALN 97.036 were $0, the County reported $870, which overstated expenditures by $870. • The actual expenditures for COVID-19 FEMA-Public Assistance DR-4530, Disaster Grants – Public Assistance (Presidentially Declared Disasters), ALN 97.036, were $28,063, the County reported $21,047, which understated expenditures by $7,016. • The actual expenditures for Emergency Management Performance Grant, ALN 97.042, were $45,000, the County reported $56,250, which overstated expenditures by $11,250. • The actual expenditures for Fire Management Assistance Grand, ALN 97.046, were $0, the County reported $181, which overstated expenditures by $181. Cause of Condition: Policies and procedures have not been designed and implemented to ensure an accurate reporting of expenditures for federal awards. Effect of Condition: These conditions resulted in the misstatement of the expenditures reported on the County’s SEFA and could increase the potential for material noncompliance. Recommendation: OSAI recommends county officials and department heads gain an understanding of federal programs awarded to Washington County. Internal control procedures should be designed and implemented to ensure accurate reporting of expenditures on the SEFA and to ensure compliance with federal requirements. Management Response: District 1 County Commissioner: Not by way of excuse, but truly in response, the Federal programs associated with the COVID response were unnecessarily arduous and created confusion at all levels of government. While the monetary response was accepted, the premise of these programs was nothing more than an administrative shell game. From the outset of the response, guidance was termed as “interim”, then “final interim” and finally, “final” (redundancy intentional). The intent of our national level leadership became more apparent as these programs progressed with each iteration of programming being reliant on returned funds from the previous. Without grandstanding, I will simply say that no entity, regardless of their planning with these programs, will be found as fully compliant. As these programs have a sunset in the near term, I suspect these findings will disappear. District 2 County Commissioner: I was not in office at this time; however, I will work with other elected officials, county officials and department heads to ensure there is an understanding of federal programs awarded to Washington County, and the use of internal control procedures designed and implemented to ensure accurate reporting of expenditures and revenues on the SEFA and to ensure compliance with federal requirements. District 3 County Commissioner: These programs are temporary and difficult to navigate through. I will continue to press staff to report effectively as possible and to be responsive to specific requests that are made. County Clerk: I will work with the other Elected Officials to gain a better understanding of federal programs that are awarded to our County. I will work with the other offices to implement internal controls to ensure accurate reporting on the SEFA. County Sheriff: I have and will continue to work toward compliance in these areas of SEFA. I will continue to work with the other elected officials to gain proper understanding of Federal Programs and Requirements. Criteria: Title 2 CFR 200 § 200.210(a)(b) Financial Statements reads as follows: (a) Financial statements. The auditee must prepare financial statements that reflect its financial position, results of operations or changes in net assets, and where appropriate, cash flows for the fiscal year audited. The financial statements must be for the same organizational unit and fiscal year that is chosen to meet the requirements of this part. However, non-Federal entity-wide financial statements may also include departments, agencies, and other organizational units that have separate audits in accordance with §200.514 Scope of audit, paragraph (a) and prepare separate financial statements. (b) Schedule of expenditures of federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statement, which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR § 200.508(b) Auditee responsibilities reads as follows: The auditee must: Prepare appropriate financial statements, including the schedule of expenditures of Federal awards in accordance with §200.510 Financial statements. 2 CFR § 200.510 (b) Financial statements reads as follows: Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. [….] Additionally, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.23 states in part: Objectives of an Entity – Compliance Objectives Management conducts activities in accordance with applicable laws and regulations. As part of specifying compliance objectives, the entity determines which laws and regulations apply to the entity. Management is expected to set objectives that incorporate these requirements. Furthermore, GAO Standards – Principle 6 – Define Objectives and Risk Tolerances – 6.05 states: Definitions of Objectives Management considers external requirements and internal expectations when defining objectives to enable the design of internal control. Legislators, regulators, and standardsetting bodies set external requirements by establishing the laws, regulations, and standards with which the entity is required to comply. Management identifies, understands, and incorporates these requirements into the entity’s objectives. Management sets internal expectations and requirements through the established standards of conduct, oversight structure, organizational structure, and expectations of competence as part of the control environment.

Finding 2021-011 – Lack of County-Wide Controls Over Major Federal Program – Coronavirus Relief Fund PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management; Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD NUMBER: Oklahoma CARES PPE – Reimbursement 2020; 4530-DR-OK; SA- 2242 FEDERAL AWARD YEAR: 2020 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: - $0 - Condition: Through the process of gaining an understanding of the County’s internal control structure for federal programs, it was noted that county-wide internal controls regarding Control Environment, Risk Assessment, Information and Communication, and Monitoring have not been designed. The following deficiencies were noted: • The BOCC is aware there are compliance supplement requirements; however, they are not aware of the specifics of the requirements. There is no evidence the BOCC looked over submissions to ensure they were in compliance with federal guidance prior to submission to the awarding agency. • The County did start keeping a reconciliation of federal expenditures; however, it was not accurate with the expenditures submitted, and the County did not continue to update to include the Sheriff Office payroll. Additionally, there is no evidence of a BOCC review. • The risks of incorrect financial reporting, resulting from fraud or error for the SEFA are not addressed verbally or in written communication. • The County is relying on the Clerk and Treasurer to ensure the accuracy of the SEFA. Cause of Condition: Policies and procedures have not been designed and implemented to ensure the County complies with grant requirements. Effect of Condition: Without an adequate system of county-wide controls, there is greater risk of a breakdown in control activities which could result in unrecorded transactions, undetected errors, misappropriation of funds, and noncompliance with federal grant requirements. Recommendation: OSAI recommends that the County implement a system of internal controls to ensure compliance with grant requirements. Management Response: District 1 County Commissioner: Not by way of excuse, but truly in response, the Federal programs associated with the COVID response were unnecessarily arduous and created confusion at all levels of government. While the monetary response was accepted, the premise of these programs was nothing more than an administrative shell game. From the outset of the response, guidance was termed as “interim”, then “final interim” and finally, “final” (redundancy intentional). The intent of our national level leadership became more apparent as these programs progressed with each iteration of programming being reliant on returned funds from the previous. Without grandstanding, I will simply say that no entity, regardless of their planning with these programs, will be found as fully compliant. As these programs have a sunset in the near term, I suspect these findings will disappear. District 2 County Commissioner: I was not in office the year audited, but I will work with the other elected officials to implement a system of internal controls to ensure compliance with grant requirements. District 3 County Commissioner: I will work with the other elected officials creating internal controls to ensure compliance with grant requirements. Criteria: The GAO Standards – Section 1 – Fundamental Concepts of Internal Control – OV1.01 states in part: Definition of Internal Control Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. Additionally, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.04 states in part: Components, Principles, and Attributes Control Environment - The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives. Risk Assessment - Assesses the risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses. Information and Communication - The quality information management and personnel communicate and use to support the internal control system. Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews. Furthermore, 2 CFR § 200.303 Internal Controls (a) reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

Finding 2021-012 – Lack of Internal Controls Over Major Federal Program – Coronavirus Relief Fund PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management; Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD NUMBER: Oklahoma CARES PPE – Reimbursement 2020; 4530-DR-OK; SA- 2242 FEDERAL AWARD YEAR: 2020 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: -$0- Condition: During the process of documenting the County’s internal controls regarding federal disbursements, we noted that Washington County has not established procedures to ensure compliance with the following compliance requirements: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance. • Expenditures are not reviewed for Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance. • The County did not maintain an accurate and up to date reconciliation of expenditures in regard to the Coronavirus Relief Fund. • No internal controls were present to identify which costs were Allowable, and for the correct amounts for the Coronavirus Relief Fund. o The County submitted $948,512 in expenditures related to COVID-19 of which only $744,579 were obligated to be reimbursed. o The County submitted $14,606 in COVID-19 related PPE expenditures of which only $13,888 was awarded. • The County did not follow proper purchasing procedures; two (2) expenditures totaling $1,149 were not encumbered prior to the receipt of goods/services: Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal program expenditures are made in accordance with federal compliance requirements. Effect of Condition: This condition attributed to the noncompliance with grant requirements and could lead to the loss of federal funds to the County. Recommendation: OSAI recommends the County gain an understanding of requirements for this program and implement internal control procedures to ensure compliance with all requirements. Management Response: District 1 County Commissioner: Not by way of excuse, but truly in response, the Federal programs associated with the COVID response were unnecessarily arduous and created confusion at all levels of government. While the monetary response was accepted, the premise of these programs was nothing more than an administrative shell game. From the outset of the response, guidance was termed as “interim”, then “final Interim” and finally, “final” (redundancy intentional). The intent of our national level leadership became more apparent as these programs progressed with each iteration of programming being reliant on returned funds from the previous. Without grandstanding, I will simply say that no entity, regardless of their planning with these programs, will be found as fully compliant. As these programs have a sunset in the near term, I suspect these findings will disappear. District 2 County Commissioner: I was not in office the year audited but will work with the other elected officials to ensure the county gains an understanding of requirements for the program and implement internal control procedures to ensure compliance with all requirements. District 3 County Commissioner: As elected officials, we will implement internal controls to ensure compliance for this one-time type of grant. Criteria: 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The GAO Standards – Section 1 – Fundamental Concepts of Internal Control – OV1.01 states in part: Definition of Internal Control Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. Additionally, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.04 states in part: Components, Principles, and Attributes Control Activities – The actions management establishes through policies and procedures to achieve objectives and respond to risks in the internal control system, which includes the entity’s information system.

Finding 2021-006: Cash Management - Material Weakness Grantor: U.S. Department of Health and Human Services Federal Program Names: Health Center Program Cluster: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) COVID-19 Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) Grants for New and Expanded Services under the Health Center Program Federal Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number and Year: H80CS26638 - 2020 and 2021, H8DCS35487 - 2020, H8CCS34364 - 2020, H8ECS38373 - 2020, and H8F40829 - 2021 Criteria In accordance with §200.305, Federal payment, grantees and subgrantees that receive grant funds are responsible for maintaining controls regarding the management of federal program funds under the Uniform Guidance in 2 CFR 200.302 and 200.303. Condition The Center's drawdowns did not illustrate review and approval by management. Cause The Center did not have adequate controls to ensure drawdowns were properly approved and such approval is documented. Effect The condition may lead to inaccurate or improper drawdowns. Questioned Costs None. Context We selected seven drawdowns for testing of cash management. We noted there was no formal approval or evidence of review for these drawdowns. Identification of Repeat Finding Yes, see finding 2020-006. Recommendation The Center should develop written procedures to review all drawdowns that occur in order to ensure accuracy. Views of Responsible Officials Management and the Board of Directors agree with the finding and will implement additional controls to ensure there is formal evidence of review being performed.

Finding 2021-006: Cash Management - Material Weakness Grantor: U.S. Department of Health and Human Services Federal Program Names: Health Center Program Cluster: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) COVID-19 Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) Grants for New and Expanded Services under the Health Center Program Federal Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number and Year: H80CS26638 - 2020 and 2021, H8DCS35487 - 2020, H8CCS34364 - 2020, H8ECS38373 - 2020, and H8F40829 - 2021 Criteria In accordance with §200.305, Federal payment, grantees and subgrantees that receive grant funds are responsible for maintaining controls regarding the management of federal program funds under the Uniform Guidance in 2 CFR 200.302 and 200.303. Condition The Center's drawdowns did not illustrate review and approval by management. Cause The Center did not have adequate controls to ensure drawdowns were properly approved and such approval is documented. Effect The condition may lead to inaccurate or improper drawdowns. Questioned Costs None. Context We selected seven drawdowns for testing of cash management. We noted there was no formal approval or evidence of review for these drawdowns. Identification of Repeat Finding Yes, see finding 2020-006. Recommendation The Center should develop written procedures to review all drawdowns that occur in order to ensure accuracy. Views of Responsible Officials Management and the Board of Directors agree with the finding and will implement additional controls to ensure there is formal evidence of review being performed.

Finding 2021-006: Cash Management - Material Weakness Grantor: U.S. Department of Health and Human Services Federal Program Names: Health Center Program Cluster: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) COVID-19 Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) Grants for New and Expanded Services under the Health Center Program Federal Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number and Year: H80CS26638 - 2020 and 2021, H8DCS35487 - 2020, H8CCS34364 - 2020, H8ECS38373 - 2020, and H8F40829 - 2021 Criteria In accordance with §200.305, Federal payment, grantees and subgrantees that receive grant funds are responsible for maintaining controls regarding the management of federal program funds under the Uniform Guidance in 2 CFR 200.302 and 200.303. Condition The Center's drawdowns did not illustrate review and approval by management. Cause The Center did not have adequate controls to ensure drawdowns were properly approved and such approval is documented. Effect The condition may lead to inaccurate or improper drawdowns. Questioned Costs None. Context We selected seven drawdowns for testing of cash management. We noted there was no formal approval or evidence of review for these drawdowns. Identification of Repeat Finding Yes, see finding 2020-006. Recommendation The Center should develop written procedures to review all drawdowns that occur in order to ensure accuracy. Views of Responsible Officials Management and the Board of Directors agree with the finding and will implement additional controls to ensure there is formal evidence of review being performed.

Finding 2021-006: Cash Management - Material Weakness Grantor: U.S. Department of Health and Human Services Federal Program Names: Health Center Program Cluster: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) COVID-19 Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) Grants for New and Expanded Services under the Health Center Program Federal Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number and Year: H80CS26638 - 2020 and 2021, H8DCS35487 - 2020, H8CCS34364 - 2020, H8ECS38373 - 2020, and H8F40829 - 2021 Criteria In accordance with §200.305, Federal payment, grantees and subgrantees that receive grant funds are responsible for maintaining controls regarding the management of federal program funds under the Uniform Guidance in 2 CFR 200.302 and 200.303. Condition The Center's drawdowns did not illustrate review and approval by management. Cause The Center did not have adequate controls to ensure drawdowns were properly approved and such approval is documented. Effect The condition may lead to inaccurate or improper drawdowns. Questioned Costs None. Context We selected seven drawdowns for testing of cash management. We noted there was no formal approval or evidence of review for these drawdowns. Identification of Repeat Finding Yes, see finding 2020-006. Recommendation The Center should develop written procedures to review all drawdowns that occur in order to ensure accuracy. Views of Responsible Officials Management and the Board of Directors agree with the finding and will implement additional controls to ensure there is formal evidence of review being performed.

Finding 2021-006: Cash Management - Material Weakness Grantor: U.S. Department of Health and Human Services Federal Program Names: Health Center Program Cluster: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) COVID-19 Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) Grants for New and Expanded Services under the Health Center Program Federal Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number and Year: H80CS26638 - 2020 and 2021, H8DCS35487 - 2020, H8CCS34364 - 2020, H8ECS38373 - 2020, and H8F40829 - 2021 Criteria In accordance with §200.305, Federal payment, grantees and subgrantees that receive grant funds are responsible for maintaining controls regarding the management of federal program funds under the Uniform Guidance in 2 CFR 200.302 and 200.303. Condition The Center's drawdowns did not illustrate review and approval by management. Cause The Center did not have adequate controls to ensure drawdowns were properly approved and such approval is documented. Effect The condition may lead to inaccurate or improper drawdowns. Questioned Costs None. Context We selected seven drawdowns for testing of cash management. We noted there was no formal approval or evidence of review for these drawdowns. Identification of Repeat Finding Yes, see finding 2020-006. Recommendation The Center should develop written procedures to review all drawdowns that occur in order to ensure accuracy. Views of Responsible Officials Management and the Board of Directors agree with the finding and will implement additional controls to ensure there is formal evidence of review being performed.

Finding 2021-006: Cash Management - Material Weakness Grantor: U.S. Department of Health and Human Services Federal Program Names: Health Center Program Cluster: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) COVID-19 Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) Grants for New and Expanded Services under the Health Center Program Federal Assistance Listing Numbers: 93.224 and 93.527 Federal Award Identification Number and Year: H80CS26638 - 2020 and 2021, H8DCS35487 - 2020, H8CCS34364 - 2020, H8ECS38373 - 2020, and H8F40829 - 2021 Criteria In accordance with §200.305, Federal payment, grantees and subgrantees that receive grant funds are responsible for maintaining controls regarding the management of federal program funds under the Uniform Guidance in 2 CFR 200.302 and 200.303. Condition The Center's drawdowns did not illustrate review and approval by management. Cause The Center did not have adequate controls to ensure drawdowns were properly approved and such approval is documented. Effect The condition may lead to inaccurate or improper drawdowns. Questioned Costs None. Context We selected seven drawdowns for testing of cash management. We noted there was no formal approval or evidence of review for these drawdowns. Identification of Repeat Finding Yes, see finding 2020-006. Recommendation The Center should develop written procedures to review all drawdowns that occur in order to ensure accuracy. Views of Responsible Officials Management and the Board of Directors agree with the finding and will implement additional controls to ensure there is formal evidence of review being performed.

PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management; Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: $-0- Condition: During our review and reconciliation of the SEFA, as initially prepared by the County, we identified federal programs that were not reported accurately. These errors resulted in expenditures being understated by $3,828,046. Cause of Condition: Policies and procedures have not been designed and implemented to ensure accurate reporting of expenditures for all federal awards. Effect of Condition: This condition resulted in inaccurate recording of expenditures on the SEFA and could increase the potential for material noncompliance. Recommendation: OSAI recommends county officials and department heads gain an understanding of federal programs awarded to Rogers County. Internal control procedures should be designed and implemented to ensure an accurate reporting of expenditures on the SEFA and to ensure compliance with federal requirements. Management Response: Board of County Commissioners: The BOCC is responsible for the overall fiscal concerns of the county. See OKLA. STAT. Title 19, § 345. The BOCC, with the cooperation and participation of all elected officials, reviews, develops and implements policies and procedures to create a strong internal control environment. Additionally, the BOCC conducts meetings with all elected officials and officers responsible for the receipt and/or expenditure of county funds. These meetings address fiscal matters, including but not limited to, policy discussions and implementation, financial reports, budget oversight, SEFA reporting, and legal compliance. Policies and procedures, combined with fiscal oversight meetings, are intended to: 1) prevent or detect material misstatements in the financial statements; 2) prevent or detect fraud within the county; 3) increase communication between the BOCC and those elected officials and officers responsible for the receipt and/or expenditure of public funds; 4) provide oversight over the fiscal concerns of the county; 5) identify and address risks related to financial reporting; 6) ensure the accuracy of Rogers County’s financial statements, Estimate of Needs, the SEFA; and 7) ensure compliance with all applicable federal and state laws, regulations, and/or codes. The BOCC is responsible for preparing the financial statements. See OKLA. STAT. Title 68, § 3002(A). At the end of fiscal year 2020, the BOCC chose not to renew the contract with the budget maker. Beginning in fiscal year 2021, the BOCC and the Rogers County Treasurer developed and implemented a plan for the preparation and presentation of the financial statements by the Rogers County Treasurer beginning in fiscal year 2021. The purpose of this plan was to increase communication, involvement and oversight regarding the County’s financial condition and for better accuracy and timeliness of the preparation and presentation of the financial statements. The BOCC, with the cooperation of all elected officials and officers responsible for the receipt or expenditure of county funds, will evaluate the processes and procedures currently in place to detect and identify material misstatements in Rogers County’s financial statements, detect fraud, and identify and address risks related to Rogers County’s financial reporting. Where deficiencies are identified, processes and procedures will be implemented to identify fraud, detect material misstatements in the financial statements, and address risks related to financial reporting. County Clerk: The County Clerk works with the BOCC and all elected officials to develop and implement policies and procedures to prevent material misstatements in Rogers County’s financial statements, detect fraud and identify and address risks related to Rogers County’s financial reporting. These policies are intended to ensure the accuracy of the County’s financial statements, Estimate of Needs, SEFA, and compliance with all applicable federal and state laws, regulations, and/or codes. The County Clerk will continue to perform the duties of her office in accordance with Oklahoma law. Where appropriate, the County Clerk will participate in the development and implementation of policies and procedures to prevent material misstatements in Rogers County’s financial statements, detect fraud and identify and address risks related to Rogers County’s financial reporting. County Treasurer: The County Treasurer was engaged to compile the SEFA report. Each department is responsible for reporting its own Federal revenues and expenditures. County Sheriff: The County Sheriff will work with the BOCC and all elected officials to develop and implement policies and procedures to ensure Rogers County’s SEFA is prepared timely and accurately. Criteria: GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.23 states in part: Objectives of an Entity – Compliance Objectives Management conducts activities in accordance with applicable laws and regulations. As part of specifying compliance objectives, the entity determines which laws and regulations apply to the entity. Management is expected to set objectives that incorporate these requirements. 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR § 200.508(b) Auditee responsibilities reads as follows: The auditee must: Prepare appropriate financial statements, including the schedule of expenditures of Federal awards in accordance with §200.510 Financial statements. 2 CFR § 200.510(b) Financial statements reads as follows: Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended.

PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management; Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: -$0- Condition: Through the process of gaining an understanding of the County’s internal control structure for federal programs, it was noted that county-wide internal controls regarding Control Environment, Risk Assessment, Information and Communication, and Monitoring have not been designed. Cause of Condition: Policies and procedures have not been designed and implemented to ensure the County complies with grant requirements. Effect of Condition: This condition could result in noncompliance to grant requirements and loss of federal funds. Recommendation: OSAI recommends that the County design and implement a system of internal controls to ensure compliance with grant requirements. Management Response: Board of County Commissioners: The BOCC is responsible for the overall fiscal concerns of the county. See OKLA. STAT. Title 19, § 345. The BOCC, with the cooperation and participation of all elected officials, reviews, develops and implements policies and procedures to create a strong internal control environment. The BOCC will work with all elected officials and with the state and local partners in each federal award to develop policies, procedures, and internal controls designed to accurately track grants, including the application process, verification, oversight, and reporting of grant requirements. These policies and procedures will be designed to identify requirements for recipients and sub-recipients of grants, ensure accurate equipment and real property management, procurement, recipient and subrecipient monitoring and reporting. Further, policies will ensure a proper understanding of all grant requirements and compliance of the same. Criteria: The GAO Standards – Section 1 – Fundamental Concepts of Internal Control – OV1.01 states in part: Definition of Internal Control Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. Additionally, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.04 states in part: Components, Principles, and Attributes Control Environment - The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives. Risk Assessment - Assesses the risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses. Information and Communication - The quality information management and personnel communicate and use to support the internal control system. Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews. Furthermore, 2 CFR § 200.303 Internal Controls (a) reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management; Oklahoma Office Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: $-0- Condition: During the process of documenting the County’s internal controls regarding federal disbursements, we noted that Rogers County has not established procedures to ensure compliance with the following compliance requirements: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal program expenditures are made in accordance with federal compliance requirements. Effect of Condition: This condition attributed to the noncompliance with grant requirements and could lead to the loss of federal funds to the County. Recommendation: OSAI recommends the County gain an understanding of requirements for this program and implement internal control procedures to ensure compliance with all requirements. Management Response: Board of County Commissioners: The BOCC is responsible for the overall fiscal concerns of the county. See OKLA. STAT. Title 19, § 345. The BOCC, with the cooperation and participation of all elected officials, reviews, develops and implements policies and procedures to create a strong internal control environment. The BOCC will work with all elected officials and with the state and local partners in each federal award to develop policies, procedures, and internal controls designed to accurately track grants, including the application process, verification, oversight, and reporting of grant requirements. These policies and procedures will be designed to identify requirements for recipients and sub-recipients of grants, ensure accurate equipment and real property management, procurement, recipient and subrecipient monitoring and reporting. Further, policies will ensure a proper understanding of all grant requirements and compliance of the same. Criteria: 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The GAO Standards – Section 1 – Fundamental Concepts of Internal Control – OV1.01 states in part: Definition of Internal Control Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. Additionally, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.04 states in part: Components, Principles, and Attributes Control Activities – The actions management establishes through policies and procedures to achieve objectives and respond to risks in the internal control system, which includes the entity’s information system.

PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management and Oklahoma Office and Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING NO: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: $731,856 Condition: The County submitted and received reimbursement for $4,244,344 in expenditures related to the COVID-19 Pandemic. After performing testwork on 100% of the County’s expenditures, $731,856 was not expended in accordance with the Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance due to ineligible costs. • The County was reimbursed $630,738 for payroll expenditures for the Northeast Oklahoma Enhanced 9-1-1 Trust Authority for the period of March 2020, through August 2020. The reimbursement of these funds was determined to be unallowable, as these costs were not expenditures of the County. • The County was reimbursed $63,000 for the October 2020 payment to the Tulsa Port of Catoosa (the Port) for proposed project costs of the Port. The reimbursement of these funds was determined to be unallowable, as this cost was not an allowable cost of Rogers County. • The County was reimbursed $24,620 for the September 2020 payment to the Rogers County Youth Services for estimated COVID related expenses of Rogers County Youth Services. The reimbursement of these funds was determined to be unallowable, as this cost was not an allowable cost of Rogers County. • The County was reimbursed $7,821 for the September 2020 payment to the City of Claremore for advertising expenses of the City of Claremore. The reimbursement of these funds was determined to be unallowable, as this cost was not an allowable cost of Rogers County. • The County was reimbursed $5,455 for duplicate expenses submitted between August 2020 and October 2020. • The County was reimbursed $650 for office supplies and equipment purchased in August 2020 when actual cost of the supplies and equipment was $428 causing the County to be reimbursed $222 more than allowed. • The County relied on the Oklahoma Office of Management and Enterprise Services to ensure that the County reimbursement request was for eligible expenditures. Cause of Condition: Policies and procedures have not been designed and implemented to ensure that the County has proper internal controls over federal grant expenditures and that the expenditures were for an allowable cost. Effect of Condition: These conditions resulted in noncompliance with federal grant requirements. The County runs the risk of misappropriation of funds which could hinder the County from receiving future federal funding. Further, this could result in the repayment of funds. Recommendation: OSAI recommends the County gain an understanding of requirements for this program and design and implement policies and procedures to ensure compliance with all applicable grant requirements. Management Response: Board of County Commissioners: The BOCC is responsible for the overall fiscal concerns of the county. See OKLA. STAT. Title 19, § 345. The BOCC, with the cooperation and participation of all elected officials, reviews, develops and implements policies and procedures to create a strong internal control environment. The BOCC will work with all elected officials and with the state and local partners in each federal award to develop policies, procedures, and internal controls designed to accurately track grants, including the application process, verification, oversight, and reporting of grant requirements. These policies and procedures will be designed to identify requirements for recipients and sub-recipients of grants, ensure accurate equipment and real property management, procurement, recipient and subrecipient monitoring and reporting. Further, policies will ensure a proper understanding of all grant requirements and compliance of the same. The BOCC engaged a third party to assist in program evaluation, determination of eligible costs, subrecipient oversight and tracking, and grant documentation and reporting. Based on the third party’s qualifications and experience, the BOCC relied upon the experience and expertise of the third party to oversee COVID-19 funds. Further, with respect to submissions to the Oklahoma Office of Management and Enterprise Services (OMES), the BOCC relied on OMES to ensure that expenses submitted for reimbursement were eligible expenses. Criteria: 42 United States Code § 801 – Coronavirus relief fund Section 801(d) requires the States, Tribal governments, or units of local government use the funds received to cover only those costs that (1) are necessary expenditures incurred due to the public health emergency with respect to the Coronavirus Disease 2019 (COVID-19); (2) were not accounted for in the budget most recently approved as of March 27, 2020, for the State or government; and (3) were incurred during the period that begins on March 1, 2020, and ends on December 30, 2020. Additionally, 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR § 200.403 - Factors affecting allowability costs states in relevant part, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (f) not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented.

PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management; Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: $-0- Condition: During our review and reconciliation of the SEFA, as initially prepared by the County, we identified federal programs that were not reported accurately. These errors resulted in expenditures being understated by $3,828,046. Cause of Condition: Policies and procedures have not been designed and implemented to ensure accurate reporting of expenditures for all federal awards. Effect of Condition: This condition resulted in inaccurate recording of expenditures on the SEFA and could increase the potential for material noncompliance. Recommendation: OSAI recommends county officials and department heads gain an understanding of federal programs awarded to Rogers County. Internal control procedures should be designed and implemented to ensure an accurate reporting of expenditures on the SEFA and to ensure compliance with federal requirements. Management Response: Board of County Commissioners: The BOCC is responsible for the overall fiscal concerns of the county. See OKLA. STAT. Title 19, § 345. The BOCC, with the cooperation and participation of all elected officials, reviews, develops and implements policies and procedures to create a strong internal control environment. Additionally, the BOCC conducts meetings with all elected officials and officers responsible for the receipt and/or expenditure of county funds. These meetings address fiscal matters, including but not limited to, policy discussions and implementation, financial reports, budget oversight, SEFA reporting, and legal compliance. Policies and procedures, combined with fiscal oversight meetings, are intended to: 1) prevent or detect material misstatements in the financial statements; 2) prevent or detect fraud within the county; 3) increase communication between the BOCC and those elected officials and officers responsible for the receipt and/or expenditure of public funds; 4) provide oversight over the fiscal concerns of the county; 5) identify and address risks related to financial reporting; 6) ensure the accuracy of Rogers County’s financial statements, Estimate of Needs, the SEFA; and 7) ensure compliance with all applicable federal and state laws, regulations, and/or codes. The BOCC is responsible for preparing the financial statements. See OKLA. STAT. Title 68, § 3002(A). At the end of fiscal year 2020, the BOCC chose not to renew the contract with the budget maker. Beginning in fiscal year 2021, the BOCC and the Rogers County Treasurer developed and implemented a plan for the preparation and presentation of the financial statements by the Rogers County Treasurer beginning in fiscal year 2021. The purpose of this plan was to increase communication, involvement and oversight regarding the County’s financial condition and for better accuracy and timeliness of the preparation and presentation of the financial statements. The BOCC, with the cooperation of all elected officials and officers responsible for the receipt or expenditure of county funds, will evaluate the processes and procedures currently in place to detect and identify material misstatements in Rogers County’s financial statements, detect fraud, and identify and address risks related to Rogers County’s financial reporting. Where deficiencies are identified, processes and procedures will be implemented to identify fraud, detect material misstatements in the financial statements, and address risks related to financial reporting. County Clerk: The County Clerk works with the BOCC and all elected officials to develop and implement policies and procedures to prevent material misstatements in Rogers County’s financial statements, detect fraud and identify and address risks related to Rogers County’s financial reporting. These policies are intended to ensure the accuracy of the County’s financial statements, Estimate of Needs, SEFA, and compliance with all applicable federal and state laws, regulations, and/or codes. The County Clerk will continue to perform the duties of her office in accordance with Oklahoma law. Where appropriate, the County Clerk will participate in the development and implementation of policies and procedures to prevent material misstatements in Rogers County’s financial statements, detect fraud and identify and address risks related to Rogers County’s financial reporting. County Treasurer: The County Treasurer was engaged to compile the SEFA report. Each department is responsible for reporting its own Federal revenues and expenditures. County Sheriff: The County Sheriff will work with the BOCC and all elected officials to develop and implement policies and procedures to ensure Rogers County’s SEFA is prepared timely and accurately. Criteria: GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.23 states in part: Objectives of an Entity – Compliance Objectives Management conducts activities in accordance with applicable laws and regulations. As part of specifying compliance objectives, the entity determines which laws and regulations apply to the entity. Management is expected to set objectives that incorporate these requirements. 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR § 200.508(b) Auditee responsibilities reads as follows: The auditee must: Prepare appropriate financial statements, including the schedule of expenditures of Federal awards in accordance with §200.510 Financial statements. 2 CFR § 200.510(b) Financial statements reads as follows: Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended.

PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management; Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: -$0- Condition: Through the process of gaining an understanding of the County’s internal control structure for federal programs, it was noted that county-wide internal controls regarding Control Environment, Risk Assessment, Information and Communication, and Monitoring have not been designed. Cause of Condition: Policies and procedures have not been designed and implemented to ensure the County complies with grant requirements. Effect of Condition: This condition could result in noncompliance to grant requirements and loss of federal funds. Recommendation: OSAI recommends that the County design and implement a system of internal controls to ensure compliance with grant requirements. Management Response: Board of County Commissioners: The BOCC is responsible for the overall fiscal concerns of the county. See OKLA. STAT. Title 19, § 345. The BOCC, with the cooperation and participation of all elected officials, reviews, develops and implements policies and procedures to create a strong internal control environment. The BOCC will work with all elected officials and with the state and local partners in each federal award to develop policies, procedures, and internal controls designed to accurately track grants, including the application process, verification, oversight, and reporting of grant requirements. These policies and procedures will be designed to identify requirements for recipients and sub-recipients of grants, ensure accurate equipment and real property management, procurement, recipient and subrecipient monitoring and reporting. Further, policies will ensure a proper understanding of all grant requirements and compliance of the same. Criteria: The GAO Standards – Section 1 – Fundamental Concepts of Internal Control – OV1.01 states in part: Definition of Internal Control Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. Additionally, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.04 states in part: Components, Principles, and Attributes Control Environment - The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives. Risk Assessment - Assesses the risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses. Information and Communication - The quality information management and personnel communicate and use to support the internal control system. Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews. Furthermore, 2 CFR § 200.303 Internal Controls (a) reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management; Oklahoma Office Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: $-0- Condition: During the process of documenting the County’s internal controls regarding federal disbursements, we noted that Rogers County has not established procedures to ensure compliance with the following compliance requirements: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal program expenditures are made in accordance with federal compliance requirements. Effect of Condition: This condition attributed to the noncompliance with grant requirements and could lead to the loss of federal funds to the County. Recommendation: OSAI recommends the County gain an understanding of requirements for this program and implement internal control procedures to ensure compliance with all requirements. Management Response: Board of County Commissioners: The BOCC is responsible for the overall fiscal concerns of the county. See OKLA. STAT. Title 19, § 345. The BOCC, with the cooperation and participation of all elected officials, reviews, develops and implements policies and procedures to create a strong internal control environment. The BOCC will work with all elected officials and with the state and local partners in each federal award to develop policies, procedures, and internal controls designed to accurately track grants, including the application process, verification, oversight, and reporting of grant requirements. These policies and procedures will be designed to identify requirements for recipients and sub-recipients of grants, ensure accurate equipment and real property management, procurement, recipient and subrecipient monitoring and reporting. Further, policies will ensure a proper understanding of all grant requirements and compliance of the same. Criteria: 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The GAO Standards – Section 1 – Fundamental Concepts of Internal Control – OV1.01 states in part: Definition of Internal Control Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. Additionally, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.04 states in part: Components, Principles, and Attributes Control Activities – The actions management establishes through policies and procedures to achieve objectives and respond to risks in the internal control system, which includes the entity’s information system.

PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management and Oklahoma Office and Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING NO: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; and Period of Performance QUESTIONED COSTS: $731,856 Condition: The County submitted and received reimbursement for $4,244,344 in expenditures related to the COVID-19 Pandemic. After performing testwork on 100% of the County’s expenditures, $731,856 was not expended in accordance with the Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance due to ineligible costs. • The County was reimbursed $630,738 for payroll expenditures for the Northeast Oklahoma Enhanced 9-1-1 Trust Authority for the period of March 2020, through August 2020. The reimbursement of these funds was determined to be unallowable, as these costs were not expenditures of the County. • The County was reimbursed $63,000 for the October 2020 payment to the Tulsa Port of Catoosa (the Port) for proposed project costs of the Port. The reimbursement of these funds was determined to be unallowable, as this cost was not an allowable cost of Rogers County. • The County was reimbursed $24,620 for the September 2020 payment to the Rogers County Youth Services for estimated COVID related expenses of Rogers County Youth Services. The reimbursement of these funds was determined to be unallowable, as this cost was not an allowable cost of Rogers County. • The County was reimbursed $7,821 for the September 2020 payment to the City of Claremore for advertising expenses of the City of Claremore. The reimbursement of these funds was determined to be unallowable, as this cost was not an allowable cost of Rogers County. • The County was reimbursed $5,455 for duplicate expenses submitted between August 2020 and October 2020. • The County was reimbursed $650 for office supplies and equipment purchased in August 2020 when actual cost of the supplies and equipment was $428 causing the County to be reimbursed $222 more than allowed. • The County relied on the Oklahoma Office of Management and Enterprise Services to ensure that the County reimbursement request was for eligible expenditures. Cause of Condition: Policies and procedures have not been designed and implemented to ensure that the County has proper internal controls over federal grant expenditures and that the expenditures were for an allowable cost. Effect of Condition: These conditions resulted in noncompliance with federal grant requirements. The County runs the risk of misappropriation of funds which could hinder the County from receiving future federal funding. Further, this could result in the repayment of funds. Recommendation: OSAI recommends the County gain an understanding of requirements for this program and design and implement policies and procedures to ensure compliance with all applicable grant requirements. Management Response: Board of County Commissioners: The BOCC is responsible for the overall fiscal concerns of the county. See OKLA. STAT. Title 19, § 345. The BOCC, with the cooperation and participation of all elected officials, reviews, develops and implements policies and procedures to create a strong internal control environment. The BOCC will work with all elected officials and with the state and local partners in each federal award to develop policies, procedures, and internal controls designed to accurately track grants, including the application process, verification, oversight, and reporting of grant requirements. These policies and procedures will be designed to identify requirements for recipients and sub-recipients of grants, ensure accurate equipment and real property management, procurement, recipient and subrecipient monitoring and reporting. Further, policies will ensure a proper understanding of all grant requirements and compliance of the same. The BOCC engaged a third party to assist in program evaluation, determination of eligible costs, subrecipient oversight and tracking, and grant documentation and reporting. Based on the third party’s qualifications and experience, the BOCC relied upon the experience and expertise of the third party to oversee COVID-19 funds. Further, with respect to submissions to the Oklahoma Office of Management and Enterprise Services (OMES), the BOCC relied on OMES to ensure that expenses submitted for reimbursement were eligible expenses. Criteria: 42 United States Code § 801 – Coronavirus relief fund Section 801(d) requires the States, Tribal governments, or units of local government use the funds received to cover only those costs that (1) are necessary expenditures incurred due to the public health emergency with respect to the Coronavirus Disease 2019 (COVID-19); (2) were not accounted for in the budget most recently approved as of March 27, 2020, for the State or government; and (3) were incurred during the period that begins on March 1, 2020, and ends on December 30, 2020. Additionally, 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR § 200.403 - Factors affecting allowability costs states in relevant part, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (f) not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented.

Department of Health and Human Services Federal Assistance Listing/CFDA #93.498 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 1 TIN #870212456 Activities Allowed or Unallowed and Allowable Cost/Cost Principles Significant Deficiency in Internal Control Over Compliance and Noncompliance Not Considered Material Criteria: CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The District claimed and reported expenditures that contained errors based upon the underlying documentation. Additionally, the District did not have internal controls in place to review and approve allowable expenditures separate from the preparer. Cause: The District had multiple individuals identifying and compiling eligible costs, however, the District did not have an internal control process in place to ensure a secondary review and approval of eligible expenditures that were summarized from the underlying supporting spreadsheets to the final expenditure listing. The summary spreadsheet was used to claim allowable costs under the federal program. Additionally, not all supporting documentation was retained. Effect: There is a potential that costs may be claimed and reported are not allowable or amounts claimed may not be supported during a subsequent examination. Questioned Costs: None reported. Context: A nonstatistical sample of 60 supplies, services, and payroll transactions out of a population of approximately 1,476 totaling $3,100,530 were selected for testing. The sample contained errors in two transactions in which the amounts claimed on the Period 1 report were not supported by invoices. The amounts claimed not supported by invoices totaled $2,097 out of a total sample value of $2,021,539. Repeat Finding from Prior Years: No Recommendation: We recommend the District modify internal control policies to ensure amounts claimed for this program agree to underlying documentation and to ensure the records are retained to support the amounts. Views of Responsible Officials: Management agrees with the finding.

Finding 2021-004 – Internal Controls and Noncompliance Over the Schedule of Expenditures of Federal Awards (SEFA) PASS THROUGH GRANTOR: Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of the Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance QUESTIONED COSTS: $-0- Condition: During our review and reconciliation of the Schedule of Expenditures of Federal Awards (SEFA) as initially prepared by the County, we identified federal programs that were not listed accurately which resulted in federal expenditures being understated by $180,089. Cause of Condition: Policies and procedures have not been designed and implemented to ensure accurate reporting of expenditures for all federal awards. Effect of Condition: This condition resulted in inaccurate recording of the federal expenditures on the SEFA. This condition could result in the failure to identify Single Audit requirements. Recommendation: OSAI recommends county officials and department heads gain an understanding of federal programs awarded to Choctaw County. Internal control policies and procedures should be designed and implemented to ensure accurate reporting of expenditures on the SEFA and to ensure compliance with federal requirements. Management Response: Chairman of the Board of County Commissioners: We will adopt procedures and implement to ensure accurate reporting of expenditures on the SEFA and to ensure compliance with federal requirements. County Clerk: We will pay more attention to what is being put on SEFA schedule. County Treasurer: I will do my part in correcting this issue to make sure that all qualifying expenditures are reported accurately in the future. Criteria: 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR § 200.508(b) Auditee responsibilities reads as follows: The auditee must: Prepare appropriate financial statements, including the schedule of expenditures of Federal awards in accordance with §200.510 Financial statements. 2 CFR § 200.510(b) Financial statements reads as follows: Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. Further, GAO Standards – Section 2 – Establishing an Effective Internal Control System - Objectives of an Entity - OV2.23 states in part: Compliance Objective Management conducts activities in accordance with applicable laws and regulations. As part of specifying compliance objectives, the entity determines which laws and regulations apply to the entity. Management is expected to set objectives that incorporate these requirements.

Finding 2021-005 – Internal Controls Over Major Federal Program – Coronavirus Relief Fund PASS-THROUGH GRANTOR: Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of the Treasury ASSISTANCE LISTING NO: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles, Period of Performance QUESTIONED COSTS: $-0- Condition: During the process of documenting the County’s internal controls regarding federal disbursements for Coronavirus Relief fund, we noted that Choctaw County has not established procedures to ensure compliance with the following compliance requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; and Period of Performance. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal expenditures are made in accordance with federal compliance requirements. Effect of Condition: This condition could result in noncompliance to grant requirements and loss of federal funds to the County. Recommendation: OSAI recommends the County gain an understanding of requirements for these programs and implement internal control policies and procedures to ensure compliance with requirements. Management Response: Chairman Board of County Commissioners: We will implement control procedures to ensure compliance with requirements. County Clerk: We will watch our adherence to federal requirements closer. County Treasurer: I will assist in implementing internal controls procedures to ensure compliance. Criteria: The GAO Standards – Section 1 – Fundamental Concepts of Internal Controls – OV1.01 states in Dpeafritn: ition of Internal Controls Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. 2 CFR § 200.303 Internal Controls (a) reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

Finding 2021-006 – Noncompliance Over Major Federal Program – Activities Allowed or Unallowed and Allowable Costs/Cost Principles-Coronavirus Relief Fund PASS THROUGH GRANTOR: Oklahoma Office of Management and Enterprise Services FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.019 FEDERAL PROGRAM NAME: Coronavirus Relief Fund FEDERAL AWARD NUMBER: SA-0161 FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed and Allowable Costs/Cost Principles QUESTIONED COSTS: $59,595 Condition: After performing expenditure testwork on 100% of the program, disbursements totaling $59,595 were not expended in accordance with the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements due to unsubstantiated and ineligible costs. We noted the following: • Reimbursed payroll expenditures totaling $51,552 were previously reimbursed by another entity. • Reimbursed payroll expenditures totaling $7,075 were previously reimbursed by another federal grant. • One employee’s salary totaling $569 was submitted and paid twice on two reimbursement requests. • Expenditures totaling $399 were unaccounted for and were not supported by adequate documentation to determine costs were incurred for allowable cost/cost principles. Cause of Condition: Policies and procedures have not been designed and implemented to ensure compliance with federal award requirements. Effect of Condition: These conditions resulted in noncompliance with grant requirements. The County runs the risk of misappropriation of funds which could hinder the County from receiving future federal funding. Further, this condition could result in the repayment of funds. Recommendation: OSAI recommends the County design and implement policies and procedures to ensure compliance with applicable grant requirements. Management Response: Chairman of the Board of County Commissioners: We will implement policies and procedures to ensure compliance with applicable grant requirements. County Clerk: We will watch closer ensure compliance with applicable grant requirements. County Treasurer: I will do my part to assist in the design and implementation of policies and procedures to ensure compliance with applicable grant requirements. Criteria: 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR § 200.403 - Factors affecting allowability costs states in part, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (g) Be adequately documented.” The Department of the Treasury Federal Register, Vol. 86, No. 10 states in part, “Fund payments may not be used for expenses that have been or will be reimbursed by another federal program.” Additionally, guidance provided in the Subrecipient Agreement - Federal Funding Certification executed 6/04/2020 between Choctaw County and the State of Oklahoma states in part, 5. Funds provided as a direct payment from the State of Oklahoma pursuant to this certification must adhere to official federal guidance issued or to be issued on what constitutes a necessary expenditure. Any funds expended by a political subdivision or its grantee(s) in any manner that does not adhere to official federal guidance or in violation of this certification shall be returned to the State of Oklahoma Coronavirus Relief Fund. 6. Any local government entity receiving funds pursuant to this certification shall retain documentation of all uses of the funds… 10. I acknowledge and certify that Recipient has not received, and will not apply for, federal funds from any other source, to reimburse it for the expenditures for which funds are sought pursuant hereto.

2021-009 Inability to Test Compliance (Material Weakness) Federal Agency: Department of Education Pass-through Agency: New Hampshire Department of Education Cluster/Program: Title I Assistance Listing Number: 84.010 Passed-through Identification: 20210848 Compliance Requirements: All Type of Finding: Internal Control over Compliance – Material Weakness Material Noncompliance Criteria or Specific Requirement: In accordance with 2 CFR 200.334, recipients of federal funds must retain financial and programmatic records, supporting documents, statistical records, and all other records pertinent to a federal award for a period of three years from the date of submission of the final expenditure report. Additionally, per 2 CFR 200.303, recipients must establish and maintain effective internal control over federal awards to ensure compliance with federal statutes, regulations, and the terms and conditions of the award. Condition: The School District informed the engagement team that it was unable to locate all required documentation necessary to support expenditures and compliance with federal program requirements. This affected our ability to complete the required testing over the major program. Cause: The School District does not have a consistent or centralized process for retaining and organizing documentation related to federal program expenditures and compliance requirements. Staff turnover and lack of clear documentation procedures contributed to the unavailability of records. Effect: Due to the absence of required supporting documentation, we were unable to obtain sufficient appropriate audit evidence to support compliance with the federal requirements for the affected programs. As a result, we were unable to determine whether certain transactions were allowable and in compliance with the applicable grant requirements. This represents a material noncompliance with federal regulations and may result in questioned costs or other remedial actions by the granting agency. Questioned Costs: $989,166. This amount represents the total presented on the Schedule of Expenditures of Federal Awards. The entire amount is in question because no testing could be performed as required documentation was not retained by the School District. Identification as Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the School District implement stronger internal controls over document retention, including centralized digital storage systems, regular staff training on federal documentation requirements, and written procedures outlining retention responsibilities. These procedures should ensure that all required documentation is maintained and readily accessible for audit and monitoring purposes. Views of Responsible Officials: Management’s views and corrective action plan is included at the end of this report.

2021-010 Inability to Test Compliance (Material Weakness) Federal Agency: Department of Education Pass-through Agency: New Hampshire Department of Education Cluster/Program: COVID-19 – Education Stabilization Fund Assistance Listing Number: 84.425D Passed-through Identification: 20204986 & 20211886 Compliance Requirements: All Type of Finding: Internal Control over Compliance – Material Weakness Material Noncompliance Criteria or Specific Requirement: In accordance with 2 CFR 200.334, recipients of federal funds must retain financial and programmatic records, supporting documents, statistical records, and all other records pertinent to a federal award for a period of three years from the date of submission of the final expenditure report. Additionally, per 2 CFR 200.303, recipients must establish and maintain effective internal control over federal awards to ensure compliance with federal statutes, regulations, and the terms and conditions of the award. Condition: The School District informed the engagement team that it was unable to locate all required documentation necessary to support expenditures and compliance with federal program requirements. This affected our ability to complete the required testing over the major program. Cause: The School District does not have a consistent or centralized process for retaining and organizing documentation related to federal program expenditures and compliance requirements. Staff turnover and lack of clear documentation procedures contributed to the unavailability of records. Effect: Due to the absence of required supporting documentation, we were unable to obtain sufficient appropriate audit evidence to support compliance with the federal requirements for the affected programs. As a result, we were unable to determine whether certain transactions were allowable and in compliance with the applicable grant requirements. This represents a material noncompliance with federal regulations and may result in questioned costs or other remedial actions by the granting agency. Questioned Costs: $505,347. This amount represents the total presented on the Schedule of Expenditures of Federal Awards. The entire amount is in question because no testing could be performed as required documentation was not retained by the School District. Identification as Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the School District implement stronger internal controls over document retention, including centralized digital storage systems, regular staff training on federal documentation requirements, and written procedures outlining retention responsibilities. These procedures should ensure that all required documentation is maintained and readily accessible for audit and monitoring purposes. Views of Responsible Officials: Management’s views and corrective action plan is included at the end of this report.

2021-010 Inability to Test Compliance (Material Weakness) Federal Agency: Department of Education Pass-through Agency: New Hampshire Department of Education Cluster/Program: COVID-19 – Education Stabilization Fund Assistance Listing Number: 84.425D Passed-through Identification: 20204986 & 20211886 Compliance Requirements: All Type of Finding: Internal Control over Compliance – Material Weakness Material Noncompliance Criteria or Specific Requirement: In accordance with 2 CFR 200.334, recipients of federal funds must retain financial and programmatic records, supporting documents, statistical records, and all other records pertinent to a federal award for a period of three years from the date of submission of the final expenditure report. Additionally, per 2 CFR 200.303, recipients must establish and maintain effective internal control over federal awards to ensure compliance with federal statutes, regulations, and the terms and conditions of the award. Condition: The School District informed the engagement team that it was unable to locate all required documentation necessary to support expenditures and compliance with federal program requirements. This affected our ability to complete the required testing over the major program. Cause: The School District does not have a consistent or centralized process for retaining and organizing documentation related to federal program expenditures and compliance requirements. Staff turnover and lack of clear documentation procedures contributed to the unavailability of records. Effect: Due to the absence of required supporting documentation, we were unable to obtain sufficient appropriate audit evidence to support compliance with the federal requirements for the affected programs. As a result, we were unable to determine whether certain transactions were allowable and in compliance with the applicable grant requirements. This represents a material noncompliance with federal regulations and may result in questioned costs or other remedial actions by the granting agency. Questioned Costs: $505,347. This amount represents the total presented on the Schedule of Expenditures of Federal Awards. The entire amount is in question because no testing could be performed as required documentation was not retained by the School District. Identification as Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the School District implement stronger internal controls over document retention, including centralized digital storage systems, regular staff training on federal documentation requirements, and written procedures outlining retention responsibilities. These procedures should ensure that all required documentation is maintained and readily accessible for audit and monitoring purposes. Views of Responsible Officials: Management’s views and corrective action plan is included at the end of this report.

Department of Health and Human Services Federal Assistance Listing #93.498 COVID-19: Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 1 TIN #770637498 Reporting Material Weakness in Internal Control Over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The Health System reported expenses based on specifically identified COVID related expenses. Condition: The Health System failed to provide an expense listing that supported the expenses included within the HHS Special Report – Period 1 (Report). In addition, the Health System’s lost revenue report did not reconcile to the Report and there was no evidence of review by someone other than the preparer. Cause: Internal controls in place did not ensure that all federal awards were supported and tracked appropriately. Effect: The lack of adequate policies governing review of the terms and conditions of the program, and lack of review over Report preparation and submission increases the risk that employees participating in the federal award administration may not be able to detect and correct noncompliance in a timely manner. The Health System submitted the Report without an accurate schedule to support the amount of expenses claimed. Questioned Costs: None reported. Context: Sampling was not used. Repeat Finding from Prior Years: No Recommendation: We recommend that the Health System enhance internal control policies to ensure all amounts reported and submitted to the federal agency are adequately documented and supported We also recommend that the Health System enhance internal control policies to ensure that the required reports are properly reviewed prior to submission to ensure all key line items are necessary, correct, meet the requirements of the federal program, and are properly recorded in the reports required to be submitted to the federal agency. Views of Responsible Officials: Management agrees with the finding.

Finding 2021-004 Noncompliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles and Period of Performance Finding 2021-005 Noncompliance with Eligibility Compliance Requirements: • Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Per 2 CFR 200.303, the auditee must establish and maintain effective internal control over federal awards and Per 2 CFR 200.403, costs must be necessary, reasonable, allocable, and authorized consistent with policies and procedures that apply uniformly to both federally financed and other activities. The costs must also occur during the proper grant period of performance. • Eligibility – Per 2 CFR 200.303 and 2 CFR 200.331, the auditee must establish and maintain internal controls to ensure that only eligible individuals, organizations, or activities receive assistance under federal awards. Criteria: An effective system of internal control over compliance requires that expenditures charged to federal awards be supported by adequate documentation and approvals to demonstrate that: • Costs are necessary, reasonable, allocable, and allowable under program requirements, and recorded properly and in the correct period. • Expenditures are for activities permitted under the terms and conditions of the award. • Expenditures are reviewed and monitored. • Participants or beneficiaries meet eligibility requirements. Condition: During our testing of expenditures and program activity for the federal program, we identified multiple instances in which transactions lacked adequate supporting documentation to demonstrate compliance with the above requirements. Specifically: • CSBG – ALN 93.569: Of the sixty expense transactions tested over CSBG, three did not have corresponding support or documentation to verify they were allowable activities, allowable costs, and they were recognized in the correct period. Specifically, invoices, purchase orders, or timesheets were missing, incomplete, or did not adequately substantiate the expenditures charged to the federal award. • During our testing, we identified an instance where 1 transaction was processed without proper documented approvals - 1 transaction totaling $842.40 • During testing of participant files over CSBG, we noted that 15 out of 60 client files could not be located, which did not allow us to properly determine if these participants were in fact eligible to be served under this program. Cause: The lack of documentation was primarily due to inadequate internal control procedures over record retention and verification. Additionally, there was significant turnover which contributed to inconsistent documentation practices. Effect or Potential Effect: Without sufficient supporting documentation and approvals, the Organization cannot demonstrate that: • Expenditures were for allowable activities. • Costs charged were necessary, reasonable, and allocable and recorded in the proper period. • Costs are reviewed and monitored. • Participants or beneficiaries met eligibility requirements. Questioned costs: Due to insufficient documentation, the amount of questioned costs could not be determined. Recommendation: We recommend the Organization strengthen its compliance-related internal controls by: • Requiring standardized documentation to support compliance with each requirement. • Implementing periodic reviews of documentation completeness before charging costs to federal awards. • Providing training to staff responsible for grant management on compliance and record retention requirements. • Retain all documentation related to federal awards in a central location. • Reinforcing the approval process by documenting and communicating approval requirements to all staff involved in initiating and processing transactions, providing mandatory training to employees on expense authorization policies, and establishing monitoring procedures to ensure approvals are consistently documented before transactions are processed. Views of responsible officials: Management agrees with the finding and the recommendation. Corrective action plan: See Management’s Corrective Action Plan (Unaudited).

Finding 2021-004 Noncompliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles and Period of Performance Finding 2021-005 Noncompliance with Eligibility Compliance Requirements: • Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Per 2 CFR 200.303, the auditee must establish and maintain effective internal control over federal awards and Per 2 CFR 200.403, costs must be necessary, reasonable, allocable, and authorized consistent with policies and procedures that apply uniformly to both federally financed and other activities. The costs must also occur during the proper grant period of performance. • Eligibility – Per 2 CFR 200.303 and 2 CFR 200.331, the auditee must establish and maintain internal controls to ensure that only eligible individuals, organizations, or activities receive assistance under federal awards. Criteria: An effective system of internal control over compliance requires that expenditures charged to federal awards be supported by adequate documentation and approvals to demonstrate that: • Costs are necessary, reasonable, allocable, and allowable under program requirements, and recorded properly and in the correct period. • Expenditures are for activities permitted under the terms and conditions of the award. • Expenditures are reviewed and monitored. • Participants or beneficiaries meet eligibility requirements. Condition: During our testing of expenditures and program activity for the federal program, we identified multiple instances in which transactions lacked adequate supporting documentation to demonstrate compliance with the above requirements. Specifically: • CSBG – ALN 93.569: Of the sixty expense transactions tested over CSBG, three did not have corresponding support or documentation to verify they were allowable activities, allowable costs, and they were recognized in the correct period. Specifically, invoices, purchase orders, or timesheets were missing, incomplete, or did not adequately substantiate the expenditures charged to the federal award. • During our testing, we identified an instance where 1 transaction was processed without proper documented approvals - 1 transaction totaling $842.40 • During testing of participant files over CSBG, we noted that 15 out of 60 client files could not be located, which did not allow us to properly determine if these participants were in fact eligible to be served under this program. Cause: The lack of documentation was primarily due to inadequate internal control procedures over record retention and verification. Additionally, there was significant turnover which contributed to inconsistent documentation practices. Effect or Potential Effect: Without sufficient supporting documentation and approvals, the Organization cannot demonstrate that: • Expenditures were for allowable activities. • Costs charged were necessary, reasonable, and allocable and recorded in the proper period. • Costs are reviewed and monitored. • Participants or beneficiaries met eligibility requirements. Questioned costs: Due to insufficient documentation, the amount of questioned costs could not be determined. Recommendation: We recommend the Organization strengthen its compliance-related internal controls by: • Requiring standardized documentation to support compliance with each requirement. • Implementing periodic reviews of documentation completeness before charging costs to federal awards. • Providing training to staff responsible for grant management on compliance and record retention requirements. • Retain all documentation related to federal awards in a central location. • Reinforcing the approval process by documenting and communicating approval requirements to all staff involved in initiating and processing transactions, providing mandatory training to employees on expense authorization policies, and establishing monitoring procedures to ensure approvals are consistently documented before transactions are processed. Views of responsible officials: Management agrees with the finding and the recommendation. Corrective action plan: See Management’s Corrective Action Plan (Unaudited).

Finding 2021-006 Noncompliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles and Period of Performance Finding 2021-007 Noncompliance with Eligibility Compliance Requirements: • Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Per 2 CFR 200.303, the auditee must establish and maintain effective internal control over federal awards and Per 2 CFR 200.403, costs must be necessary, reasonable, allocable, and authorized consistent with policies and procedures that apply uniformly to both federally financed and other activities. The costs must also occur during the proper grant period of performance. • Eligibility – Per 2 CFR 200.303 and 2 CFR 200.331, the auditee must establish and maintain internal controls to ensure that only eligible individuals, organizations, or activities receive assistance under federal awards. Criteria: An effective system of internal control over compliance requires that expenditures charged to federal awards be supported by adequate documentation to demonstrate that: • Costs are necessary, reasonable, allocable, and allowable under program requirements and recorded in the proper period. • Expenditures are for activities permitted under the terms and conditions of the award and recorded properly. • Expenditures are reviewed and monitored. • Participants or beneficiaries meet eligibility requirements. Condition: During our testing of expenditures and program activity for the federal program, we identified multiple instances in which transactions lacked adequate supporting documentation to demonstrate compliance with the above requirements. Specifically: • TANF – ALN 93.558: Of the sixty expense transactions tested over TANF, two did not have corresponding support or documentation to verify they were allowable activities and allowable costs. Specifically, invoices, purchase orders, or timesheets were missing, incomplete, or did not adequately substantiate the expenditures charged to the federal award in the proper period. • During our testing, we identified an instance where 8 transactions were processed without proper documented approvals - 8 transaction totaling $12,694.19 • During testing of participant files over TANF, we noted that five out of 60 client files could not be located, which did not allow us to properly determine if these participants were in fact eligible to be served under this program. Cause: The lack of documentation was primarily due to inadequate internal control procedures over record retention and verification. Additionally, there was significant turnover which contributed to inconsistent documentation practices. Effect or Potential Effect: Without sufficient supporting documentation, the Organization cannot demonstrate that: • Expenditures were for allowable activities. • Costs charged were necessary, reasonable, and allocable and recorded properly. • Expenditures were reviewed and monitored. • Participants or beneficiaries met eligibility requirements. Questioned costs: Due to insufficient documentation, the amount of questioned costs could not be determined. Recommendation: We recommend the Organization strengthen its compliance-related internal controls by: • Requiring standardized documentation to support compliance with each requirement. • Implementing periodic reviews of documentation completeness before charging costs to federal awards. • Providing training to staff responsible for grant management on compliance and record retention requirements. • Retain all documentation related to federal awards in a central location. • Reinforcing the approval process by documenting and communicating approval requirements to all staff involved in initiating and processing transactions, providing mandatory training to employees on expense authorization policies, and establishing monitoring procedures to ensure approvals are consistently documented before transactions are processed. Views of responsible officials: Management agrees with the finding and the recommendation. Corrective action plan: See Management’s Corrective Action Plan (Unaudited).

Finding 2021-006 Noncompliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles and Period of Performance Finding 2021-007 Noncompliance with Eligibility Compliance Requirements: • Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Per 2 CFR 200.303, the auditee must establish and maintain effective internal control over federal awards and Per 2 CFR 200.403, costs must be necessary, reasonable, allocable, and authorized consistent with policies and procedures that apply uniformly to both federally financed and other activities. The costs must also occur during the proper grant period of performance. • Eligibility – Per 2 CFR 200.303 and 2 CFR 200.331, the auditee must establish and maintain internal controls to ensure that only eligible individuals, organizations, or activities receive assistance under federal awards. Criteria: An effective system of internal control over compliance requires that expenditures charged to federal awards be supported by adequate documentation to demonstrate that: • Costs are necessary, reasonable, allocable, and allowable under program requirements and recorded in the proper period. • Expenditures are for activities permitted under the terms and conditions of the award and recorded properly. • Expenditures are reviewed and monitored. • Participants or beneficiaries meet eligibility requirements. Condition: During our testing of expenditures and program activity for the federal program, we identified multiple instances in which transactions lacked adequate supporting documentation to demonstrate compliance with the above requirements. Specifically: • TANF – ALN 93.558: Of the sixty expense transactions tested over TANF, two did not have corresponding support or documentation to verify they were allowable activities and allowable costs. Specifically, invoices, purchase orders, or timesheets were missing, incomplete, or did not adequately substantiate the expenditures charged to the federal award in the proper period. • During our testing, we identified an instance where 8 transactions were processed without proper documented approvals - 8 transaction totaling $12,694.19 • During testing of participant files over TANF, we noted that five out of 60 client files could not be located, which did not allow us to properly determine if these participants were in fact eligible to be served under this program. Cause: The lack of documentation was primarily due to inadequate internal control procedures over record retention and verification. Additionally, there was significant turnover which contributed to inconsistent documentation practices. Effect or Potential Effect: Without sufficient supporting documentation, the Organization cannot demonstrate that: • Expenditures were for allowable activities. • Costs charged were necessary, reasonable, and allocable and recorded properly. • Expenditures were reviewed and monitored. • Participants or beneficiaries met eligibility requirements. Questioned costs: Due to insufficient documentation, the amount of questioned costs could not be determined. Recommendation: We recommend the Organization strengthen its compliance-related internal controls by: • Requiring standardized documentation to support compliance with each requirement. • Implementing periodic reviews of documentation completeness before charging costs to federal awards. • Providing training to staff responsible for grant management on compliance and record retention requirements. • Retain all documentation related to federal awards in a central location. • Reinforcing the approval process by documenting and communicating approval requirements to all staff involved in initiating and processing transactions, providing mandatory training to employees on expense authorization policies, and establishing monitoring procedures to ensure approvals are consistently documented before transactions are processed. Views of responsible officials: Management agrees with the finding and the recommendation. Corrective action plan: See Management’s Corrective Action Plan (Unaudited).