Findings Citing § 200.303

2025-003 Suspension and Debarment ALN 21.027 Coronavirus State and Local Fiscal Funds US Department of the Treasury Fiscal Year 2025 Funding Criteria: CFR 180.300 requires the City to ensure vendors and contractors are not disqualified, excluded, or debarred prior to entering into a covered transaction. Per 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. The City should have a process to ensure compliance with 2 CFR 180.300. Condition: The City did not have documented controls over the review of verifying vendors are not debarred or suspended. Cause of the condition: The City completes SAM checks of all vendors however, the City does not have a review process to verify the vendor is not suspended or debarred before a contract or payment with the vendor. Potential effect of condition: The City may have covered transactions with federally debarred vendors. Questioned Costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should put controls in place to verify SAM checks before authorizing a contract or a purchase order with a vendor for a covered transaction. Management Response: Management recognizes the importance of compliance with federal suspension and debarment requirements. Management has implemented procedures to ensure compliance with suspension and debarment requirements for federally funded transactions. As part of the procurement process, vendors responding to solicitations for grant-funded projects will be required to provide evidence of active SAM registration and certify that they are not suspended or debarred. In addition, prior to execution of contracts or issuance of purchase orders for covered transactions, management will perform and document an independent SAM.gov verification as part of standard pre-award procedures to confirm vendor eligibility.

Assistance Listing, Federal Agency, and Program Name ALN 93.982, U.S. Department of Health and Human Services, Mental Health Disaster Assistance and Emergency Mental Health Regular Services Program Wayne County Strong Federal Award Identification Number and Year 20255313 00, 2025 Pass through Entity Michigan Department of Health and Human Services Finding Type Significant deficiency Repeat Finding No Criteria Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition DWIHN’s internal controls were not sufficiently designed and/or operating effectively to prevent the submission of unallowable costs for reimbursement under the federal award. Questioned Costs None If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported Not applicable Identification of How Questioned Costs Were Computed Not applicable Context DWIHN submitted unallowable costs for reimbursement to the funding agency, including unallowable indirect costs and a duplicate invoice from one vendor. While DWIHN had a detective control in place to review expenditures included in reimbursement requests, the control was performed after the expenditures had been paid and included in reimbursement submissions. Due to the timing of this review, the detective control did not prevent DWIHN from paying the unallowable costs and subsequently requesting reimbursement for those costs. Upon identification of the unallowable expenditures, DWIHN took prompt corrective action, including recoupment of the funds from the applicable sources and repayment to the funding agency for the disallowed amounts. Ultimately, the grant was properly accounted for at the end of the grant period. Cause and Effect Although DWIHN had preventive and detective controls in place related to reimbursement requests, those controls did not operate effectively as designed for this grant program. As a result, unallowable costs were reimbursed to DWIHN by the granting agency prior to being identified and remediated. Recommendation We recommend that DWIHN strengthen and timely execute its review procedures over reimbursement requests and supporting documentation to ensure that all expenditures submitted for reimbursement comply with the terms and conditions of the grant award. This may include enhancing preventive controls or adjusting the timing of existing reviews to ensure unallowable or duplicate costs are identified and excluded prior to submission to the funding agency. Views of Responsible Officials and Corrective Action Plan DWIHN concurs with the finding. However, it should be noted that it is customary and standard practice to charge the indirect de minimis rate to federal grants in accordance with 2 CFR 200.414(f) Indirect Costs and the Department of Health & Human Services Grants Policy Statement section 2.3.4.6. Indirect Cost Rates. In addition, one (1) out of the seven (7) contracted vendors submitted FSR’s with indirect costs to the project; six (6) providers submitted the FSR’s without indirect cost thus adhering to the instructions. Further, the unallowed costs and duplicate payment were identified, corrected, and remediated by the finance staff prior to submission of the final reports, closeout of the grant and audit fieldwork. Finally, program and finance staff responsible for the approving and processing of FSR’s have been informed of the need to review FSR’s in greater detail before they are submitted, approved, and payment occurs. A more detailed review of the FSR’s as adherence to established policies and procedures, will eliminate the risk of errors and omissions.

Finding 2025-003 – Internal Controls over Federal Awards (Significant Deficiency) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance and Assistance Listing #93.959 Block Grants for Prevention and Treatment of Substance Abuse. Criteria: 2 CFR section 200.303 establishes the requirements for non‑federal entities to establish and maintain effective internal control over federal awards to provide reasonable assurance that transactions are properly authorized. Condition: The Council’s Grant Management Policies & Procedures Manual requires credit card purchase requests be submitted on the Council's approval form at least two weeks prior to the date needed and must have the signed approval of the Executive Director. In three of the 35 transactions tested, the credit card purchase approval form was dated after the date of purchase. Cause: Purchase requests were not consistently submitted and approved in advance of the purchase date, indicating a breakdown in adherence to established procurement timelines. . Effect: Although the transactions were ultimately approved and the costs were otherwise allowable, allocated, and properly charged to the program, failure to obtain timely approval increases the risk that purchases may be made without appropriate prior authorization. Questioned Costs: None Recommendation: We recommend management reinforce procurement procedures to ensure purchase requests are submitted and approved in accordance with the established policy requiring approval at least two weeks prior to the date needed, thereby strengthening internal controls over procurement and disbursements. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.

SD 2025-001 REPORTING Department of Commerce ALN 11.463 – Habitat Conservation Federal Award ID Number: FX463C0051 2025 Funding Criteria: Per 2 CFR 200.303, non-Federal entities must establish and maintain effective internal controls over Federal awards that provide reasonable assurance the entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. In addition, pursuant to 2 CFR Part 170, recipients of Federal awards are required to report first-tier subawards and executive compensation data in accordance with the Federal Funding Accountability and Transparency Act (FFATA). Specifically, subaward information must be reported in the Federal Subaward Reporting System (FSRS) by the end of the month following the month in which the subaward was obligated, as required by the terms and conditions of the Federal award. Condition: The FFATA report was not filed during the year as subawards were granted. Cause: The Council was unaware of the requirement to file the FFATA. Effect: Potential for unintended errors to occur without being immediately identified and corrected. The Council was not in compliance with the Uniform Guidance and the Habitat Conservation Program. Questioned Costs: None. The finding is for reporting which does not relate to questioned costs. Perspective: None of the FFATA reports were filed during 2025 for all 10 subrecipients. Recommendation: The Federal Funding Accountability and Transparency Act (FFATA) reporting requirement is a general term and condition from the Department of Commerce and should be completed as required and reviewed by someone other than the preparer before submission. Management Response: The FFATA reporting requirement was not a specific award condition on the grant award to the IRL Council from NOAA Fisheries. However, it is a standard general term and condition from the Department of Commerce which is referenced on the grant award. The subawards for the NOAA grant have now been input into SAM.gov. The IRL Council will review the specific FFATA requirements required by the Department of Commerce (different than the EPA requirements) and will make sure that the IRL Council continues to be in compliance.

Federal Agency: Environmental Protection Agency Federal Program Name: Water Pollution Control Assistance Listing Numbers: 66.419 Federal Award Identification Number: 98339418 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: 10/1/2023 - 12/30/2025 Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matter Criteria or specific requirement: Compliance: Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR §200.318 through §200.327. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. Small purchase procedures are used for purchases that exceed the micro-purchase amount but do not exceed the simplified acquisition threshold ($250,000). If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources (2 CFR §200.320(b)). Control: Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: For two of five procurements selected for testing, the Commission was unable to provide documentation (completed requisition form) to demonstrate compliance with their procurement policy. Questioned costs: Undetermined. Cause: Controls were not operating effectively to ensure that the Commission’s procurement policies were followed for procurements entered into where expenses were charged to the federal program. Effect: The Commission was unable to provide documentation to support compliance with Federal requirements. Repeat Finding: No. Recommendation: We recommend that the Commission ensure that it follows its procurement policies for all goods and services charged to the program and that documentation be readily available for audit. Views of responsible officials: To prevent future noncompliance the Commission will 1)clarify vendor coverage on existing agreements, 2) strengthen controls over procurement threshold, 3) monitor cumulative spending by vendor, and 4) reinforce training and communication.

Payroll Federal Agency: Department of Housing and Urban Development Federal Program Name: Community Development Block Grants Cluster Entitlements/Special Purpose Assistance Listing Number: 14.218 Federal Award Identification Number and Year: B-23-UN-12-0002 and B-25-UU-12-0003 Award Period: November 11, 2023 – November 20, 2029 and January 16, 2025 – June 6, 2031 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria: 2 CFR 200.302(b)(3) states that the recipient must maintain records that sufficiently identify the amount, source, and expenditure of funds for federally-funded activities. These records must contain information pertaining to federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. 2CFR 200.403 states that costs must be adequately documented. 2 CFR section 200.303(a) states a non-Federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should comply with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There were two conditions present: • One employee had duplicate hours for three pay periods. • Two employees had incorrect pay rates used for the calculation of allowable payroll costs for seven pay periods. Questioned costs: • $3,974 - B-23-UN-12-0002 • $81 - B-25-UU-12-0003 Context: Forty employee pay periods were selected for testing. • One employee had a total of twenty-four hours duplicated over four pay periods. • Two employees had incorrect pay rates across seven pay periods. Cause: Allowable payroll costs are performed using a manual process. While the calculation was reviewed and approved, a cross check between the KRONOS report and the allowable cost calculation was not performed. Allowable payroll costs are calculated using pay rates at end of the quarter. When there are no changes during the quarter, this methodology results in an accurate calculation. However, if a pay rate changes during the quarter, this methodology results in a misstatement for the calculation of allowable payroll costs. Effect: Using incorrect hours or pay rates to calculate wages recorded quarterly can result in overcharging grant and submitting inaccurate expenditures to the grant which may lead to non-compliance with grant requirements. Repeat Finding: No Recommendation: It is recommended the County modify its procedure to include: • Improve reconciliation procedures to verify hours per pay period recorded in quarterly spreadsheet agrees to hours recorded in the KRONOS system. • Record grant wages using the pay rate at the beginning of the quarter if recorded on a quarterly basis or use pay rates for each pay period if recorded on a pay period basis. Views of responsible official and planned corrective actions: Management concurs with the auditor’s recommendations. Action taken in response to finding: • Document the audit process in a formalized SOP and cross train all reviewers from SRGA Admin, Budget, and Fiscal. • Create a checklist to accompany each personnel draw to ensure that after rates are verified that SRGA Admin certifies that no RPAs or pay adjustments were approved during the pay periods reported and if there were, a second pay rate is entered for that draw and hours are split according to accurate rates/dates. • Document the cure process in the SOP to ensure that any errors found after the fact will be corrected with HUD to remain compliant and to ensure that no funds drawn in error are retained. • Include a date verification process prior to submission of the draw to ensure that staff did not duplicate any dates. This verification will be an audit of the Time Tracking Review completed by Admin staff. Ongoing training and coaching will be administered should duplicate entries be found on final draw reports. • Audit of all personnel draws for both allocations of CDBG-DR grants will be completed using the new SOP and verification tools before the end of fiscal year 2026.

Assistance Listing, Federal Agency, and Program Name 93.870, Maternal, Infant, and Early Childhood Home Visiting Grant Federal Award Identification Number and Year S-MIEC-F-2025-9-1 Pass through Entity Children's Trust of South Carolina Finding Type Significant deficiency Repeat Finding No Criteria Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control-Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Organization was reimbursed $22,968 under the grant award but amounts were outside of performance year of the grant. The control in place to review expenditures was not effective in identifying expenditures that were outside the grant period. Questioned Costs $22,968 If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported N/A Identification of How Questioned Costs Were Computed The question costs were determined by totaling all of the expenses that were identified to be outside the period of performance of the grant. Context Two contracts were entered into during the year with both having costs that were to be incurred in future period not covered by grant, but both were fully charged to grant for current fiscal year. Through testing of procurement noted that contract term started part way though grant year and for period after end of the grant's period of preformance. As through procurement there were only two contracts entered into the total cost is $22,968 of expenditures related to future period. Cause and Effect The Organization's control over contractor payments was not designed effectively to ensure costs incurred prior to requesting for reimbursement. The failure to have an effective control in place caused the Organization to charge a cost to the program that the Organization had not yet incurred. Recommendation We recommend that the review of process ensure that items have been expended prior to charging amount to the grant. Views of Responsible Officials and Planned Corrective Actions The Organization acknowledges that the expenditure was reimbursed outside of the grant’s period of performance under review due to the nature of the expenditure and accounting treatment selected. The Organization will implement enhanced review procedures of federal expenditures sought for reimbursement to better align with the underlying accounting treatment.

Finding 2025-001: Review of Compliance Matrices and Narratives - Special Tests and Provisions Federal Program Name: National Railroad Passenger Corporation Grants Assistance Listing No. 20.315 Federal Award Nos.: 69A36525520030AMTDC 69A36525520040AMTDC 69A36524520000AMTDC 69A36523504100AMTDC 69A36523504110AMTDC FR-AMT-0025-22 FR-AMT-0026-22 FR-AMT-0028-22 FR-AMT-0027-22 Federal Agency: Department of Transportation, Federal Railroad Administration Criteria 1. The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each state must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms of the conditions of the federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. For the compliance matrix that is maintained for the annual grants under Assistance Listing No. 20.315, Ernst & Young (EY) identified that for two provisions, the wording contained within the matrix did not match in its entirety to the respective grant agreement. Additionally, EY noted that two provisions that were present in the grant agreements were not included in the matrix. 2. For the compliance matrix that is maintained for Infrastructure Investment and Jobs Act (IIJA) grants under Assistance Listing No. 20.315, EY identified that two provisions present in the grant agreements were not included in the matrix. 3. For the compliance matrices maintained for both the annual grants and IIJA grants under Assistance Listing No. 20.315, EY identified a lack of evidence to support management's assessment of certain provisions as not applicable. Cause In reviewing management’s internal controls, the key internal control identified by management is not designed such that consistent, proactive monitoring and/or review occurs to ensure all compliance requirements and any changes to the wording of specific provisions are updated and reviewed within the compliance matrices and narratives. Effect or Potential Effect Amtrak is not in compliance with the 2 CFR 200.302 (a) and 2 CFR 200.303. This may also put Amtrak at greater risk of non-compliance with specific provisions in accordance with the federal awards. Questioned Costs None identified. Context EY reviewed the federal awards in scope and compared them to the compliance matrices and compliance narrative maintained by the company as part of the audit procedures in connection with the testing of the special tests and provisions compliance requirement. Per review of the grant agreements, a total of 159 provisions exist of which EY identified six provisions as missing or inaccurate as described in the condition section above. As such, this finding relates to 3.77% of the total population of provisions. Identification as a Repeat Finding This is a repeat finding of 2024-002. Recommendation EY recommends that Amtrak update the control design with enough precision to ensure that reviews and updates to the compliance matrices are made on a regular cadence to ensure that any updates, amendments or changes are monitored and updated timely. Views of Responsible Officials Amtrak recognizes the need to improve our controls over the updates of the compliance matrices and will review its control processes by the end of FY2026.

Finding 2025-002: Equipment and Real Property Management Federal Program Name: National Railroad Passenger Corporation Grants Assistance Listing No. 20.315 Federal Award Nos.: 69A36524520000AMTDC 69A36524520010AMTDC FR-AMT-0025-22 FR-AMT-0026-22 69A36523504100AMTDC 69A36523504110AMTDC FR-AMT-0019-20 FR-AMT-0020-20 FR-AMT-0003-14-01-02 FR-AMT-0022-21 FR-AMT-0023-21 DTFRDV-07-G-00002 DTFRDV-09-G-00002 FY2000 Appropriation FY1975 Appropriation Federal Agency: Department of Transportation, Federal Railroad Administration Criteria The code of federal regulations – 2 CFR 200.313 Equipment (d) Management Requirements requires that: (2) A physical inventory of the property must be conducted, and the results must be reconciled with the property records at least once every two years. (3) A control system must be in place to ensure safeguards for preventing property loss, damage, or theft. Any loss, damage, or theft of equipment must be investigated. The recipient or subrecipient must notify the Federal agency or pass-through entity of any loss, damage, or theft of equipment that will have an impact on the program. The code of federal regulations 2 CFR 200.303 Internal Controls states the recipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by COSO. (d) Take prompt action when instances of noncompliance are identified. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. For three of the equipment samples reviewed (approximately $1.1 million net book value), it was observed that the assets within Penn Coach Yard, in Philadelphia PA, lacked adequate safeguards to prevent property loss, damage or theft, as evidenced by the occurrence of two instances of property damage in the current year. EY notes Amtrak performed satisfactory investigations into both instances. 2. During EY's procedures performed for two assets (approximately $7.2 million net book value), EY identified that no inventory had occurred for the assets, even though they had been placed in service over two years prior and would have required an inventory prior to EY's observation. As this came to EY's attention after the inventory was required and during observation procedures, EY investigated further and could not obtain alternative evidence to support that an inventory had occurred within the two-year period. Cause The lack of adequate safeguards at Penn Coach Yard is attributable to a variety of insufficiencies related to security at Penn Coach Yard. The nature of much of Amtrak’s equipment is composed of moving assets on the tracks, operating up and down the corridors, operating around the yards, or moving from location to location in a geographical region to achieve daily operational objectives thus making tracking timely inventories more challenging. Furthermore, Amtrak resources are deployed such that managers and supervisors oversee geographical regions and equipment that are stationed throughout various routes, often connecting through multiple states with many unmanned and less traveled stations. In reviewing management’s internal controls, the key internal controls identified by management are not designed to ensure consistent, timely, and proactive monitoring to verify that inventory observations occur no less than once every two years. While there is an identified internal control stating that “On a monthly basis, these reports will identify all equipment that has not been observed within 2 years and communicate to the Enterprise Asset Management and Disposition Team (EAMDT) and other appropriate parties for action to be taken. EAMDT is responsible for ensuring the observations of equipment are completed. Once the equipment is observed, information is updated in the departmental source system and subsequently updated within the EAMDT reports,” the internal control does not establish a clear action plan or expected timeframe for responsible parties to respond to or remediate identified items. Further, the internal control is designed to identify assets that are already out of compliance, rather than to proactively monitor assets approaching the two‑year threshold. As a result, the internal control design is detective in nature and may not identify the risk of noncompliance until after noncompliance has occurred. Effect or Potential Effect Noncompliance with 2 CFR 200.313 (d) (2) and (3), and potential refund of grant funds used to purchase noncompliant assets. Questioned Costs The questioned costs below represent the total underlying net book value associated with EY's five equipment selections with exceptions. Assistance Listing No. 20.315 69A36524520000AMTDC/69A36524520010AMTDC $ 4,868,340 FR-AMT-0025-22/FR-AMT-0026-22 2,624,469 69A36523504100AMTDC/69A36523504110AMTDC 590,078 FY2000 Appropriation 110,077 FR-AMT-0019-20/FR-AMT-0020-20 98,376 FR-AMT-0003-14-01-02 88,840 DTFRDV-07-G-00002 30,532 FY1975 Appropriation 9,097 FR-AMT-0022-21/FR-AMT-0023-21 5,831 DTFRDV-09-G-00002 (94,917) Total Questioned Costs $ 8,330,723 Context EY performed equipment observations as a part of the testing of the equipment compliance area, randomly selecting 60 equipment units, and performing live observations with Amtrak personnel at the site with the equipment. EY performed inquiries relating to Amtrak’s safeguarding and maintenance procedures along with an inspection of the property records. Identification as a Repeat Finding Condition 2 represents a repeat finding of 2023-001. Condition 1 is not a repeat finding. Recommendation EY recommends Amtrak set up a system with certain criteria for identifying sites at a higher risk for noncompliance with safeguard requirements, and creates an action plan for evaluating, and remediating potential noncompliance. EY recommends that management consider redesigning one of its key controls to help ensure that the monitoring of the observations is occurring on a preventive basis to help identify any exposure to non-compliance before it occurs and clearly identifies any follow-up steps and actions. For example, there should be established a protocol as well as timeline for when required observations are to take place, additionally, as it is known in advance, which items are coming up for inventory, Amtrak could prepare an annual schedule of inventories, that could be revised quarterly. Views of Responsible Officials Amtrak acknowledges the recommendation that Amtrak should have a system with certain criteria for identifying sites at a higher risk for noncompliance with safeguard requirements and create an action plan for evaluating and remediating potential noncompliance. As part of this effort, the EAMDT will work with Corporate Security to review and, as appropriate, align existing governance processes to reduce the likelihood of similar noncompliance. Amtrak agrees with the recommendation to redesign key controls to help ensure that the monitoring of the observations happens on a preventive basis to help identify any exposure to non-compliance before it occurs. Amtrak published an updated Equipment Control Policy and created an eLearning course, as well as implemented several processes, technologies, and reports that help to proactively monitor and identify equipment that is 90 days or less from needing an inventory. This has improved the compliance rate from less than 70% in FY22 to over 97% in FY25. Amtrak understands that this is a repeat finding and will review with the Amtrak departmental owner of equipment that was out of compliance to strengthen the practice and reduce the likelihood of noncompliance.

Assistance Listing, Federal Agency, and Program Name - 93.045/93.053, Department of Health and Human Services, Aging Cluster Federal Award Identification Number and Year - N/A Pass through Entity - Area Aging on Aging 1C Finding Type - Material weakness Repeat Finding - Yes 2024-15 Criteria - Per 2 CFR 200.303, nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Per 2 CFR 200.318(b), recipients must maintain oversight to ensure contractors perform in accordance with the terms, conditions, and specifications of their contracts. Per the “Minimum Nutrition Program Standards” issued Commission on Services to the Aging, individuals receiving certain nutrition benefits to undergo a periodic reassessment of eligibility that includes obtaining confirmation of medical necessity for certain benefit levels. Condition - The County engaged a third party contractor to perform certain eligibility reassessments, including obtaining verification of medical necessity, when required. While the County had a process in place to properly identify when reassessment was required and to follow up with the contractor about the status of reassessments, controls did not ensure the third party contractor followed through on reassessments on a timely basis. Questioned Costs - None If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - N/A Identification of How Questioned Costs Were Computed - N/A Context - The County is responsible for ensuring participants who receive meals are eligible under the terms of the grant. The County did not have a control over home delivered meal participants that ensured the third party contractor timely reassessed participants every six months. 3 of the 43 samples selected did not have updated assessment forms within six months of receiving meals and 17 of the 43 samples did not have updated assessment forms. Cause and Effect - The County's controls were not adequate to ensure that the third party contractor was reassessing participants every six months. The lack of controls could result in the County providing meals to ineligible participants. Recommendation - We recommend the County update its policy on the reassessment process, including actions to be taken when participants refuse to complete the reassessment or cannot be contacted. This plan should also include a schedule for actions to be taken when participants do not complete reassessment submissions timely. The County should also implement the appropriate controls to monitor the third-party contractor and ensure reassessments are being performed timely. Views of Responsible Officials and Corrective Action Plan - The Department of Senior Services would like to clarify that the third-party contractor is contracted through The Senior Alliance, the Area Agency on Aging for region 1 C and not Wayne County. Wayne County Senior Services will continue to monitor the third-party vendor for timely assessments and reassessments through the existing controls which include: • Providing the third-party contractor monthly lists of clients in need of assessment/reassessment • Generating monthly lists of outstanding reassessments (clients not reassessed from the monthly list) • Reminding clients of the requirement for six-month reassessments • Obtaining updated information (phone numbers, emergency contacts, etc.) twice per year • Providing updated information to third-party contractor • Documentation of communicated information regarding third-party contractor’s performance to The Senior Alliance

Assistance Listing, Federal Agency, and Program Name - 93.045/93.053, Department of Health and Human Services, Aging Cluster Federal Award Identification Number and Year - N/A Pass through Entity - Area Aging on Aging 1C Finding Type - Material weakness Repeat Finding - No Criteria - Uniform Guidance at 2 CFR 200.510(b) requires the auditee to prepare a Schedule of Expenditures of Federal Awards (SEFA) that accurately reports total federal expenditures for each federal program. In addition, effective internal control over compliance, as required by 2 CFR 200.303, requires controls that ensure expenditures reported on the SEFA are complete, accurate, and properly reconciled to underlying accounting records and amounts billed to the funding agency. Condition - The County did not maintain effective internal control over the reconciliation of expenditures reported on the Schedule of Expenditures of Federal Awards to amounts billed to the funding agency. If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - None Identification of How Questioned Costs Were Computed - N/A Context - The SEFA is a key component of the Single Audit and serves as the primary basis for determining major programs subject to audit under the Uniform Guidance. As part of the SEFA preparation process, management compiles federal expenditures from multiple sources, including underlying accounting records and amounts billed to funding agencies. Accurate reconciliation of these sources is critical to ensure that federal expenditures are reported completely and accurately, and that major program determinations are appropriately made. As a result of the audit, it was identified that expenditures related to the Aging Cluster were understated by approximately $126,000 on the preliminary SEFA due to the omission of expenditures that had been billed to the funding agency but backed out of amounts reported on the SEFA during the reconciliation process. Management recorded an adjustment to correct the understatement prior to issuance of the final SEFA. Cause and Effect - The County’s SEFA preparation process did not include a sufficiently designed and implemented control to ensure the accuracy of reconciling items between expenditures reported on the SEFA to amounts billed to the funding agency. As a result of this deficiency, expenditures in the Aging Cluster were understated by approximately $126,000 on the preliminary SEFA. The correction of this error on the final SEFA increased total expenditures for the Aging Cluster, resulting in the program being classified as a Type A program rather than a Type B program for major program determination purposes. Because the deficiency resulted in a material misstatement of the SEFA that was not prevented or detected by internal control, it is considered a material weakness in internal control over compliance. Recommendation - We recommend that management design and implement effective controls over the preparation of the SEFA, including maintaining adequate support for adjustments and reconciling items. Such controls should be performed and reviewed by personnel independent of the SEFA preparation process to ensure the completeness and accuracy of federal expenditures reported. Views of Responsible Officials and Planned Corrective Actions - The County has established procedures for reconciling general ledger activity to supporting documentation and Federal Financial Reports (FFRs/FSRs) throughout the fiscal year, including additional reconciliation procedures performed at year end to capture late or adjusting entries. The condition was further impacted by timing differences between departmental reporting and subsequent adjusting entries, as well as the aggregation of adjustments across multiple programs without sufficient program-level detail at the time of review. While follow-up was initiated to obtain supporting breakdowns, the process did not require resolution of these items prior to final classification and inclusion in year-end reporting. The County is strengthening internal controls over grant-related financial activity and SEFA preparation by enhancing and enforcing requirements for accurate transaction recording, supporting documentation, and independent validation. Key improvements include: • Enhanced documentation and classification requirements for grant-related entries • Strengthened review and validation controls to ensure proper support and classification • Improved reconciliation and adjustment protocols, including postreporting revalidation • Control enforcement and escalation for unsupported or unresolved items • Training and guidance on federal compliance requirements

2025-001 – Allowable Cost Federal Agency: Department of Homeland Security Federal Program Name: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Pass-Through Agency: Florida Division of Emergency Management Pass-Through Numbers: Z2891 and Z4745 Award Period: September 23, 2022 to March 29, 2024 and October 5, 2024 to April 11, 2025 Type of Finding: 􀁸 Material Weakness in Internal Control over Compliance 􀁸 Other Matters Criteria or specific requirement: Per 2 CFR §200.303(a), the County must establish and maintain effective internal controls over federal awards that provide reasonable assurance of compliance with federal statutes, regulations, and award terms. Internal controls should ensure that employees' hours worked and documented on Activity Logs are accurately reflected in the amounts submitted to the grantor for reimbursement. Condition: During our testing, we noted that employees' hours reported on the Activity Logs did not reconcile to the corresponding amounts requested for reimbursement, resulting in discrepancies between the supporting documentation and the reimbursement requests submitted. Questioned costs: $7,568 of known questioned costs. There are also unknown questioned costs because the extent of the discrepancies between the employees' hours reported on the Activity Logs and the amounts requested for reimbursement could not be determined without further details of the activity performed during fiscal years 2022 and 2025. Context: During our testing of 40 employees, we noted 24 instances (60%) where employees' hours reported on the Activity Logs did not reconcile to the corresponding amounts requested for reimbursement. Cause: The County had not established adequate review and reconciliation procedures to ensure that employees' hours reported on Activity Logs were accurately reflected on reimbursement requests. Effect: Without adequate review and reconciliation procedures, there is an increased risk that inaccurate reimbursement amounts could be submitted to the grantor, potentially resulting in questioned costs, noncompliance with award terms, or the requirement to return federal funds. Repeat Finding: No. Recommendation: We recommend the County implement a formal review and reconciliation process to ensure that employees' hours reported on Activity Logs are verified against the reimbursement request prior to submitting it to the grantor. This review should be performed by personnel knowledgeable of the grant requirements and documented to evidence the review was completed. Views of responsible officials: There is no disagreement with the finding.

2025-002 – Reporting Federal Agency: Department of Homeland Security Federal Program Name: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Pass-Through Agency: Florida Division of Emergency Management Pass-Through Numbers: Z2891, Z0581, Z4745, Z4858 Award Period: September 23, 2022 to March 29, 2024; September 4, 2017 to March 10, 2019; October 5, 2024 to April 11, 2026; and October 5, 2024 to April 11, 2025 Type of Finding: 􀁸 Material Weakness in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), the County must establish and maintain effective internal controls over federal awards that provide reasonable assurance of compliance with federal statutes, regulations, and award terms. Internal controls should include procedures to ensure that required reports are accurate, complete, and subject to appropriate supervisory review prior to submission. Condition: During our testing, we reviewed 5 quarterly reports submitted to the grantor and noted that noted that none contained evidence of supervisory review or approval to ensure the accuracy and completeness of the reported information prior to submission. Questioned costs: None Context: 5 of the 12 quarterly reports were reviewed as part of the audit. No documentation of review or approval was identified for any of the reports tested. Cause: The County had not established or implemented formal review and approval procedures over the preparation and submission of grant reporting. Effect: The absence of documented review and approval controls increases the risk that errors or omissions in required reports may not be detected and corrected prior to submission, resulting in inaccurate information being provided to grantors. This could impact funding decisions, compliance with grant requirements, or future reimbursements. Repeat Finding: No. Recommendation: We recommend the County establish and implement formal procedures requiring supervisory review and approval of all reports submitted to grantors. Evidence of review should be documented and retained, including the reviewer’s signature or electronic approval, the date of review, and the date of submission, to support compliance with reporting requirements. Views of responsible officials: There is no disagreement with the finding.

Finding No.: 2025-001 Federal Agency: Environmental Protection Agency AL No. and Title: 66.039 Diesel Emission Reduction Act (DERA) National Grants 98T80301 Federal Award No.: Area: Procurement and Suspension and Debarment Criteria: 2 CFR 180.300 requires entities entering into a covered transaction with another person at the next lower tier to verify that the person with whom they intend to do business is not excluded or disqualified. Such verification can be made by (a) checking SAM.gov Exclusions, or (b) collecting a certification from that person; or (c) adding a clause or condition to the covered transaction with that person. 2 CFR 180.220 (b) (1) states that a contract for goods and services is a covered transaction if the contract is awarded by a participant in a nonprocurement transaction covered under §180.210, and the contract amount is expected to equal or exceed $25,000. 2 CFR 200.303 requires that a non-federal entity must “(a) establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: For one covered transaction during fiscal year 2025, the Authority represented that it performed verification of suspension or debarment from SAM.gov Exclusions, however, no formal documentation is kept on file to demonstrate compliance at the time of procurement. Cause: The Authority does not have formal policy requiring documentation of procedures performed to verify that the person in a covered transaction with whom they intend to do business is not excluded or disqualified. Effect or potential effect: The Authority lacked the formal documentation of procedures performed to demonstrate compliance to 2 CFR 180.300. Finding No.: 2025-001, continued Federal Agency: Environmental Protection Agency AL No. and Title: 66.039 Diesel Emission Reduction Act (DERA) National Grants 98T80301 Federal Award No.: Area: Procurement and Suspension and Debarment Questioned costs: None Context: There was only one covered transaction. The audit team verified that vendor is not excluded or disqualified. Recommendation: The Authority should formalize its policies and procedures in documenting procedures performed in verifying that the person in a covered transaction with whom they intend to do business is not excluded or disqualified. Views of responsible officials: The Authority agrees to the finding. Refer to the corrective action plan.

Finding: 2025-002 – Cash Management – Significant Deficiency in Controls over Compliance and immaterial instance of non-compliance Department: United States Department of Health and Human Services Program Name: Assistance for Torture Victims Federal Assistance Listing Number: 93.604 Criteria: 2 CFR 200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by COSO. 2 CFR 200.305 mandates that federal payments, including reimbursement, must minimize the time elapsing between fund transfer and disbursement. Condition/Context: During our walkthroughs of the cash draw process, the Organization indicated that evidence supporting preparation of the draw and review of the draw is not retained in its books and records. Additionally, the Organization drew funds in excess of their immediate cash needs, totaling approximately $350,000. Cause: Management did not have a documented policy and set of documented procedures in place to ensure consistent application of an independent review and memorializing that review. Effect: Draws in excess of amounts incurred may not be spent within three days. Further, any amounts claimed that are not allowable grant expenditures may be disallowed by the granting agency. Questioned Costs: None Repeat finding: This is a repeat finding – see prior year 2024-002. Recommendation: We recommend that the Organization establish a written policy and procedures for cash management that should be reviewed and approved by those charged with governance. The policy should require that all draws be reviewed by someone independent of the individual calculating the draw. The review should be documented in the Organization’s books and records. Views of responsible officials and planned corrective actions: Management agrees with the recommendation and has established a written policy and implemented a documented process for the preparation and review of federal drawdowns, including clear evidence of review such as signoffs or electronic approvals.

Finding 2025-002: Significant Deficiency in Internal Control Over Financial Statements – Inadequate Review of Expenditures Federal Programs 15.904 and 14.251 U.S Department of the Interior and U.S. Department of Housing and Urban Development Criteria: Under 2 CFR 200.303 and 2 CFR 200.508, the Organization must maintain effective internal control over compliance with federal award requirements, including documented evidence that disbursements are properly authorized, supported, and made in accordance with applicable grant agreements and organizational policies. Condition: During disbursement testing for the above federal programs, approvals were often evidenced only by the President’s signature on checks. Approval was not consistently documented on underlying invoices or in the accounting system, and practices for documenting preapproval of grant-related expenditures were not uniform. Cause: The Organization has not fully implemented a formal, documented expense approval process that requires and evidences review and authorization at the invoice or transaction level. Effect: Inconsistent documentation of approvals increases the risk that federal program disbursements may be processed without appropriate review, may not comply with grant requirements or organizational policies, or may be recorded in the wrong period or account. This represents a significant deficiency in internal control over compliance, although no unallowable or improper costs were identified in our testing. Questioned Costs: None. Recommendation: Implement a formal expense approval policy for federal program expenditures that requires documented approval at the invoice or transaction level (for example, signatures/initials on invoices or documented electronic approvals in QuickBooks Online). Establish an approval matrix with defined thresholds and authorized approvers to reduce reliance on the President and promote consistent application across programs. Views of responsible officials: See attached corrective action plan.

FINDING 2025‐001—ALLOWABLE COSTS/COST PRINCIPLES AND ACTIVITIES ALLOWED AND UNALLOWED AND SPECIAL TEST – DRAWDOWNS OF HOME/HOME ARP FUNDS—MATERIAL WEAKNESS IN INTERNAL CONTROLS OVER COMPLIANCE FEDERAL PROGRAM: Home Investment Partnerships Program (HOME) ASSISTANCE LISTING NUMBER: 14.239 YEAR(S): 2025 FEDERAL AGENCY: Department Of Housing and Urban Development (HUD) PASS‐THROUGH AGENCIES: Idaho Housing and Finance Association Criteria - In accordance with 2 CFR 200.303 the recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition/Context - On a periodic basis management submits draw-down requests to the pass-through agency. Management could not provide documentation to evidence that a review was performed over 100% of the draw-down requests prior to their submission. Further, during the testing of the underlying expenses, which are the primary inputs into the above-mentioned drawdown requests, management was able to evidence their review of payroll expenses via approved time sheets. However, non-payroll expenses and their associated indirect cost allocation calculations did not have evidence of management’s review for allowability. Cause - Management did not design and implement a control that required documented evidence of review and approval of the drawdown request. The control also did not ensure that the evidence of review of the underlying non-payroll expenses and indirect cost allocation calculations were retained. Effect - Management may not be able to detect and prevent unallowable expenses from being submitted to the passthrough agency for reimbursement, which could result in unallowed expenses being charged to the grant. Questioned Cost - Not Applicable Recommendation - Management should design and implement a control that ensures sufficient evidence of approval is obtained and retained, including underlying indirect cost allocation calculations and non-payroll costs. View of Responsible Officials - See Corrective Action Plan.

GRANT REPORTING U.S. Department of Homeland Security ALN 97.036 – Disaster Grants – Public Assistance Contract No. PA-B3-06-74-01-312 and PA-DR-06-74-01-166 Passed through the Florida Division of Emergency Management 2025 Funding Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Reports and reimbursement requests should be subject to independent review for the full fiscal year to verify completeness, validity and timeliness of submission. The grant agreement requires quarterly progress reports to be filed with the pass-through entity, Florida Division of Emergency Management. Condition: Review of quarterly reports and reimbursement requests were not documented by the City before submittal. Cause of condition: The department at the City that is responsible for managing the grant does not have a process in place to document their review of quarterly reports and reimbursement requests submitted to the Florida Division of Emergency Management. Potential effect of condition: Reports submitted to the Florida Division of Emergency Management may be incomplete, include errors, or be submitted late. Perspective: The department of the City that manages the grant did not have a documented process in place for the review and approval of quarterly reports and reimbursement requests prior to submittal to the grantor. Questioned costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should develop procedures to ensure documented management review of all reporting prior to submission to grantors. Management’s Response: The City updated its control process to ensure that reports prepared are reviewed by City staff or management prior to being submitted to grantor.

2025-001 Compliance and Internal Controls over Reporting (Significant Deficiency) Assistance Listing Number 17.259 – Workplace Innovation and Opportunity Act Cluster / WIOA Youth Activities 2024-2025 Funding U.S. Department of Labor Passed through Texas Workforce Commission / Houston Galveston Area Council Contract No. 206-25 Criteria: Under 2 CFR Section 200.303(a), the recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, per the Subrecipient Contract Scope of Work 13.1, a monthly report to the Board and H-GAC contract liaison is due by the 10th of each month. Monthly reports are required to be submitted to the grantor to properly track grant progress, which allows the grantor to determine if further action is needed to fulfill the purpose of the grant. Condition: Monthly reports for October 2024, December 2024 and May 2025 were not submitted timely. SER-Jobs’ established controls over the reporting process did not work effectively to detect and/or correct non-compliance over the reporting process. Cause: Monthly reports were submitted late due to delays in accounting period close, which delayed the submission process to include the financial information in the required reports. Effect: Failure to submit the required reports as stipulated in the scope of work by the grantor may constitute a breach of contract and potential loss of funding. Questioned Costs: None. Perspective: 3 out of the 4 reports selected for our testing were not submitted timely. Repeat Finding: No Recommendation: Ser-Jobs should establish procedures to ensure that controls related to reporting are consistently implemented which should include prompt completion of the accounting period close to allow for timely submissions. Views of Responsible Officials: We concur with the recommendation, please see Corrective Action Plan.

2025-001: Accounting Records and Documentation (Significant Deficiency) Federal Program: Child Nutrition Cluster – School Breakfast Program (AL No. 10.553) and National School Lunch Program (AL No. 10.555) Condition: During our audit of compliance with federal program requirements, we noted that the District did not consistently maintain accounting records and supporting documentation for Child Nutrition Program reimbursement transactions in a manner that ensured timely accessibility for audit testing. Certain reimbursement requests and related supporting documentation were not readily available during audit fieldwork. As a result, we were required to perform expanded audit procedures, including additional reconciliations and alternative testing, to obtain sufficient appropriate audit evidence supporting the reported reimbursement amounts. Criteria: Uniform Guidance (2 CFR §200.302 and §200.303) requires nonfederal entities to maintain accurate, complete, and adequately supported financial records and to establish effective internal controls to ensure compliance with federal program requirements. Cause: The deficiency appears to be attributable to weaknesses in the District’s documentation retention, organization, and supervisory review procedures related to Child Nutrition reimbursement reporting. Effect: Although documentation was not fully sufficient at the outset of audit testing, expanded audit procedures allowed us to obtain reliable support for the reimbursement amounts tested. No questioned costs or audit differences were identified as a result of this condition. Testing of reimbursement activity disclosed no variances between amounts reported and amounts received, based on a tested population totaling $793,987.13. Recommendation: We recommend that the District strengthen its internal controls over the preparation, review, organization, and retention of Child Nutrition Program reimbursement documentation to ensure that complete and accurate supporting records are maintained and readily available for audit and monitoring purposes. Views of Responsible Officials: The District’s management concurs with the finding and plans to implement procedures to improve the completeness and accessibility of accounting records and supporting documentation related to federal program reimbursements.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Suspension and Debarment, Reporting, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) Federal Program Title: Food Distribution Cluster Texas 1944 Water Treaty Grant ALN: 10.565, 10.568, 10.560 10.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Food Distribution Cluster 246TX816Y8105, 256TX816Y7105, 246TX818Y8613, 238TX000I1003, 246TX816Q2204 October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, November 3, 2023 - November 2, 2024, May 23, 2023 - June 30, 2025, October 1, 2023 - September 30, 2024 Texas 1944 Water Treaty Grant FSA25GRA0012028 March 19, 2025 - March 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Department of Agriculture (TDA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user termination controls, we identified two instances, out of a sample of 14 terminated users, in which access was not removed within the timeframe required by TDA’s System Administrator separation process (i.e., application access removed on the date of the ticket/same day of termination and network access within one business day): Application (TX‑UNPS): User A was terminated on 06/13/2025. Network access was removed on 06/16/2025 (within one business day), but TX‑UNPS application access remained active until 06/19/2025 (removed after four business days), which does not meet the same‑day requirement for application access. Network: User B was terminated on 09/13/2024. Network access was removed on 09/17/2024 (removed after one business day due to weekend/holiday schedule), which does not meet the requirement for removal within one business day. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that TDA: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: TDA agrees with the finding. TDA acknowledges that improvements can be made to the separation process.

Cash Management, Eligibility, Matching and Earmarking, Period of Performance, Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – Change Management Federal Agency: U.S. Department of Justice Federal Program Title: Crime Victim Assistance ALN: 16.575 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 15POVC-25-GG-00366-ASSI, 15POVC-24-GG-00728-ASSI, 15POVC-23-GG- 00468-ASSI, 15POVC-22-GG-00468-ASSI, 2020-V2-GX-0040 October 1, 2024 – September 30, 2028, October 1, 2023 – September 30, 2027, October 1, 2022 – September 30, 2026, October 1, 2021 – September 30, 2025, October 1, 2020 – September 30, 2025, October 1, 2019 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Office of the Governor must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our review of information technology general controls related to network change management, we noted that the organization does not have a formal, documented change control process governing changes and approvals to the network hardware components and systems. As a result, network changes may not be consistently documented, reviewed, or formally approved. For purposes of this control, network changes include any additions, modifications, or removals affecting the network infrastructure, including but not limited to: • Network hardware (e.g., routers, switches, firewalls, wireless devices) • Network device configurations • Network related software, firmware, or operating system components Questioned costs: None. Context: See “Condition.” Cause: Management is aware of this matter and a draft policy initiative is already underway and targeted for completion during fiscal year 2026. Effect: In the absence of a formal documented change management process, there is an increased risk that unauthorized or untested network changes could adversely impact the confidentiality, integrity, or availability of systems and data. Repeat Finding: No Recommendation: We recommend that management finalize and implement the formal, documented network change management process to ensure all changes to network hardware, configurations, and related software are properly requested, reviewed, approved, tested, and documented. Views of responsible officials: A formal but not documented process has been utilized which requires CIO approval of all changes. A Project was instigated in 2024 to formalize and embed the verbal process into a written process with auditable execution logs. The project is in its final stages

Reporting – Financial, Performance and Special Reporting Federal Agency: U.S. Department of Labor (DOL) Federal Program Title: Unemployment Insurance (UI) ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: UI372522255A48, UI380082260A48, UI382492255A48, 23A03UI0389351, 23A60UR000007, 23A60UB000060, 24A55UI000051, 24A55UT000017, 24A60UR000091, 24A60UD000038, 25A55UE000005, 25A60UB000137, 25A60UB000149, 25A60UB000176, 25A60UB000187, 25A60UD000047, 25A55UI000094, 25A55UT000066, 25A60UR000102 October 1, 2021 – December 31, 2024, January 1, 2022 – September 30, 2024, January 1, 2022 – March 31, 2025, October 1, 2022 – December 31, 2025, January 1, 2023 – September 30, 2025, April 1, 2023 – May 22, 2025, October 1, 2023 – December 31, 2026, October 1, 2023 – September 30, 2024, January 1, 2024 – September 30, 2026, May 17, 2024 – May 17, 2027, July 1, 2024 – December 31, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 9, 2024 – July 9, 2027, October 1, 2024 – December 31, 2027, October 1, 2024 – September 30, 2025, January 1, 2025 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of financial, performance, and special reporting, we identified gaps in TWC’s documentation and oversight of its reporting processes. Specifically, for the ETA 2112 – UI Financial Transaction Summary, we tested three monthly reports, and none contained evidence of review or approval prior to submission. Similarly, for the ETA 9050 – Time Lapse of All First Payments Except Workshare and the ETA 9052 – Nonmonetary Determination Time Lapse Detection performance reports, we tested three monthly submissions for each report type, and all lacked documentation demonstrating that a formal accuracy and completeness review was performed. In addition, our testing of two quarterly ETA 2208A – Quarterly UI Above-Base Reports identified a lack of segregation of duties. For both reports tested, the individual responsible for preparing the report also performed the review function. Questioned costs: None. Context: See “Condition.” Cause: The absence of documented reviews and approvals appears to result from insufficient internal controls over the reporting process, including unclear staff responsibilities. These control gaps contributed to inconsistent application of review procedures and allowed instances where documentation of required oversight did not occur or was performed by the same individual responsible for report preparation. Repeat Finding: No Recommendation: TWC should strengthen internal controls over the reporting process by establishing clear roles and responsibilities for the preparation, review, and approval of all required ETA reports. Management should ensure that each report undergoes a documented, independent review to verify accuracy and completeness before submission. Additionally, TWC should provide targeted training to staff on reporting requirements and internal control expectations to reinforce consistent application of review procedures and prevent situations where the preparer and reviewer are the same individual. Views of responsible officials: Management agrees on the importance of the ETA reports and the accuracy of the information in the reports.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Reporting – Information Technology – User Access Federal Agency: U.S. Department of Veterans Affairs Federal Program Title: Veteran's State Nursing Home Care ALN: 64.015 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: N/A Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), The General Land Office (GLO) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our assessment of access controls, we noted that while GLO performs user access reviews for accounts with privileged (elevated) access to the network. No periodic user access review is performed for all network users (non‑privileged/general users) within the audit period. As a result, there is no documented verification that standard user accounts retain only appropriate, job‑related access. Questioned costs: None. Context: See “Condition.” Cause: The condition appears to result from policy and process gaps that focus review efforts primarily on privileged accounts, coupled with the absence of a formalized, agency‑wide schedule and procedure for reviewing all network users’ access and retaining evidence of those reviews. Effect: Failure to conduct and document periodic access reviews for all network users increases the risk that: • Excessive or outdated access persists undetected; • Unauthorized access to systems or data may occur; • Potential security, operational, and compliance exposures are elevated. No instances of misuse were identified during our procedures; however, the lack of comprehensive reviews represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that GLO: • Establish a formal, documented access review program that covers all network users (privileged and non‑privileged) on at least an annual cadence. • Implement standardized templates and a central repository to capture review date, reviewer, population, exceptions identified, and remediation actions taken. • Periodically monitor adherence to the review schedule and report completion status and exceptions to management governance (e.g., IT leadership or an information security committee). Views of responsible officials: Management of the Texas General Land Office (GLO), Information Technology Services (ITS) Department, concurs with the audit finding and agrees that formalizing and documenting a periodic user access review process for all non-privileged network users will further strengthen the agency’s internal control framework and cybersecurity posture in alignment with 2 CFR §200.303 and applicable federal internal control standards.

Procurement and Suspension and Debarment Federal Agency: U.S. Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) ALN: 66.468 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2521902915 September 1, 2024 - August 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Commission on Environmental Quality (TCEQ) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.318, the recipient or subrecipient must maintain and use documented procedures for procurement transactions under a federal award or subaward, including for acquisition of property or services. These documented procurement procedures must be consistent with State, local, and tribal laws and regulations and the standards identified in §§ 200.317 through 200.327. Per 2 CFR §200.214, recipients and subrecipients are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, as well as 2 CFR part 180. The regulations in 2 CFR part 180 restrict making Federal awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from receiving or participating in Federal awards. Condition: Audit procedures included a review of five procurements conducted during the fiscal year to assess whether TCEQ adhered to required procurement procedures and performed vendor eligibility verifications prior to entering into covered transactions. For one procurement, totaling $16,175, the required procurement processes were not followed, and the necessary vendor compliance checks, including verification of suspension and debarment status, were not completed before executing the transaction. Questioned costs: None. Context: See “Condition.” Cause: The procurement was initiated directly by the program area without notifying or coordinating with the Procurement and Contracts Section. Program staff proceeded with the purchase under the assumption that procurement involvement was unnecessary because the selected vendor was the sole provider of the required item. As a result, established procurement procedures and vendor compliance verification processes were not followed. Effect: Failure to follow procurement procedures and complete proper vendor compliance checks prior to entering into a covered transaction may lead to entering contracts with suspended or debarred vendors that could result in noncompliance and questioned costs. Repeat Finding: No Recommendation: TCEQ should provide targeted training to program staff on federal procurement requirements, including the necessity of coordinating all purchases through the P&C Section and completing required vendor compliance checks. Training should emphasize procedures for sole‑source or limited‑source procurements and reinforce staff responsibilities under 2 CFR procurement and internal control standards. Regular refresher sessions and documented guidance will help ensure consistent understanding and adherence to required procurement practices across all program areas. Views of responsible officials: The Financial Administration Division (FAD) will implement the audit’s recommendations. FAD will reinforce the guidance provided through continuous training, documentation, and improved internal controls.

Cash Management, Eligibility, Level of Effort, Earmarking, Period of Performance, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Education (USDE) Federal Program Title: Career and Technical Education - Basic Grants to States ALN: 84.048 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: V048A220043, V048A230043, V048A240043 July 1, 2022 - September 30, 2023, July 1, 2023 - September 30, 2024, July 1, 2024 - September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Higher Education Coordinating Board (THECB) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of access controls, we noted that while THECB performs user access reviews for individuals with network access, the reviews were not documented. The absence of documented evidence prevents verification that the reviews were completed, who performed them, when they were performed, and whether identified issues were appropriately resolved. Questioned costs: None. Context: See “Condition.” Cause: The lack of documented access reviews appears to result from informal review processes and insufficient procedures requiring reviewers to maintain written evidence of the review. Additionally, there may be no standardized template or centralized repository for retention of such documentation. Effect: Without documentation of the network access review, THECB cannot demonstrate that: • Reviews were performed within the applicable audit period • Access rights were validated for appropriateness • Unauthorized or outdated access was identified and removed This lack of documentation increases the risk of unauthorized system access, potential misuse of systems or data, and noncompliance with federal internal control requirements. Repeat Finding: No Recommendation: We recommend that THECB: • Develop and implement a standardized documentation process for all user access reviews, including a required template documenting review date, reviewer identity, scope, results, and remediation actions. • Maintain all documentation in a centralized repository accessible to IT management and audit personnel. • Implement periodic monitoring to ensure reviews are performed timely and documentation is consistently retained. • Consider using automated access review tools to support completeness, timeliness, and auditability of reviews. Views of responsible officials: THECB ITS agrees with the finding.

Reporting – ACF-196R Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF October 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR §265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. The ACF-204 report (Annual Report on State Maintenance-of-Effort Programs) must be completed and submitted in accordance with the requirements at 45 CFR §265.9(c). The report includes several line items that contain critical information, including “Total State MOE Expenditures.” Input for the Total State MOE expenditures line item is provided by the Texas Education Agency (TEA), the Texas Workforce Commission (TWC), and HHSC. The MOE amounts in the ACF-204 report are to agree to the amounts in the final ACF-196R report. For the FY2024 ACF-196R report, the contributing agencies reported State MOE expenditures on various line items including but not limited to: HHSC – Line 6a (Basic Assistance (excluding Relative Foster Care Maintenance Payments and Adoption and Guardianship Subsidies) TEA – Line 11b (Pre-Kindergarten/Head Start) Condition: All key line items in the FY 2024 ACF‑204 report were tested and agreed to supporting documentation without exception. However, the Total State Maintenance of Effort (MOE) Expenditures reported in the ACF‑204 by HHSC and the Texas Education Agency (TEA) did not reconcile to the amounts reported in the ACF‑196R as shown below: Amounts reported in the ACF‑204 were accurate and supported; the variances occurred because the ACF‑196R reflected higher MOE expenditures than those reported on the ACF‑204. Questioned costs: None. Context: See “Condition.” Cause: The variance in line 11b was due to miscommunication between the relevant HHSC personnel regarding revisions to an initial submission. The variance in line 6a was due to the HHSC Federal Reporting Team incorrectly including period 1 of 2025 in the MOE calculation. The agency did not perform a complete reconciliation between the ACF‑204 and ACF‑196R prior to submission, resulting in inconsistent MOE reporting across the required reports. Effect: Inaccurate or inconsistent reporting of MOE expenditures increases the risk of noncompliance with federal reporting requirements under 2 CFR §200.302 (financial management) and 2 CFR §200.329 (performance and financial reporting). These discrepancies may impair the federal awarding agency’s ability to evaluate program performance, assess State MOE compliance, and rely on the accuracy of reported financial information. Repeat Finding: No. Recommendation: HHSC should strengthen their financial reporting controls to ensure consistency between the ACF‑204 and ACF‑196R reports. Specifically, the agency should implement a formal reconciliation process that: • Compares all MOE expenditure amounts reported on the ACF‑204 to those reported on the ACF‑196R prior to submission; • Requires documented review and approval of the reconciliation by management; and • Ensures any discrepancies are researched, resolved, and corrected before the reports are finalized. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Child Support Non-Cooperation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 608 (a)(2), if the agency responsible for administering the State plan approved under part D determines that an individual is not cooperating with the State in establishing paternity or in establishing, modifying, or enforcing a support order with respect to a child of the individual, and the individual does not qualify for any good cause or other exception established by the State pursuant to section 654(29) of this title, then the State: (1) shall deduct from the assistance that would otherwise be provided to the family of the individual under the State program funded under this part an amount equal to not less than 25 percent of the amount of such assistance; and (2) may deny the family any assistance under the State program. The State’s policy is to reduce benefits 100% for non-cooperation. HHSC policy requires that when the Office of the Attorney General (OAG) identifies a TANF recipient who has failed to cooperate with child support requirements, OAG must notify HHSC within seven days of the non‑cooperation date. Upon receipt, HHSC must apply the sanction within five working days. Condition: A sample of 40 TANF beneficiaries who were reported as non‑cooperating with program requirements during fiscal year 2025 was selected for testing. Two instances of untimely sanction application were identified: • One case in which HHSC reduced benefits one month late, resulting in an overpayment of $320. • One case in which HHSC reduced benefits two months late, resulting in an overpayment of $890. Questioned costs: $1,210 Context: See “Condition.” Cause: HHSC’s internal controls did not consistently ensure timely processing of sanctions upon receipt of non‑cooperation referrals from OAG. Existing monitoring and workflow procedures were insufficient to detect or prevent delays in applying benefit reductions. Effect: Failure to apply sanctions within required timeframes can lead to inaccurate benefit issuance, questioned costs, and weakened program integrity. Repeat Finding: No. Recommendation: HHSC should strengthen internal controls over the processing of TANF non‑cooperation sanctions to ensure timely application in accordance with program requirements. Specifically, HHSC should: • Implement an automated or workflow‑based tracking mechanism to monitor the timeliness of sanctions received from OAG. • Provide refresher training to eligibility staff on timely sanction procedures and the importance of preventing improper payments. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §261.60(a)-(c), a State must report the actual hours that an individual participates in an activity. It is not sufficient to report the hours an individual is scheduled to participate in an activity. For unsubsidized employment, subsidized employment, and on-the-job training, the State may report projected actual hours of employment participation for up to six months based on current, documented actual hours of work. Any time the State receives information that the client's actual hours of work have changed, or no later than the end of any six-month period, the agency must re-verify the client's current actual average hours of work and may report these projected actual hours of participation for another six-month period. Condition: Audit procedures included independently recalculating average work participation hours for a sample of 40 TANF cases and comparing those results to the hours reported to the U.S. Department of Health and Human Services on the ACF‑199 report. For one of the 40 cases tested, the recalculated average work hours did not agree with the hours reported on the ACF‑199. This discrepancy resulted in a net overstatement of 9 hours on the ACF‑199 report. Questioned costs: No. Context: See “Condition.” Cause: The variance in reported hours for the affected case resulted from a system processing error by the third‑party vendor. During extraction from the WorkInTexas (WIT) system, TWC’s case management system, and file creation for transmission to HHSC, certain hour entries were inadvertently duplicated, leading to the double‑counting of participation hours and, consequently, an overstatement in the ACF‑199 reporting. Effect: Inaccurate reporting of work participation hours affects the reliability of the State’s TANF data submitted to the federal government and may compromise the accuracy of the State’s calculated work participation rates. Such reporting inaccuracies increase the risk of noncompliance with federal work verification requirements and may expose the State to potential penalties if similar errors are systemic or not promptly addressed. Repeat Finding: No. Recommendation: TWC, in coordination with the system vendor, should strengthen controls over the extraction, translation, and transmission of work participation hour data used in the ACF‑199 report. Specifically, TWC should: • Require the third-party vendor to implement system safeguards that prevent the duplication of hour entries during data extraction from the WIT system and subsequent file creation. • Establish automated validation checks to detect anomalies such as duplicate lines, unexpected variances, or irregular hour totals prior to ingesting vendor files into TWC systems. • Enhance supervisory review procedures to ensure that data received from third‑party vendors is reconciled to source records and verified for completeness and accuracy before inclusion in federal reporting. Views of responsible officials: TWC’s Divisions of Workforce Development, Information Technology, and Information, Innovation and Insight agree with the recommendations.

Cash Management – Cash Management Improvement Act Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXLIEA, 2301TXLIEE, 2401TXLIEA, 2401TXLIEI, 2501TXLIEA, 2501TXLIEI October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 31 CFR §205.20, states use clearance patterns to project when funds are paid out, given a known dollar amount and a known date of disbursement. A state must ensure that clearance patterns meet the following standards: (a) A clearance pattern must be auditable. (b) A clearance pattern must accurately represent the flow of Federal funds under the Federal assistance programs to which it is applied. (c) A clearance pattern must include seasonal or other periodic variations in clearance activity. (d) A clearance pattern must be based on at least three consecutive months of disbursement data, unless additional data is required to accurately represent the flow of Federal funds. (e) If a State uses statistical sampling to develop a clearance pattern, the sample size must be sufficient to ensure a 96 percent confidence interval no more than plus or minus 0.25 weighted days above or below the estimated mean. (f) A clearance pattern must extend, at a minimum, until 99 percent of the dollars in a disbursement have been paid out for Federal assistance program purposes. (g) We and a State may agree to other procedures, such as estimates to project when funds are paid out when the dollar amount and/or the timing of disbursements are not known. Condition: The LIHEAP program is included in the Treasury-State Agreement effective for the fiscal year ending August 31, 2025, and it meets the threshold for inclusion under the Cash Management Improvement Act (CMIA). As such, TDHCA is required to prepare Period 1 clearance pattern calculations supported by verifiable disbursement data to ensure federal funds are drawn in accordance with the program’s required average clearance pattern of three days. TDHCA did not prepare a Period 1 clearance pattern calculation for LIHEAP based on at least three consecutive months of disbursement data as required. Although the Treasury-State Agreement specifies a three‑day average clearance pattern for the program, TDHCA did not maintain or provide documentation supporting how this clearance pattern was developed. As a result, the clearance pattern was not auditable, and we were unable to determine whether TDHCA’s practices for drawing federal funds aligned with the CMIA requirements. Questioned costs: None. Context: See “Condition.” Cause: Management noted their clearance pattern reflected their established funding techniques and prior reports; therefore, they overlooked the specific Treasury-State Agreement documentation requirements. Effect: Although we were able to perform testing over TDHCA’s cash management practices for LIHEAP and concluded that no federal interest was earned as a result of timing differences, the absence of a documented Period 1 clearance pattern calculation prevented us from validating the accuracy of the three‑day clearance pattern prescribed in the Treasury–State Agreement. Without an auditable calculation, TDHCA cannot demonstrate that the established clearance pattern is supported by actual disbursement data, which limits assurance that the methodology used for federal draws fully complies with CMIA requirements. Repeat Finding: No Recommendation: TDHCA should establish and implement procedures to ensure that a Period 1 clearance pattern calculation is completed and retained for LIHEAP in accordance with CMIA and Treasury–State Agreement requirements. This calculation should be based on at least three consecutive months of actual disbursement data and documented in a manner that is readily auditable. TDHCA should also provide training to staff responsible for CMIA compliance to ensure they are aware of the requirement to prepare and maintain this calculation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Reporting – Quarterly Performance and Management Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2501TXLIEI October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §96.82(a), each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Key Line Items containing critical information include: 1. Section 1 – Total Households Assisted 2. Section 2 – Performance Management 3. Section 3 – Estimated Use of Funds 4. Section 4 – LIHEAP Program Implementation and Support Condition: As part of our testing of the Quarterly Performance and Management Report for award 2501TXLIEI, we selected 2 of the 4 reports submitted during the fiscal year. During our review, we identified a discrepancy in the quarter 1 report (October 1 – December 31). The report stated that $159,463,428 in LIHEAP funds had been obligated by funding source in Section 3 – Estimated Use of Funds; however, supporting documentation reflected obligated funds totaling $174,447,109, resulting in a variance of $(14,983,681). Questioned costs: None. Context: See “Condition.” Cause: An error was made when TDHCA staff entered the amount of funds obligated into the report, and existing internal controls did not detect the error before the report was submitted to U.S. Department of Health and Human Services (HHS) Effect: Inaccurate reporting may lead to misstated financial information at the federal level, hinder management’s ability to make informed decisions, and could affect federal oversight and monitoring of program activity. These discrepancies increase the risk of noncompliance with federal reporting requirements and may impact the integrity of cumulative statewide LIHEAP reporting. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its review and reconciliation procedures for quarterly LIHEAP reporting to ensure that amounts reported are fully supported by accurate and complete documentation. This should include implementing a formal review process that requires verification of reported obligation amounts against source records prior to submission, as well as enhanced training for staff responsible for report preparation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Period of Performance, Reporting, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Temporary Assistance for Needy Families 2401TXTANF, 2501TXTANF October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2025 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Department of Family and Protective Services (DFPS) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user access termination controls, we identified two instances, out of a sample of 25 terminated users, in which individuals were not removed from the Network and IMPACT in a timely manner. In both cases, the users’ accounts remained active well beyond their documented termination dates, resulting in unauthorized active credentials during the post‑termination period. The two exceptions were as follows: User A: Termination date 11/05/2024; access not removed until 11/22/2024. User B: Termination date 11/17/2024; access not removed until 02/20/2025. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend DFPS: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: Management agrees with the findings.

Reporting – Post-Expenditure Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: • TANF Funds Transferred into SSBG –Amount reported on this line item should be consistent with the TANF federal financial report (ACF-196R). The Federal Funds Office (FFO) is responsible for the completeness, accuracy, and timely submission of the Post Expenditure Report. Federal Reporting Fiscal Management personnel are responsible for proper reporting and submission of the ACF-196R Report. Condition: During testing of key line items for the FY2024 Post Expenditure Report submitted in March 2025, we noted that TANF Funds Transferred into SSBG was reported as $41,623,634. However, the amount reported on the ACF-196R report was $38,778,521, resulting in a variance of $2,845,113. Questioned costs: None Context: See “Condition.” Cause: FFO did not properly coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196R report were consistent with the amount on the Post Expenditure Report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: 2023-013, 2024-008 Recommendation: We recommend the FFO coordinate with the appropriate Federal Reporting Team personnel regarding amounts noted for the TANF Funds Transferred into SSBG to ensure the amount in the Post Expenditure Report matches with the amount in the ACF-196R. Views of responsible officials: HHSC concurs with the recommendation.

Earmarking – Administrative Expenses Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM087322 October 17, 2022 – October 16, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 300x-5(b), a funding agreement for a grant under section 300x of this title is that the State involved will not expend more than 5 percent of the grant for administrative expenses with respect to the grant. Condition: HHSC expended $1,069,086 of the total grant award amount of $3,690,918 as of the end of the project period. Administrative expenditures for the grant totaled $54,672, which represents 5.11 percent of the federal funds expended, exceeding the allowable 5 percent threshold. Questioned costs: $1,217. Context: See “Condition.” Cause: The overage resulted from a delay in the grant’s start date, which subsequently postponed the initiation of related projects and led to lower overall expenditures. Effect: By exceeding the 5 percent administrative cap, HHSC did not comply with the statutory limitation on administrative costs, resulting in unallowable administrative expenditures charged to the grant. This noncompliance may require reimbursement to the federal agency and increases the risk of future questioned costs. Repeat Finding: No Recommendation: We recommend HHSC make necessary adjustments to federal expenditures in the event of program delays to ensure the agency stays within required percentage maximums. Views of responsible officials: HHSC concurs with the recommendation.

Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Special Education – Grants for Infants and Families Temporary Assistance for Needy Families (TANF) Block Grants for Prevention and Treatment of Substance Abuse ALN: 84.181 93.558 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Special Education – Grants for Infants and Families H181A200171, H181A210171, H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024, July 1, 2024 – September 30, 2025, July 1, 2025 – September 30, 2026 TANF 2001TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF and 2501TXTANF October 1, 2019 – September 30, 2020, October 1, 2020 – September 30, 2021, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI083054, 1B08TI083478, 1B08I084673, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2019 – September 30, 2021, October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), assistance listings numbers (ALN), and title of the program. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Special Education – Grants for Infants and Families (SEGIF) –The UEI was not included in the base subaward agreement for seven of the eight agreements selected for testing. The last amendment to the original agreement included the UEI number, however, it did not reference the ALN and title of the program. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Temporary Assistance for Needy Families – The ALN and title of the program was not included in four of the seven subaward agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Block Grants for Prevention and Treatment of Substance Abuse –The UEI was not included in one of the 18 agreements selected for testing. The start and end dates for the agreement was September 1, 2020 – August 31, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR §200.332 prior to execution is not at the correct precision level. Effect: Because required subaward information was omitted, HHSC increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing UEI, ALN, and program titles may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: HHSC concurs with the recommendation.

Level of Effort - Supplement not Supplant Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster ALN: 93.044, 93.045, 93.053 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD October 1, 2021 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §1321.9(c)(2)(xvi), funds awarded under Title III of the Older Americans Act for services provided under section 321(d) (42 U.S.C 3030d(d)) must be used to supplement, not supplant existing Federal, State, and local funds expended to support those activities. Condition: A comparison of supportive services and senior center funding between fiscal years 2023 and 2024 showed that total service levels increased by approximately 5 percent, rising from $40,354,713 in FY2023 to $42,267,130 in FY2024. During the same period, federal expenditures increased by 8 percent, from $31,170,863 to $33,755,005, while non‑federal expenditures decreased by 7 percent, from $9,183,850 to $8,512,125. Because the increase in federal funding outpaced the increase in total services, and was accompanied by a reduction in non‑federal contributions, federal funds effectively replaced rather than supplemented state or other non‑federal resources. Accordingly, HHSC supplanted non‑federal funds with federal funds for the 2024 grant. To quantify the financial impact, total services increased by 5 percent; therefore, the federal contribution would be expected to increase proportionally by 5 percent. Applying a 5 percent growth rate to the FY2023 federal amount of $31,170,863 yields an expected level of $32,729,406 for FY2024. However, actual federal expenditures totaled $33,755,005, resulting in excess federal funding of $1,025,599 beyond what would be needed to support the observed service increase. Questioned costs: $1,025,599. Context: See “Condition.” Cause: HHSC has followed supplement not supplant policies and procedures that were implemented based on compliance with total level of services (i.e., all services) and not specifically for supportive services and senior centers, as required. Effect: HHSC has supplanted non-federal funds used for supportive services and senior centers, resulting in questioned costs and noncompliance. Repeat Finding: No Recommendation: HHSC should revise existing policies and procedures to ensure they are not supplanting nonfederal funds specifically related to supportive services and senior centers. Views of responsible officials: HHSC concurs with the recommendation.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.044, 93.045, 93.053 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXSSC6, 2101TXCMC6, 2101TXHDC6, 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD, 2201TXSTPH, 2301TXOAHD, 2301TXOACM, 2301TXOASS, 2301TXOANS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS, 2501TXOASS, 2501TXOAHD, 2501TXOACM, 2501TXOANS April 1, 2021 – September 30, 2025, October 1, 2021 – September 30, 2024, January 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 TANF 2401TXTANF and 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Block Grants for Community Mental Health Services 1B09SM085913, 1B09SM085385, 1B09SM087345, 1B09SM087322, 1B09SM089380, 1B09SM089610, 1B09SM089984 September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, September 30, 2023 – September 29, 2025, October 1, 2023 – September 30, 2025, September 30, 2024 – September 29, 2026 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Nonmajor programs Opioid STR 6H79TI083288, 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. As of March 8, 2025, fsrs.gov was retired, and all subaward reporting data and functionality are now on SAM.gov. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards on FSRS.gov or SAM.gov. A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligation at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS.gov or SAM.gov. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2024-005, 2023-010, 2022-013, 2021-007 Views of responsible officials: HHSC concurs with the recommendation.

Special Provisions- Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Cluster (CCDF) ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCDC6, 2201TXCCDD, 2201TXCCDF, 2301TXCCDF, 2301TXCCDD, 2501TXCCDF, 2401TXCCDM, 2401TXCCDF, 2401TXCCDD, 2501TXCCDD, 2501TXCCDM, 2501TXCCDY October 1, 2020 – September 30, 2024, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026, October 1, 2024 – September 30, 2026, October 1, 2024 – September 30, 2027, and December 21, 2024 – September 30, 2028. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing fraud. In order to identify and recover payments, pursuant to TWC’s Childcare Services Guide (November 2024), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. TWC must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: According to the TWC Division of Fraud Deterrence and Compliance Monitoring’s Standard Operating Procedures for Workforce Board PIRTS Audits, when a Workforce Development Board identifies an improper payment, the Board is required to issue a Notice of Determination informing the participant of their ineligibility, the amount and time period of the improper payment, and the reason for the determination. If the improper payment results from fraud, the Board must issue a first collection letter within 30 days of sending the determination notice to initiate recoupment of the ineligible amount. If repayment is not received or an active payment plan is not established, the Board must issue a final collection letter and refer the participant to TWC for a warrant hold, which restricts the individual from receiving future services until the outstanding amount is recovered. All correspondence is to be documented and maintained in the Program Integrity Reporting Tracking System (PIRTS), the system used by Boards to report and track childcare fact‑finding, fraud determinations, and recoupment activities. As part of our audit procedures, we tested 40 of the 297 closed cases reported to TWC in fiscal year 2025 to verify that TWC followed its procedures related to authenticating that a payment was fraudulent and subsequently recovered payment, if applicable. Of the 40 cases tested, 12 cases did not follow the prescribed procedures and lacked evidence that the Workforce Boards issued the required 1st collection letter within the 30‑day timeframe. Questioned costs: None. Context: See “Condition.” Cause: The exceptions identified occurred because TWC did not provide adequate oversight or monitoring of Workforce Board compliance with established PIRTS procedures. Without routine monitoring, follow‑up, or enforcement mechanisms to ensure Boards issued collection letters within required timeframes, lapses in adherence to the 30‑day requirement went undetected. This lack of oversight contributed to inconsistent application of required fraud‑recovery processes across Boards. Effect: Failure to ensure that Workforce Development Boards issued required first collection letters within the prescribed 30‑day timeframe impeded timely initiation of recoupment efforts for fraudulent childcare payments. This condition increases the risk that improper payments resulting from fraud may not be recovered in a timely manner and that individuals with outstanding fraudulent overpayments may continue to seek or receive services. Repeat Finding: No Recommendation: TWC should strengthen its oversight of Workforce Board compliance with PIRTS requirements by implementing routine monitoring procedures to verify that Boards issue first collection letters within the required 30‑day timeframe. This may include periodic reviews of PIRTS documentation, automated tracking or alerts for timeliness, and follow‑up with Boards when deadlines are missed. Additionally, TWC should provide guidance or refresher training to reinforce expectations and ensure consistent application of improper payment recovery procedures across all Boards. Strengthening these oversight mechanisms will help reduce the risk of delayed collection efforts and improve adherence to established fraud‑deterrence processes. Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. TWC’s Division of Fraud Deterrence and Compliance Monitoring’s Office of Investigations (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. Additionally, TWC’s Subrecipient Monitoring Department (SRM) tests Board compliance with respect to childcare improper payment reporting and recoupment. TWC currently conducts routine monitoring and follow-up to ensure Boards issue collections letters in a timely fashion. That being said, TWC does agree that our objectives would be better served with more robust measures. Currently, FDCM/OI investigators review a sample of PIRTS reports on a monthly basis to ensure that Boards are uploading all required documentation related to childcare improper payments and undertaking collection efforts. Investigators review two randomly selected cases for each Board per month on a rolling basis for the prior three months. FDCM/OI also conducts periodic PIRTS training and retraining with Board staff. Additionally, the PIRTS system sends automated reminder notifications for Board staff to issue collection letters. FDCM/OI realizes the importance of issuing collection letters in a timely matter. Doing so not only increases the likelihood that important child care funds are remitted, but also assists with additional enforcement activities including prosecution of substantiated fraud. FDCM/OI takes the integrity of child care funds very seriously and will aid prosecution where appropriate.

Special Tests and Provisions – ADP Risk Analysis and System Security Review Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5001, 2505TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 – September 30, 2024, October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2024, October 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – December 31, 2024, October 1, 2024 – December 31, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §95.621, State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. Condition: HHSC maintains a total of 35 in-house and third-party systems that are used in the administration of Medicaid, which are required to be reviewed each biennial period. During the fiscal year 2024-2025 biennial, only 15 risk assessments were executed based on internal methodology or third-party assessments. HHSC did not perform risk assessments over the remaining 20 systems during the two-year period. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to it’s current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2024-012, 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5001, 2505TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 – September 30, 2024, October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2024, October 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – December 31, 2024, October 1, 2024 – December 31, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC policies require the completion of Form 2567 Statement of Deficiencies and Plan of Correction to include the prefix tag, the deficiency that contains the code of federal regulations (CFR) or life safety code (LSC) reference for each health and safety survey conducted. HHSC is required to mail a copy of the completed form to the provider within ten business days after the exit date of the survey to ensure any deficiencies noted are addressed timely. For one of 40 health surveys conducted during the fiscal year, Form 2567 was mailed out to the provider 162 business days after the exit date of the survey. While the form was mailed after the required timeline per HHSC policy, it did not include any cited deficiencies. Questioned costs: None. Context: See “Condition.” Cause: After the provider's exit date, HHSC regional staff subsequently determined, several months later, that the required notice had not been issued to the facility. This oversight occurred during a period of transition within the ICF team. Effect: Failure to notify a provider of identified deficiencies in a timely manner may prevent the provider from implementing corrective actions within the required timeframe to meet compliance deadlines. Such delays increase the risk of continued noncompliance and may result in inappropriate payments for new admissions before the provider agreement is terminated. Repeat Finding: No. Recommendation: HHSC should enhance and/or reinforce existing internal controls to ensure timely completion and mailing of Form 2567 to meet standards in 42 CFR Part 442 and related policy requirements. This could include developing automated tracking systems or checklists to monitor survey deadlines and/or providing refresher training for all regional staff involved in the survey and notification process. Views of responsible officials: HHSC concurs with the recommendation.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Equipment and Real Property Management, Matching, Level of Effort and Earmarking, Period of Performance, Procurement and Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) U.S. Department of Education (USDE) U.S. Department of Health and Human Services Social Security Administration Federal Program Title: SNAP Cluster Special Education Grants for Infants and Families Temporary Assistance for Needy Families Social Services Block Grant Block Grants Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse Aging Cluster Medicaid Cluster Disability Insurance/ SSI Cluster ALN: 10.551, 10.561 84.181 93.558 93.667 93.958 93.959 93.044, 93.045, 93.053 93.775, 93.777, 93.778 96.001, 96.006 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SNAP Cluster 6TX400105, 6TX400106, USDA-FNS-SNAP-24-EVS-TX October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, September 25, 2024 - September 30, 2025 Special Education Grants for Infants and Families H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2022 - September 30, 2023, July 1, 2023 - September 30, 2024, July 1, 2024 - September 30, 2025, July 1, 2025 - September 30, 2025 Temporary Assistance for Needy Families 1601TXTANF, 1801TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF, 2501TXTANF October 1, 2015 - September 30, 2016, October 1, 2017 - September 30, 2018, October 1, 2020 - September 30, 2022, October 1, 2021 – September 30, 2022, October 1, 2022 - September 30, 2023, October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2025 - September 30, 2026 Block Grants Community Mental Health Services B09SM089610, B09SM087322, B09SM087345, B09SM085385, B09SM089380, B09SM089984, B09SM085913 October 1, 2023 - September 30, 2025, October 17, 2022 - October 16, 2024, October 1, 2022 - September 30, 2024, September 1, 2021 - March 24, 2025, September 30, 2023 - September 29, 2025, September 30, 2024 - September 29, 2026, September 1, 2021 - March 24, 2025 Block Grants For Prevention and Treatment of Substance Abuse B08TI087067, B08TI085835, B08TI084609, B08TI088134, B08TI083969 October 1, 2023 - September 30, 2025, October 1, 2022 - September 30, 2024, September 1, 2021 - March 24, 2025, October 1, 2024 - September 30, 2026, September 1, 2021 - March 24, 2025 Aging Cluster 2101TXSSC6, 2101TXCMC6, 2101TXHDC6, 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD, 2201TXSTPH, 2301TXOAHD, 2301TXOACM, 2301TXOASS, 2301TXOANS, 2401TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2501TXOASS, 2501TXOAHD, 2501TXOAHD, 2501TXOANS April 1, 2021 - September 30, 2025, October 1, 2021 - September 30, 2024, January 1, 2022 - September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 - September 30, 2025, October 1, 2024 - September 30, 2026 Medicaid Cluster 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2024, October 1, 2024 - September 30, 2024, October 1, 2024 – September 30, 2025, October 1, 2023 - September 30, 2025, October 1, 2024 - December 31, 2024 Disability Insurance/ SSI Cluster 2304TXDI00, 2404TXDI00, 2504TXDI00 October 1, 2023 - February 2, 2024, October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user access within the CAPPS FIN (PeopleSoft Financials) system, we identified two user accounts, out of 17 tested, that had been granted inappropriate access to the PeopleSoft Administrator role. This role provides elevated privileges beyond those required for their job duties and should be limited to authorized system administrators. Management remediated the inappropriate access on November 10, 2025. Questioned costs: None. Context: See “Condition.” Cause: The inappropriate access assignments appear to result from gaps in privileged access provisioning and periodic re‑certification controls within the CAPPS FIN environment. Effect: Improper assignment of elevated PeopleSoft Administrator access in CAPPS FIN increases the risk of: • Unauthorized changes to system configuration, accounting rules, or financial data; • Data modification or exposure, including information related to federal program expenditures; • Bypassing of compensating controls intended to maintain data integrity and separation of duties; Although management removed access on 11/10/2025, the presence of improper administrator‑level access before remediation represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend HHSC: • Strengthen privileged access provisioning by requiring documented approval, business justification, and periodic revalidation for all elevated roles in CAPPS FIN. • Implement a formal, recurring privileged access review across all CAPPS FIN modules, with documented results and timely remediation of exceptions. • Utilize identity governance tools or CAPPS FIN security reporting to automatically flag unauthorized assignments of administrator roles. Views of responsible officials: HHSC concurs with the recommendation.

Assistance Listing, Federal Agency, and Program Name - 93.088, U.S. Department of Health and Human Services, Advancing System Improvements for Key Issues in Women's Health 93.323, U.S. Department of Health and Human Services, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.592, U.S. Department of Health and Human Services, Family Violence Prevention and Services/Discretionary and COVID - 19 Family Violence Prevention and Services/Discretionary 93.837, U.S. Department of Health and Human Services, Cardiovascular Disease Research (Research and Development Cluster) Federal Award Identification Number and Year - 93.088 ASTWH220110 (2023 and 2024) 93.323 - 32680012K (2024) 93.592 - 90EV0516 (2021); 90EV0530 (2023); ; 90EV0544 (2024) 93.837 - U01HL146245 (2024) Pass through Entity - 93.088 N/A 93.323 - Illinois Department of Public Health 93.592 - N/A 93.837 - N/A Finding Type - Material weakness and material noncompliance with laws and regulations Repeat Finding - Yes 2024-001 Criteria - Per 2 CFR 200.303(a), nonfederal entities must establish and maintain effective internal controls over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.318(a), the nonfederal entity must have and use documented procedures, consistent with state, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a federal award or subaward. The nonfederal entity's documented procurement procedures must conform to the procurement standards identified in §§200.317 through 200.327. The LLC has established in its internal procurement policies and procedures that a minimum of 3 quotes must be obtained for purchases made under informal, simplified acquisition procedures. Per 2 CFR 200.318(i), the nonfederal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Condition - Controls were not sufficient to ensure that the history of procurement decisions was documented, as required by 2 CFR 200. Additionally, controls were not sufficient to ensure checks for suspension and debarment were documented before entering into covered transactions with third parties. Questioned Costs - unknown If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported We are unable to predictably quantify, had federal procurement standards been followed, which portion of activity presented on the SEFA under these contracts would be in question. Identification of How Questioned Costs Were Computed N/A Context - 93.088 - Management was unable to provide evidence that three out of three contractors tested was checked for suspension and debarment in advance of entering into a covered transaction. 93.323 - Management was unable to provide evidence that three out of three contractors tested was checked for suspension and debarment in advance of entering into a covered transaction. 93.592 - Management was unable to provide evidence that four out of four contractors tested was checked for suspension and debarment in advance of entering into a covered transaction. 93.837 - Of the four contracts tested, management was unable to produce records sufficient to detail the history of procurement for one contract. Additionally, for that same contractor, management was unable to provide evidence that the third party was checked for suspension and debarment in advance of entering into a covered transaction. Because we were able to confirm via a check of the Excluded Parties Listing that the contractors noted above were not suspended or debarred, no questioned costs related to this noncompliance were identified. Cause and Effect - Newly revised procurement policies and procedures implemented during the last month of the fiscal period under audit were not in place during the time of the contract acquisitions noted above, and therefore a lack of internally established procurement documentation practices resulted in material noncompliance with federal procurement standards. Recommendation - We recommend that management continue to follow and formalize its procurement policies and procedures to demonstrate how the LLC will achieve compliance with federal procurement standards identified in §§200.317 through 200.327. Additionally, we recommend management retain documented evidence that its policies and procedures were followed to ensure compliance with federal procurement standards. Views of Responsible Officials and Corrective Action Plan - Management will continue to strengthen internal controls through the revised Procurement Policy, enhanced documentation requirements, and clarified approval procedures. A centralized tracking database has been implemented to document sanctions, suspension, and debarment checks, as well as other required verifications based on the nature of each purchase or service. These procedures are required prior to entering into covered transactions and are monitored through dual staff reviews. Management believes that ongoing monitoring and consistent enforcement of these procedures will ensure compliance and prevent recurrence.

Assistance Listing, Federal Agency, and Program Name - 93.837, U.S. Department of Health and Human Services, Cardiovascular Disease Research (Research and Development Cluster) Federal Award Identification Number and Year - 93.837 - U01HL146245 (2024) Pass through Entity - N/A Finding Type - Material weakness and material noncompliance with laws and regulations Repeat Finding - No Criteria - Per 2 CFR 200.303(a), nonfederal entities must establish and maintain effective internal controls over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.305(b)(3), when the reimbursement method is used, the Federal agency or pass through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass through entity reasonably believes the request to be improper. Condition - Controls in place were not sufficient to ensure subrecipients were paid consistently within 30 days of a request for reimbursement. Questioned Costs - N/A If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - N/A Identification of How Questioned Costs Were Computed - N/A Context - Out of a sample of 29 subrecipient disbursements tested, we noted 6 were not paid within 30 days of the LLC receiving the request for reimbursement. Cause and Effect - A lack of effective internal controls resulted in material noncompliance with this requirement. Recommendation - We recommend management establish robust controls over subrecipient activity to ensure the 30 day requirement is met. Views of Responsible Officials and Planned Corrective Actions - Management acknowledges the finding. Delays in approvals may occur due to multiple internal and external parties involved. To prevent recurrence, management will monitor all parties, issue email reminders with clear deadlines, and enforce timely processing to ensure compliance with the 30 day requirement.

Finding No. 2025-001 Special Tests and Provisions – NSLDS Reporting U.S. Department of Education: Student Financial Assistance Cluster: Federal Pell Grant (ALN 84.063) Federal Grant Number: P063P241851 Statistically Valid Sample: No and it was intended to be. Prior Year Finding: Not a repeat finding. Finding Type: Significant Deficiency and Noncompliance Criteria: Institutions are required to report enrollment information under the Pell Grant and the Direct Loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number, Enrollment Effective Date, Enrollment Status, Certification Date Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number, CIP Code, CIP Year, Credential Level, Published Program Length Measurement, Published Program Length, Program Begin Date, Program Enrollment Effective Date Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. Institutions must complete and return within 15 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway (SAIG) (OMB No. 1845-0002) mailboxes sent by ED via NSLDS. An institution determines how often it receives the Enrollment Reporting roster file with the default set at a minimum of every 60 days. Once received, the institution must update for changes in the data elements for the Campus Record and the Program Record identified above, and submit the changes electronically through the batch method, spreadsheet submittal, or the NSLDS website (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309: Perkins 34 CFR 674.19(f)). Additionally, in accordance with 2 CFR 200.303, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context: The University utilizes the National Student Clearinghouse (the Clearinghouse) as a service provider for transmission of its enrollment reporting changes including, but not limited to withdrawals and graduate status to the NSLDS. The University receives the Enrollment Reporting Roster and makes necessary updates for changes in student status. A final file is then sent to the Clearinghouse who transmits information or corrections to NSLDS. For 1 student in our sample of 40, the effective status of graduation was not accurately reported to NSLDS within 60 days of the status change. The status change was submitted and certified by NSLDS 228 days late. This student received an error code of 253 or 290, which represents an error in the student’s social security number (SSN). Upon further review, the University identified 10 other students that had this same error code during fiscal year 2025. One of these students had a status change which was not reported to NSLDS timely, and it was submitted and certified by NSLDS 494 days late. Cause: This error was caused by an incorrect assumption in the Registrar’s procedures that students who returned this error from the Clearinghouse were non-Title IV aid students. While the Registrar worked to rectify these errors with the Clearinghouse, the Registrar’s Office did not update the student’s status in NSLDS independently because management believed these students did not receive Title IV aid. Effect: Student status changes not reported in a timely or accurate manner may cause the student to not enter repayment status for Federal Direct Student Loans on a timely basis. A change in status for a student receiving a Pell Grant will impact the amount they are eligible to receive Question Costs: None. Recommendation: We recommend that management incorporate procedures in their process to review the error reports received from the Clearinghouse specifically for this error code, which should include the determination of whether these students had received Title IV aid. View of Responsible Officials: Management agrees with the finding. Students on the reject detail from the Clearinghouse enrollment submission who receive a 253 or 290 error will be reviewed using a Financial Aid provided report to determine if any have been awarded aid. Financial Aid will provide the FAFSA support to correct the Clearinghouse error for students who have received aid. We will also manually report those student statuses to the NSLDS while the errors are being corrected by the Clearinghouse for anyone receiving aid so status changes are reported timely. For students that do not have FAFSA information with Financial Aid, we will contact those students directly for documentation to correct or affirm their SSN information to try and resolve any future 253 or 290 errors.

Reference Number: 2025-004 No secondary review of meal claim reimbursements prior to submission Child Nutrition Cluster ALN’s: 10.553, 10.555, and 10.582 Pass through identifying number: NT4XL1YGLGC5 Award Year: 2024-2025 Federal Agency: U.S. Department of Agriculture Passed through State Department of Agriculture Criteria: 2 CFR §200.303 requires non-Federal entities to establish and maintain effective internal control over Federal awards that provides reasonable assurance that the entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Program regulations for the Child Nutrition Cluster require reimbursement claims to be accurate and supported by appropriate documentation prior to submission. Effective internal controls over reporting include supervisory review of reimbursement claims to ensure accuracy and completeness before submission. Condition Found: During testing of reimbursement claims submitted under the Child Nutrition Cluster, we noted the School District did not perform a documented secondary review of monthly meal reimbursement claims prior to submission to the pass-through agency. Claims were prepared and submitted by the same individual without evidence of supervisory review or approval. Cause: Management indicated the control requiring a second review was informal and not consistently performed due to staffing limitations and turnover within the food service department. Additionally, the control was not formally documented in written procedures. Effect: Without a secondary review, there is an increased risk that reimbursement claims may contain errors, including inaccurate meal counts or calculation errors, which could result in over- or underreimbursement and potential noncompliance with Federal reporting requirements. Questioned Cost: $0. The District’s claims tested were mathematically accurate and supported, however, the control was not properly documented. Recommendation: We recommend the District implement and document a formal secondary review control over all Child Nutrition reimbursement claims prior to submission. Views of Responsible Officials: Management agrees with the findings. See corrective action plan

C. Findings and Questioned Costs – Major Federal Award Program Audit 2025-001: Significant Deficiency in Internal Control over Activities Allowed or Unallowed and Allowable Costs/Cost Principles Federal Agency: U.S. Department of Education Assistance Listing Number: 84.287 Federal Program Name: Twenty-First Century Community Learning Centers Pass-through Entity: Office of Superintendent of Public Instruction Pass-through Award Number: S287C240048, S287C230048 Criteria: Under 2 CFR 200.303(a), the non-federal entity must establish and maintain effective internal control over compliance with the requirements of federal awards. Additionally, in accordance with 2 CFR 200.403, costs must “be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles” and “be adequately documented.” Condition: In our testing of compliance with the requirements for activities allowed or unallowed and allowable costs/cost principles, we identified one exception where estimated costs were charged to the major program for allowable programmatic activities; however, this estimate included costs that were not ultimately incurred by Washington Alliance for Better Schools (WABS). Cause: Internal controls over the review and reconciliation of actual costs incurred by WABS and amounts charged to the major program did not detect certain unallowable costs. Effect: Reimbursements in excess of actual costs incurred were requested through the major program. Questioned Costs: Known questioned costs arising from this finding total $30,102. Context: No similar estimated costs were charged to the major program, nor were any other unallowable costs identified in our testing of a statistically valid sample of forty payroll and general cash disbursement transactions. As such, we believe this finding represents an isolated incidence and not a systemic problem. Management is currently proceeding with corrective action at the pass-through agency’s direction and has adjusted the reported amounts in the financial statements and schedule of expenditures of federal awards accordingly. Repeat Finding: This is not a repeat finding. Recommendation: We recommend that management performs a periodic reconciliation of expenditures charged to federal awards to actual costs incurred. Views of Responsible Officials: There is no disagreement with the finding.

Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Numbers: 84.063 and 84.268 Federal Award Identification Number and Year: P268K241902, P268K251902, P063P231902, P063P241902, grants were awarded within the 2023-24 and 2024-25 award years. Award Period: September 1, 2024, through August 31, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b) states that: 1) Schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. 2.) Schools must have some arrangements to report student program enrollment effective date and status to NSLDS. The Code of Federal Regulations, 2 CFR 200.303, non-Federal entities receiving Federal awards are required to establish and maintain internal controls designed to ensure compliance with federal laws, regulations and program compliance requirements. Condition and Context: During our testing of NSLDS Enrollment Reporting, we noted that 1.) the incorrect enrollment effective date was reported to NSLDS for one out of the 40 students tested 2.) the incorrect program enrollment effective date was reported to NSLDS for two out of the 40 students tested 3.) the incorrect enrollment status was reported to NSLDS for one out of 40 students tested. Questioned Costs: N/A Cause: The College policies and procedures did not ensure that the enrollment effective dates were accurately reported to NSLDS. Effect: 1) The enrollment effective date reported to NSLDS is used to determine when the student’s grace period should begin. By not reporting a correct effective date, the grace period begin date for the student will be incorrect. 2) The program enrollment effective date reported to NSLDS is used to determine the student’s 150% limit for direct loans as well as when grace period should begin. By not reporting the correct status, the calculation of the 150% would be incorrect and the grace period begin date would be incorrect. Repeat Finding: Yes – 2024-002. Recommendation: The College should evaluate their procedures and review policies surrounding reporting enrollment effective dates and program enrollment effective dates NSLDS. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

SECTION III – FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS Repeat Finding: No Program Name and Assistance Listing Number: Federal Pell Grant Program – 84.063 Federal Agency: U.S. Department of Education Pass-through Entities: N/A Questioned Costs: N/A FINDING: 2025:001: Noncompliance with NSLDS Enrollment Reporting Requirements Criteria The OMB Compliance Supplement for the Student Financial Assistance Cluster requires that institutions… “accurately notify ED of changes in student enrollment information at the Campus Level and Program Level.” Additionally, Federal Regulation 2 CFR §200.303(a) requires that the Organization… “must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition The Organization did not register for or establish participation in the National Student Loan Data System (NSLDS) during the fiscal year and, as a result, did not implement procedures or controls to report changes in student enrollment information at the Campus Level and Program Level as required. Cause The Organization did not establish policies and procedures to ensure compliance with NSLDS enrollment reporting requirements, as this was the first year of the program and management was not aware that such reporting was required in the absence of Direct Loan activity. Effect The Organization was not in compliance with NSLDS enrollment reporting requirements, which may limit the Department of Education’s ability to monitor student enrollment status and oversee Title IV program activity. Recommendation To address the issue of noncompliance with NSLDS enrollment reporting requirements, the Organization should register with the National Student Loan Data System (NSLDS) and implement policies and procedures to ensure compliance with enrollment reporting requirements, including assigning responsibility for monitoring compliance and maintaining documentation of such reporting. This was fixed after year end. Views of Responsible Officials Management agreed with the assessment and subsequent to year end, steps were taken to correct the matter.

Condition: During testing of 91 Low-Income Home Energy Assistance Program (LIHEAP) participant files, we identified 11 files for which internal controls over compliance with major program requirements were not operating effectively, as follows: Nine (9) files did not include evidence of management review (i.e., a management signature or initials on the application). One (1) file was missing the utility bill from the hard-copy file maintained at the Agency; however, the Agency had submitted the eligibility documentation in FACSPro. One (1) file was missing income verification for the head of household and a social security card for one household member from the hard-copy file maintained at the Agency; however, the Agency had submitted the eligibility documentation in FACSPro. Criteria: In accordance with 2 CFR 200.303 and LIHEAP program requirements, recipients must establish and maintain effective internal controls to provide reasonable assurance that assistance is awarded only to eligible households. Eligibility determinations must be supported by complete and adequate documentation. The Agency’s policies require that each LIHEAP applicant folder include a hard copy of the documents used to determine eligibility that is maintained at the Agency. In addition, all applications must receive a secondary review by management. This review must be documented by the reviewer’s initials or signature on the application. Cause: The exceptions noted resulted from management not consistently adhering to the Agency’s established policies regarding documentation retention and documented management review of LIHEAP applications. Effect: Failure to consistently document and review LIHEAP applications increases the risk that assistance may be awarded to ineligible households. This could result in questioned costs and noncompliance with applicable federal requirements. Recommendation: We recommend that management consistently follow Agency policy by ensuring that (1) all LIHEAP applicant files maintained at the Agency are complete and include the documentation used to support eligibility and (2) all applications receive a management review that is clearly documented through reviewer initials or signatures. View of Responsible Officials: See auditee prepared Corrective Action Plan

2025-002 The District did not have adequate internal controls for ensuring compliance with federal eligibility requirements. Assistance Listing Number and Title: 10.553 – School Breakfast Program 10.555 – National School Lunch Program Federal Grantor Name: U.S. Department of Agriculture (USDA) Federal Award/Contract Number: N/A Pass-through Entity Name: Office of the Superintendent of Public Instruction (OSPI) Pass-through Award/Contract Number: 227WAWA3N1199 Known Questioned Cost Amount: $0 Prior Year Audit Finding: N/A Background The District participates in the Child Nutrition Cluster, which includes the School Breakfast Program and National School Lunch Program. These programs provide free and reduced-price meals to students from low-income families. In the 2024-25 school year, the District received $2,078,919 in federal funding to administer these programs. Federal regulations require recipients to establish, document and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls including eligibility requirements. Districts providing free and reduced priced meals to students must verify students’ eligibility for these programs by either obtaining applications at the beginning of each school year or through the direct certification process, which is used for categorically eligible children for free meals without further application. Description of Condition The District did not have adequate internal controls to ensure it only provided free and reduced-price meals to eligible students. We consider this deficiency in internal controls to be a significant deficiency. Cause of Condition The District experienced staffing changes during the audit period and the staff responsible for managing eligibility for the program lacked adequate training over the requirements and were not aware of the requirement to retain all applications to support the free- and reduced-meal status. Effect of Condition Using a statistical sample, we found two out of 29 students tested (6.9%) were not supported by documentation evidencing their eligibility. Without documentation showing the students were eligible for free and reduced-price meals, the District cannot demonstrate compliance with the awarding agency’s eligibility requirements. These errors resulted in the District receiving $1,350 in excess federal funds. Based on the projection of our sample, we identified an additional $108,745 in estimated overpayments for free and reduced meal costs. Recommendation We recommend the District establish and follow internal controls to ensure it complies with federal and OSPI requirements for verifying eligibility for free or reduced-price meals and maintain documentation of this verification process. District’s Response Mandatory Staff Training & Professional Development: • Food Services staff responsible for processing and managing student meal applications using Qmlativ will undergo training provided by ESD113 in August and online OSPI CNEEB Application and Direct Certification Training. • Training will explicitly cover federal regulations under 7 CFR Part 245.6 (Application, Eligibility, and Certification) and 2 CFR Part 200.303 (Internal Controls over federal programs). Implementation of Dual-Review Internal Controls: • The District will establish written protocols for processing online and paper applications. • In collaboration with ESD 113, a report will be developed which will be run monthly reviewing any application that have not been validated for income eligibility or direct certification provided by the state. Auditor’s Remarks We thank the District for its cooperation throughout the audit and the steps it is taking to address these concerns. We will review the status of the District’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 7 CFR Part 245, Section 245.6 – Application, eligibility and certification of children for free and reduced price meals and free milk.