Findings Citing § 200.303

Information on the federal program: Subject: Special Education Cluster – Internal Controls Federal Agency: Department of Education Federal Program: Special Education Cluster Assistance Listing Number: 84.027, 84.027X, 84.173 Federal Award Numbers and Years (or Other Identifying Numbers): 22611-122-PN01, 23611-122-PN01, 24611-122-PN01, 22611-122-ARP, 22619-122-PN01 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Cash Management Audit Finding: Significant Deficiency Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." For grants and cooperative agreements to non-federal entities that are paid on a reimbursement basis, supporting documentation shows that the costs for which reimbursement was requested were paid prior to the date of the reimbursement request. Pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the federal award to the recipient (2 CFR section 200.305(b)(1)). Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Cash Management compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with cash management for reimbursement grants. The School Corporation did not have a design control in place to ensure that service provider invoices were paid prior to the submitting reimbursements to the Indiana Department of Education (IDOE). Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. Questioned Costs: There were no questioned costs identified. Context: The School Corporation pays one hundred percent of its Special Education Cluster funding to one service provider, which totaled $3,782,381 for the audit period. For all invoices during the audit period, the School Corporation submitted and received reimbursement from the IDOE prior to paying the service provider, and then the School Corporation remitted payment to the service provider. There was significant delay in the time between the School Corporation was reimbursed by IDOE and when the School Corporation paid the service provider. The delay in payment was in the range of 2 – 4 months for the payments made during the audit period. Identification as a repeat finding: This is a repeat finding from the immediately prior audit. The prior finding number was 2022-003. Recommendation: We recommend the School Corporation implement procedures to ensure the invoices are paid before submitting draw requests and receiving funds from IDOE. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Information on the federal program: Subject: Special Education Cluster – Internal Controls Federal Agency: Department of Education Federal Program: Special Education Cluster Assistance Listing Number: 84.027, 84.027X, 84.173 Federal Award Numbers and Years (or Other Identifying Numbers): 22611-122-PN01, 23611-122-PN01, 24611-122-PN01, 22611-122-ARP, 22619-122-PN01 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Cash Management Audit Finding: Significant Deficiency Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." For grants and cooperative agreements to non-federal entities that are paid on a reimbursement basis, supporting documentation shows that the costs for which reimbursement was requested were paid prior to the date of the reimbursement request. Pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the federal award to the recipient (2 CFR section 200.305(b)(1)). Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Cash Management compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with cash management for reimbursement grants. The School Corporation did not have a design control in place to ensure that service provider invoices were paid prior to the submitting reimbursements to the Indiana Department of Education (IDOE). Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. Questioned Costs: There were no questioned costs identified. Context: The School Corporation pays one hundred percent of its Special Education Cluster funding to one service provider, which totaled $3,782,381 for the audit period. For all invoices during the audit period, the School Corporation submitted and received reimbursement from the IDOE prior to paying the service provider, and then the School Corporation remitted payment to the service provider. There was significant delay in the time between the School Corporation was reimbursed by IDOE and when the School Corporation paid the service provider. The delay in payment was in the range of 2 – 4 months for the payments made during the audit period. Identification as a repeat finding: This is a repeat finding from the immediately prior audit. The prior finding number was 2022-003. Recommendation: We recommend the School Corporation implement procedures to ensure the invoices are paid before submitting draw requests and receiving funds from IDOE. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Information on the federal program: Subject: Special Education Cluster – Internal Controls Federal Agency: Department of Education Federal Program: Special Education Cluster Assistance Listing Number: 84.027, 84.027X, 84.173 Federal Award Numbers and Years (or Other Identifying Numbers): 22611-122-PN01, 23611-122-PN01, 24611-122-PN01, 22611-122-ARP, 22619-122-PN01 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Cash Management Audit Finding: Significant Deficiency Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." For grants and cooperative agreements to non-federal entities that are paid on a reimbursement basis, supporting documentation shows that the costs for which reimbursement was requested were paid prior to the date of the reimbursement request. Pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the federal award to the recipient (2 CFR section 200.305(b)(1)). Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Cash Management compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with cash management for reimbursement grants. The School Corporation did not have a design control in place to ensure that service provider invoices were paid prior to the submitting reimbursements to the Indiana Department of Education (IDOE). Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. Questioned Costs: There were no questioned costs identified. Context: The School Corporation pays one hundred percent of its Special Education Cluster funding to one service provider, which totaled $3,782,381 for the audit period. For all invoices during the audit period, the School Corporation submitted and received reimbursement from the IDOE prior to paying the service provider, and then the School Corporation remitted payment to the service provider. There was significant delay in the time between the School Corporation was reimbursed by IDOE and when the School Corporation paid the service provider. The delay in payment was in the range of 2 – 4 months for the payments made during the audit period. Identification as a repeat finding: This is a repeat finding from the immediately prior audit. The prior finding number was 2022-003. Recommendation: We recommend the School Corporation implement procedures to ensure the invoices are paid before submitting draw requests and receiving funds from IDOE. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Information on the federal program: Subject: Special Education Cluster – Internal Controls Federal Agency: Department of Education Federal Program: Special Education Cluster Assistance Listing Number: 84.027X Federal Award Numbers and Years (or Other Identifying Numbers): 22611-122-ARP Pass-Through Entity: Indiana Department of Education Compliance Requirement: Period of Performance Audit Finding: Material Weakness Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.309 states: "A non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance (except as described in § 200.461 Publication and printing costs) and any costs incurred before the Federal awarding agency or pass-through entity made the Federal award that were authorized by the Federal awarding agency or pass-through entity. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the period of performance compliance requirement. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the period of performance requirement. The School Corporation did not have a design control in place to ensure that service provider invoices were paid before the required liquidation date. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. Questioned Costs: There were no questioned costs identified. Context: The School Corporation pays one hundred percent of its Special Education Cluster funding to one service provider. From review of the expense population, we noted 2 payments to the service provider where the service provider was not paid until after liquidation date of December 29, 2023. The School Corporation did not pay the service provider until April 30, 2024 for $258,488 for the services provided. Identification as a repeat finding: No. Recommendation: We recommend the School Corporation implement procedures to ensure the invoices are paid before the required liquidation date. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Information on the federal program: Subject: Special Education Cluster – Internal Controls Federal Agency: Department of Education Federal Program: Special Education Cluster Assistance Listing Number: 84.027 Federal Award Numbers and Years (or Other Identifying Numbers): 22611-122-PN01 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Level of Effort - Maintenance of Effort Audit Finding: Material Weakness Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Level of Effort - Maintenance of Effort compliance requirement. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirement listed above. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: There were no questioned costs identified. Context: The School Corporation was required to submit one workbook covering FY21 and FY22 to the Indiana Department of Education (IDOE) during the audit period to meet federal the Level of Effort - Maintenance of Effort requirements. We noted the amounts reported covering the FY21 time period ($865,515) did not agree to the underlying expenditure records ($1,474,349 for the period of July 1, 2020 through June 30, 2021). Additionally, we noted the amounts reported covering the FY22 time period ($937,948) did not agree to the underlying expenditure records ($2,695,619, for the period of July 1, 2021 through June 30, 2022). Identification as a repeat finding: No. Recommendation: We recommend someone other than the preparer of the report perform a documented review prior to submission to validate the accuracy and completeness of the data submitted. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Information on the federal program: Subject: Education Stabilization Fund (ESSER) – Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 – Education Stabilization Fund Assistance Listing Number: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 Financial reporting . . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program." Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: There were no questioned costs identified. Context: The School Corporation was required to submit two Annual Data Reports to the Indiana Department of Education (IDOE) during the audit period to meet federal reporting requirements for ESSER grant awards. We noted that the ESSER II and ESSER III amounts reported for the reports covering the FY22 time period ($0 and $0, respectively) did not agree to the underlying expenditure records ($79,112 and $99,245 respectively, for the period of July 1, 2021 through June 30, 2022). Additionally, we noted that the ESSER II, and ESSER III amounts reported for the reports covering the FY23 time period ($178,829 and $874,154, respectively) did not agree to the underlying expenditure records ($159,450 and $789,489), respectively, for the period of July 1, 2022 through June 30, 2023). We also noted there was no documented, secondary review of the information in the annual data reports by someone other than the preparer. Identification as a repeat finding: No. Recommendation: We recommend someone other than the preparer of the report perform a documented review prior to submission to validate the accuracy and completeness of the data submitted. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Information on the federal program: Subject: Education Stabilization Fund (ESSER) – Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 – Education Stabilization Fund Assistance Listing Number: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 Financial reporting . . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program." Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: There were no questioned costs identified. Context: The School Corporation was required to submit two Annual Data Reports to the Indiana Department of Education (IDOE) during the audit period to meet federal reporting requirements for ESSER grant awards. We noted that the ESSER II and ESSER III amounts reported for the reports covering the FY22 time period ($0 and $0, respectively) did not agree to the underlying expenditure records ($79,112 and $99,245 respectively, for the period of July 1, 2021 through June 30, 2022). Additionally, we noted that the ESSER II, and ESSER III amounts reported for the reports covering the FY23 time period ($178,829 and $874,154, respectively) did not agree to the underlying expenditure records ($159,450 and $789,489), respectively, for the period of July 1, 2022 through June 30, 2023). We also noted there was no documented, secondary review of the information in the annual data reports by someone other than the preparer. Identification as a repeat finding: No. Recommendation: We recommend someone other than the preparer of the report perform a documented review prior to submission to validate the accuracy and completeness of the data submitted. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Information on the federal program: Subject: Education Stabilization Fund – Special Tests and Provisions - Wage Rate Requirements Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listing Number: 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Special Tests and Provisions - Wage Rate Requirements Audit Findings: Material Weakness, Material Noncompliance, Qualified Opinion Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 29 CFR 5.5 states in part: (1) Minimum wages. (i) All laborers and mechanics employed or working upon the site of the work (or under the United States Housing Act of 1937 or under the Housing Act of 1949 in the construction or development of the project), will be paid unconditionally and not less often than once a week, and without subsequent deduction or rebate on any account (except such payroll deductions as are permitted by regulations issued by the Secretary of Labor under the Copeland Act (29 CFR part 3)), the full amount of wages and bona fide fringe benefits (or cash equivalents thereof) due at time of payment computed at rates not less than those contained in the wage determination of the Secretary of Labor which is attached hereto and made a part hereof, regardless of any contractual relationship which may be alleged to exist between the contractor and such laborers and mechanics… (3)(ii)(A) The contractor shall submit weekly for each week in which any contract work is performed a copy of all payrolls to the (write in name of appropriate federal agency) if the agency is a party to the contract, but if the agency is not such a party, the contractor will submit the payrolls to the applicant, sponsor, or owner, as the case may be, for transmission to the (write in name of agency). 2 CFR 200 Appendix II states in part: In addition to other provisions required by the Federal agency or non-Federal entity; all contracts made by the non-Federal entity under the Federal award must contain provisions covering the following, as applicable. . . . (D) Davis-Bacon Act, as amended (40 U.S.C. 3141-3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non-Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141-3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, “Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction”). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week.. . .” Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Special Tests and Provisions – Wage Rate Requirements compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to design and implement an effective internal control system enabled material noncompliance to go undetected. Noncompliance with the grant agreement and the Special Tests and Provisions – Wage Rate Requirements compliance requirement could result in the loss of future federal funds to the School Corporation. Questioned Costs: There were no questioned costs identified. Context: For the one project sampled for Davis-Bacon requirements, the School Corporation did not obtain the weekly payroll reports certifications from the company that performed renovations on the School Corporation. Therefore, no review was performed to ensure that pay rates complied with the federal wage rate requirements. Additionally, the School Corporation did not have a contract with the company that included the clause for the federal wage rate requirements. The total amount disbursed and reported on the SEFA during the audit period is $467,094 and the labor portion was not determinable by the School Corporation. Identification as a repeat finding: No. Recommendation: We recommend the School Corporation implement a formal process to ensure the required weekly payroll reports certifications are collected and reviewed to ensure compliance with the wage rate requirements. Additionally, We recommend the School Corporation implement a formal process to ensure the contracts including labor costs over $2,000 funded by federal awards have Davis Bacon wage rate requirement clause in written contract. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency

2024-003 Controls over Payroll (Material Weakness in Internal Controls over Compliance and Material Noncompliance) Title: Research and Development Cluster Funding Agency, Federal Award, Agreement Number, Award Year, Assistance Listing Number: National Science Foundation, 2122108, 2024,47.049 National Science Foundation, 1953487, 2024,47.076 United States Department of Education, P031C160248, 2024, 84.031C United States Department of Health and Human Services, 1R16GM146669-01 & Q02067J, 2024, 93.859 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013, 23-DG-11030000-014 Award Year:2024 Assistance Listing Number:10.694 Title: Foster Care-Title IV-E Funding Agency: United States Department of Health and Human Services Federal Award Agreement Number:N/A Award Year:2024 Assistance Listing Number:93.658 Pass-Through Agency:CYFD Pass-Through Identification Number:23-690-500-25581 Condition: In testing 25 payroll items from each program listed above, CRI noted exceptions as described in the following table. No exceptions were noted in the items tested for the Foster Care program. (See table in report pg 120) Questioned Costs: Known and likely questioned costs of $4,547 and $506,209 are associated with the R&D Cluster related to discrepancies in time and effort documentation. No questioned costs were noted in the Southwest Forest Health and Wildfire Prevention Program or the Foster Care program. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403 – Factors affecting allowability of costs – Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: paragraph (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles; paragraph (g) Be adequately documented. Per 2 CFR section 200.430 – Compensation – personal services, paragraph (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. Cause: The University does not have sufficient controls in place to ensure the accuracy of the amounts paid to employees nor include appropriate approvals documented to be allowable to be charged to the federal grant. The University has deficiencies recording and processing payroll as described in finding 2024-001. Effect: The University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency.

2024-005 (2022-005) Procurement, Small Purchase (Significant Deficiency in Internal Controls over Compliance with Questioned Costs Greater than $25,000) - Repeated Title: Research and Development Cluster Funding Agency: National Science Foundation Federal Award Agreement Number: 1914463, 1953487 Award Year: 2024 Assistance Listing Number: 47.076 Title: Southwest Forest Health and Wildfire Prevention Funding Agency: United States Department of Agriculture Federal Award Agreement Number:21-DG-11030000-020, 22-DG-11030000-013 Award Year:2024 Assistance Listing Number:10.694 Condition: During our review of procurement testing in the Research and Development Cluster, the University did not follow small purchase procedures and did not have an annual self-certification election to follow micropurchase procurement for professional services. In our procurement testing in the Southwest Forest Health and Wildfire Prevention grant, no support was provided to test the procurement methods used for small purchases. Progress on resolution of prior year finding: No progress was made. Questioned Costs: Known and likely questioned costs of $78,063 and $30,975 in the R&D Cluster and the Southwest Forest Health and Wildfire Prevention program, respectively. Criteria: Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.320(a) sets the micro-purchase threshold at $10,000 and requires purchases over the micro-purchase threshold to use small purchase procedures, whereby price or rate quotations must be obtained and 2 CFR 200.320(a)(1)(iv) states the recipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the auditors which includes a justification, clear identification of the threshold, and supporting documentation. Per Title 2 US Code of Federal Regulations Part 200.403(g), costs must be adequately documented to be allowable under Federal awards. Cause: The University was using a $50,000 threshold for professional services to utilize micropurchase method of procurement in the Research and Development Cluster. In the Southwest Forest Health and Wildfire Prevention grant, the University was not retaining the supporting documentation to ensure purchase is allowable. Effect: The University may unintentionally use a higher-cost vendor when failing to obtain price or rate quotations for items over the micro-purchase threshold. In addition, the University may unintentionally charge expenses to the program that do not qualify and in turn lead to questioned costs and/or repayment of funds to the Grantor agency