Findings Citing § 200.303

FINDING 2024-004 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Reporting Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY24 Compliance Requirement: Reporting Audit Findings: Material Weakness, Other Matters Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-005. Condition and Context Recipients are required to submit quarterly or annually Project and Expenditure (P&E) reports to the U.S. Department of the Treasury (Treasury). The reporting periods, as well as the respective due dates, are based upon type of recipient and its population, as well as the recipient's allocation amount. Information to be reported includes projects funded, expenditures, and contracts for the appropriate reporting period. The County was classified as a metropolitan county with a population below 250,000 residents that received an allocation of less than $10 million in COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF). As such, the initial P&E report, covering the period from March 3, 2021 to March 31, 2022, was required to be submitted to the Treasury by April 30, 2022. The subsequent annual reports are to cover one calendar year and must be submitted to the Treasury by April 30 each year. The County submitted the P&E report by April 30, 2024, as required; however, a single employee prepared and submitted the P&E report without a review or oversight process in place to prevent, or detect and correct, errors. As a result, the following errors were noted:  The current period expenditures for ten projects tested were understated by $533,935. In addition, current period expenditures for one project tested was overstated by $4,529.  The cumulative expenditures for six projects tested were understated by $151,208. In addition, cumulative expenditures for three projects tested were overstated by $108,106. INDIANA STATE BOARD OF ACCOUNTS 20 DECATUR COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued)  The current period obligations for four projects tested were understated by $205,178. In addition, current period obligations for four projects tested were overstated by $1,634,629.  The cumulative obligations for one project tested was understated by $100,000. In addition, cumulative obligations for six projects tested were overstated by $2,007,842. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Coronavirus State and Local Fiscal Recovery Funds Compliance and Reporting Guidance, page 10, states in part: ". . . 10. Reporting. All recipients of federal funds must complete financial, performance, and compliance reporting as required and outlined in Part 2 of this guidance. Expenditures may be reported on a cash or accrual basis, as long as the methodology is disclosed and consistently applied. Reporting must be consistent with the definition of expenditures pursuant to 2 CFR 200.1. Your organization should appropriately maintain accounting records for compiling and reporting accurate, compliant financial data, in accordance with appropriate accounting standards and principles. . . ." 31 CFR 35.4(c) states in part: "Reporting and requests for other information. During the period of performance, recipients shall provide to the Secretary . . . periodic reports providing detailed accounting of the uses of funds . . ." Cause A proper system of internal controls, including policies and procedures, was not designed or implemented by management of the County to prevent and detect errors on the P&E report prior to submission. The County incorrectly reported projects that had been appropriated, but not yet obligated, and amounts reported did not always agree to the County's records. The reports submitted were not reviewed by a second person to identify these errors prior to submission. Effect Without the proper implementation of an effectively designed system of internal controls, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As such, the County did not accurately report current period obligations and cumulative obligations when filing the P&E report for the period April 1, 2023 to March 31, 2024. INDIANA STATE BOARD OF ACCOUNTS 21 DECATUR COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Noncompliance with the provisions of federal regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the County. In addition, not meeting the SLFRF reporting requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County design and implement a proper system of internal controls, including policies and procedures that would provide segregation of duties to ensure appropriate reviews, approvals, and oversight of federal reports are taking place. We also recommended the development of policies and procedures to ensure the County provides the Treasury with complete and accurate information for the P&E report. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-001 Subject: Highway Planning and Construction - Procurement Federal Agency: Department of Transportation Federal Program: Highway Planning and Construction Assistance Listings Number: 20.205 Federal Award Numbers and Years (or Other Identifying Numbers): DES. Nos. 1600968, 1702753, 1802927, 1802929, 1902066, 2301613 Pass-Through Entity: Indiana Department of Transportation Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Other Matters Condition and Context Recipients may use award funds to procure engineering and design-related services from consultants necessary to implement one or more eligible purposes outlined for the Highway Planning and Construction award funds. Subrecipients may adopt written policies and procedures prescribed by the awarding state DOT or prepare their own written policies and procedures approved by the Indiana Department of Transportation. The County did not have documented procurement procedures or policies used to procure engineering and design services. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 23 CFR 175 states in part: ". . . (b) Subrecipient responsibilities. Subrecipients shall develop and sustain organizational capacity and provide the resources necessary for the procurement, management, and administration of engineering and design related consultant services, reimbursed in whole or in part with FAHP funding as specified in 23 U.S.C. 106(g)(4)(A). Responsibilities shall include the following: (1) Adopting written policies and procedures prescribed by the awarding STA or other recipient for the procurement, management, and administration of engineering and design related consultant services in accordance with applicable Federal and State laws and regulations; or when not prescribed, shall include: (i) Preparing and maintaining its own written policies and procedures in accordance with paragraph (c) of this section; or (ii) Submitting documentation associated with each procurement and subsequent contract to the awarding STA or other grantee for review to assess compliance with applicable Federal and State laws, regulations, and the requirements of this part; (2) Procuring, managing, and administering engineering and design related consultant services in accordance with applicable Federal and State laws, regulations, and approved policies and procedures, as specified in 23 CFR 1.9(a). INDIANA STATE BOARD OF ACCOUNTS 14 RUSH COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (c) Written policies and procedures. The contracting agency shall prepare and maintain written policies and procedures for the procurement, management, and administration of engineering and design related consultant services. The FHWA shall approve the written policies and procedures, including all revisions to such policies and procedures, of the STA or recipient to assess compliance with applicable requirements. The STA or other recipient shall approve the written policies and procedures, including all revisions to such policies and procedures, of a subrecipient to assess compliance with applicable requirements. These policies and procedures shall address, as appropriate for each method of procurement a contracting agency proposes to use, the following items to ensure compliance with Federal and State laws, regulations, and the requirements of this part: (1) Preparing a scope of work and evaluation factors for the ranking/selection of a consultant; (2) Soliciting interests, qualifications, or proposals from prospective consultants; (3) Preventing, identifying, and mitigating conflicts of interest for employees of both the contracting agency and consultants and promptly disclosing in writing any potential conflict to the STA and FHWA, as specified in 2 CFR 200.112 and 23 CFR 1.33, and the requirements of this part. (4) Verifying suspension and debarment actions and eligibility of consultants, as specified in 2 CFR part 1200 and 2 CFR part 180; (5) Evaluating interests, qualifications, or proposals and the ranking/selection of a consultant; (6) Determining, based upon State procedures and the size and complexity of a project, the need for additional discussions following RFP submission and evaluation; (7) Preparing an independent agency estimate for use in negotiation with the selected consultant; (8) Selecting appropriate contract type, payment method, and terms and incorporating required contract provisions, assurances, and certifications in accordance with § 172.9; (9) Negotiating a contract with the selected consultant including instructions for proper disposal of concealed cost proposals of unsuccessful bidders; (10) Establishing elements of contract costs, accepting indirect cost rate(s) for application to contracts, and assuring consultant compliance with the Federal cost principles in accordance with § 172.11; (11) Ensuring consultant costs billed are allowable in accordance with the Federal cost principles and consistent with the contract terms as well as the acceptability and progress of the consultant's work; (12) Monitoring the consultant's work and compliance with the terms, conditions, and specifications of the contract; (13) Preparing a consultant's performance evaluation when services are completed and using such performance data in future evaluation and ranking of consultant to provide similar services; INDIANA STATE BOARD OF ACCOUNTS 15 RUSH COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (14) Closing-out a contract; (15) Retaining supporting programmatic and contract records, as specified in 2 CFR 200.333 and the requirements of this part; (16) Determining the extent to which the consultant, which is responsible for the professional quality, technical accuracy, and coordination of services, may be reasonably liable for costs resulting from errors and omissions in the work furnished under its contract; (17) Assessing administrative, contractual, or legal remedies in instances where consultants violate or breach contract terms and conditions, and providing for such sanctions and penalties as may be appropriate; and (18) Resolving disputes in the procurement, management, and administration of engineering and design related consultant services. (d) A contracting agency may formally adopt, by statute or within approved written policies and procedures as specified in paragraph (c) of this section, any direct Federal Government or other contracting regulation, standard, or procedure provided its application does not conflict with the provisions of 23 U.S.C. 112, the requirements of this part, and other laws and regulations applicable to the FAHP. (e) Notwithstanding paragraph (d) of this section, a contracting agency shall have a reasonable period of time, not to exceed 12 months from the effective date of this rule unless an extension is granted for unique or extenuating circumstances, to issue or update current written policies and procedures for review and approval in accordance with paragraph (c) of this section and consistent with the requirements of this part." 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause The County's management was not aware of the compliance requirement relating to the written procurement policy. Effect The failure to establish a written policy for Federal Procurement placed the County in noncompliance with the grant agreement and the Procurement and Suspension and Debarment compliance requirement. Noncompliance with the grant agreement and the compliance requirement could result in the repayment of federal funds. INDIANA STATE BOARD OF ACCOUNTS 16 RUSH COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that the County's management establish written policies and procedures for the procurement of engineering and design services. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that part of this report.

Federal Agency: U.S. Department of Education Federal Program Name: Rehab Services Demonstration & Training Program Assistance Listing Number: 84.235 Federal Award Identification Number and Year: H235F200005-2024 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: 1/1/2024-12/31/2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or Specific Requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure reimbursement requests are formally reviewed by someone who did not prepare the request to verify the correct information and data is submitted. Condition: Entity does not perform formal documented reviews and approvals over indirect cost calculations and reimbursement requests prior to submission to granting agency. Questioned Costs: None Context: During our testing, we identified instances where there was no documented review and approvals over indirect cost calculations and reimbursement requests prior to submission to granting agency. Cause: The entity does not have a formal review or approval process in place. Effect: The entity is not in compliance with Federal Government requirements. Repeat Finding: No Recommendation: We recommend the entity implement procedures and a control to document review and approvals over indirect costs and cash management. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Award Findings and Questioned Costs: Finding Number: 2024-001 Federal Assistance Listing Number: 97.036 Program: COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Agency Name: Federal Emergency Management Agency Federal Award Number: D20-528 Federal Award Year: 2024 Criteria Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, (Subpart E, Section 200.303), the nonfederal entity must establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Further, Subpart E Section 200.403 states that administrative closeout costs may be incurred until the due date of the final reports. If incurred, these costs must be liquidated prior to the due date of the final reports and charged to the final budget period of the award unless otherwise specified by the Federal agency. All other costs must be incurred during the approved budget period. Conditions Found In one of 25 selections for testwork over period of performance, expenditures related to contract labor were submitted for reimbursement to the Federal Emergency Management Agency (FEMA) that were outside of the project period. Further, the review performed over expenditures was not completed appropriately to identify this error, representing an instance of the District’s internal control not operating as designed. Cause The District does not have adequate controls in place to ensure that contract labor expenditures submitted for reimbursement by FEMA under the COVID 19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) program represent service dates within the project period. Effect Without effective controls in place, expenditures could be reimbursed by the program that were incurred outside of the project period, resulting in non compliance with program requirements. Questioned Costs $1,316, representing the known amount of expenditures incurred outside of the project period for the COVID 19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) program. Statistical Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding This finding is not a repeat finding in the immediate prior audit. Recommendation We recommend that management strengthen processes and controls in place to ensure contract labor expenditures submitted to FEMA for reimbursement under the COVID 19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) program are appropriately reviewed prior to submission to ensure they represent service dates within the project period. Views of Responsible Officials The District agrees with the finding and accepts the recommendation.

Criteria or Specific Requirement According to §200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context During our testing, we noted the department was unable to provide documentation to support management approval prior to the drawdown of federal funds for 3 selections. Effect The Organization may drawdown the incorrect amount of federal funds. Questioned Costs None identified. Cause Management oversight. Approvals were done verbally and no documentation was recorded. Recommendation We recommend the Organization to review internal controls in regards to the approval of federal fund drawdown requests.Views of Responsible Officials We have reviewed all our internal controls to ensure all approvals are documented. The procedure has been updated to include preparing the draw documentation, entering the accounts receivable invoice into the accounting system, which now requires an approval for all accounts receivable invoices. Once the accounts receivable invoices are approved in the accounting system then a draw down can be requested in the payment management system. This new process to ensure the documented approval of federal fund drawdown's was implemented mid-year 2024, after the three selections in this finding were completed.

Criteria or Specific Requirement According to §200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context During our testing, we noted the department was unable to provide documentation to support management approval prior to the drawdown of federal funds for 3 selections. Effect The Organization may drawdown the incorrect amount of federal funds. Questioned Costs None identified. Cause Management oversight. Approvals were done verbally and no documentation was recorded. Recommendation We recommend the Organization to review internal controls in regards to the approval of federal fund drawdown requests.Views of Responsible Officials We have reviewed all our internal controls to ensure all approvals are documented. The procedure has been updated to include preparing the draw documentation, entering the accounts receivable invoice into the accounting system, which now requires an approval for all accounts receivable invoices. Once the accounts receivable invoices are approved in the accounting system then a draw down can be requested in the payment management system. This new process to ensure the documented approval of federal fund drawdown's was implemented mid-year 2024, after the three selections in this finding were completed.

Criteria or Specific Requirement According to §200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context During our testing, we noted the department was unable to provide documentation to support management approval prior to the drawdown of federal funds for 3 selections. Effect The Organization may drawdown the incorrect amount of federal funds. Questioned Costs None identified. Cause Management oversight. Approvals were done verbally and no documentation was recorded. Recommendation We recommend the Organization to review internal controls in regards to the approval of federal fund drawdown requests.Views of Responsible Officials We have reviewed all our internal controls to ensure all approvals are documented. The procedure has been updated to include preparing the draw documentation, entering the accounts receivable invoice into the accounting system, which now requires an approval for all accounts receivable invoices. Once the accounts receivable invoices are approved in the accounting system then a draw down can be requested in the payment management system. This new process to ensure the documented approval of federal fund drawdown's was implemented mid-year 2024, after the three selections in this finding were completed.

Federal Agency: U.S. Department of Treasury Federal Program Name: COVID-19 Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Passed Through: N/A Finding Type: Material weakness Condition: During our testing of this major program, we noted that the County incorrectly completed the SLFRF Compliance Report – SLT-2073 – P&E Report – 2025 by reporting erroneous amounts for all categories of obligations and expenditures during the period. Criteria: The Uniform Guidance (2 CFR section 200.303) requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Effective internal controls should include procedures in place to ensure accurate reporting of the activity. Cause: The County has not designed and implemented internal controls over its federal award programs to ensure compliance with the terms and conditions of its federal award programs. Effect: The County could provide incorrect information to the federal government regarding the actual federal awards expended and obligated. Context: Reporting was direct and material to the program. Each category of the report had incorrect information reported. Questioned Costs: None Recommendation: We recommend that management design and implement internal controls that would ensure the accurate preparation of all required reporting. Repeat Finding: No Views of Responsible Officials and Planned Corrective Action: The County agrees with the finding and the recommendation will be implemented.

Department of Homeland Security, Iowa Department of Homeland Security and Emergency Management, Federal Financial Assistance Listing 97.039, DR-4457-IA-0040 Hazard Mitigation Grant Program Procurement, Suspension & Debarment Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal awards that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 200.318 maintains that recipients must have and use documented procurement policies and must conform procurement standards in sections 200.317 through 200.327. Condition: The cooperative’s procurement policy had not identified the dollar thresholds of procurement within the methods of procurement. In addition, one contract selected for testing was missing one of the required contract provisions. Cause: The cooperative’s procurement policy is very thorough and identifies the methods of procurement, however, management had not identified the thresholds of procurement included within the policy. Effect: The Cooperative’s policy was missing required information Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of 7 transactions out of 29 transactions were selected for testing, which accounted for $1,134,758 of $3,548,469 federal program expenditures. Repeat Finding form Prior Year: No Recommendation: We recommend the Cooperative review their procurement policy to ensure it includes the dollar thresholds for each of the procurement methods. In addition, we suggest the Cooperative review their contracts to ensure it includes all the required contract provisions. Views of Responsible Officials: Management agrees with the finding.

U.S. Department of Veterans Affairs 2024-001 – Supportive Services for Veteran Families (SSVF) – Assistance Listing No. 64.033, Grant Period – September 2023 through September 30, 2025. Condition: Clear Path for Veterans New England, Inc. (the Organization) did not follow its internal controls regarding eligibility for the SSVF grant and as a result, the Organization did not recertify one program participant within the three month period to ensure continued program eligibility. Criteria: Department of Veteran Affairs SSVF Program Guide (the Program Guide), Section 2.5 Recertification of Eligibility, requires the recertification of a participant’s eligibility every three months, at a minimum. In addition, 2 CFR 200.303 indicates that non-Federal entities receiving Federal awards must establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. Cause: The Organization did not properly follow the Program Guide and its internal controls. Effect: The Organization did not recertify one program participant within the timeframe in accordance with its internal controls. Context: One out of thirteen applicants sampled. Our sample was not a statistically valid sample. This was not a repeat finding from a prior period. Questioned Costs: None Recommendations: Management should ensure that the Organization follow the Program Guide and ensure that the Organization’s internal controls in place are properly followed. Management Response: Management agrees with the finding and will provide additional training during fiscal year 2025 to its program staff to ensure that the Organization’s internal controls are properly followed.

Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Federal Agency: U.S. Department of the Treasury Federal Program: COVID-19 Coronavirus State and Local Fiscal Recovery Funds (CSLFRF), ALN No. 21.027 Compliance Requirement: Reporting Repeat Finding: No Condition: During our testing of two quarterly reports, we noted that management was not able to provide supporting documentation that review procedures were performed before the submission of the performance reports. Questioned Costs: None Context: For both of the reports tested, management was not able to provide the required support showing that the reports were reviewed before submission. Criteria: 2 CFR part 200 section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Cause: There was significant turnover within the finance department of the City and grants administration was missing supervision by key personnel. Effect: The finding indicates that there could be some process improvements in how grant reports are reviewed, documented and maintained to provide evidence the compliance requirements are being met. Recommendation: We understand the grants administration has been assigned to a specific department. We recommend the agency implement procedures to ensure reports are properly reviewed as well as increase training efforts on reporting requirements if there is future staffing turnover.

FINDING 2024-003 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Suspension and Debarment Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY 2024 Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-002. Condition and Context Suspension and Debarment Prior to entering subawards and covered transactions with the COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF) award funds, recipients are required to verify that such contractors and subrecipients are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the Excluded Parties List System (EPLS), collecting a certification from that person, or adding a clause or condition to the covered transaction with that person. The County did not have procedures in place for verifying that an entity with which it plans to enter into a covered transaction is not suspended, debarred, or otherwise excluded. A population of 15 covered transactions, totaling $3,770,905, that equaled or exceeded $25,000 paid from SLFRF funds were identified. Of those 15, 4 covered transactions, totaling $380,854, were selected for testing. For each of the 4 transactions, the County did not verify the vendors' suspension or debarment status prior to payment due to the County not having procedures in place at the time contracts were obtained to verify that contractors were neither suspended nor debarred, or otherwise excluded or disqualified, from participating in federal assistance programs or activities. INDIANA STATE BOARD OF ACCOUNTS 20 BARTHOLOMEW COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) The lack of internal controls and noncompliance were system throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 31 CFR 19.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you do business is not excluded or disqualified. You do this by: (a) Checking the EPLS; or (b) Collecting a certification from that person if allowed by this rule; or (c) Adding a clause or condition to the covered transaction with that person." Cause Due to the timing of the adoption of the County's Suspension and Debarment Policy, which defines procedures to verify suspension and debarment status for covered transactions, the items selected for testing were not verified. Effect Without the proper design or implementation of internal controls, the County cannot ensure that contractors paid with federal funds are eligible to participate in federal programs. Any program funds the County used to pay contractors that have been suspended or debarred would be unallowable, and the funding agency could potentially recover the funds. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County strengthen its system of internal controls to ensure that all contractors that are paid $25,000 or more, all or in part with federal funds, are not suspended or debarred from participating in federal programs before entering into contracts. We also recommended strengthening its policies and procedures to ensure appropriate supporting documentation for federal programs is retained to be presented for audit. INDIANA STATE BOARD OF ACCOUNTS 21 BARTHOLOMEW COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 001: FFATA Controls Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There is no internal control in place over Federal Funding Accountability and Transparency Act (FFATA) reporting submissions, which is a direct and material compliance requirement over USAID federal awards. Context: The lack of control in place over FFATA submissions did not result in any instances of noncompliance with FFATA reporting requirements. The lack of an internal control in place over FFATA submissions resulted in a significant deficiency in internal controls over the FFATA compliance requirement due to potential for future noncompliance. Cause: Policies and procedures documents do not include controls for FFATA report submissions. Effect: The lack of control around FFATA submissions could result in missed reporting requirements resulting in potential delays in award processing and discontinued funding. Questioned costs: None Repeat finding? No Recommendation: We recommend management implement a control over FFATA submissions that includes evidence of that control taking place (signature, email approval, etc.). Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Department of Homeland Security, State of Iowa Department of Homeland Security and Emergency Management, 97.039, 4483DRIAP00000005, 2024 Hazard Mitigation Grant Program Reporting Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: In two of two quarterly reports tested, we noted the Cooperative improperly reported the federal, state, and local shares incurred during the reporting period. Cause: The Cooperative’s independent review process over the quarterly performance reports did not identify the improperly excluded expenditures on the report. Effect: Lack of compliance with designed internal controls over reporting could result in the Cooperative reporting incorrect or incomplete information. Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of 2 out of 4 quarterly performance reports. Repeat Finding from Prior Year: No Recommendation: We recommend the Cooperative review internal control procedures over reporting to ensure reported amounts agree to supporting documentation including a reconciliation to the general ledger. In addition, we suggest the Cooperative implement a formal approval process and retain documentation to support evidence of the review. Views of Responsible Officials: Management agrees with the finding.

Department of Homeland Security, State of Iowa Department of Homeland Security and Emergency Management, 97.039, 4483DRIAP00000005, 2024 Hazard Mitigation Grant Program Cash Management Material Weakness in Internal Control over Compliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: In two of two draw requests tested, we noted that the Cooperative did not have formal documentation to support the review of the draw prior to submission for reimbursement. Cause: The Cooperative did not have any formally documented review and approval over the draw requests. Effect: Lack of properly designed controls could result in a reasonable possibility the Cooperative would not be able to demonstrate compliance with the federal program. Questioned Costs: None reported. Context/Sampling: There were two draw requests made during the year and both were tested. Repeat Finding from Prior Year: No Recommendation: We recommend the Cooperative review internal control procedures over cash management to implement a formal review and approval process over draw requests prior to submission. The procedures should incorporate steps to retain documentation to support evidence of the review. Views of Responsible Officials: Management agrees with the finding.

Department of Treasury, State of Iowa Department of Management, Federal Financial Assistance Listing 21.029, 526659 Coronavirus Capital Projects Fund Procurement, Suspension & Debarment Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 200.318 maintains that recipients must have and use documented procurement policies and must conform procurement standards in sections 200.317 through 200.327. 2 CFR 200 Appendix II requires certain provisions be included in contracts if criteria are applicable. Additionally, 2 CFR 200.214 requires recipients to restrict the subawards and contract with certain parities that are debarred, suspended, or excluded from ineligible participation in Federal assistance programs or activities. Condition: Testing of the federal program identified the following: • The Cooperative’s formally documented procurement policy was missing one required element as it relates to the methods of procurement. • One instance where the Cooperative followed a bid process, however, the documentation was not retained to support the selection. Additionally, the contract with the vendor was missing required contract provisions in accordance with Uniform Guidance. • One instance where the Cooperative did not follow the procurement process as detailed in the procurement policy and did not have any formal documentation or contract in place with the vendor. • Two instances where the Cooperative entered into a contract with a vendor over $25,000 and there was no review performed to ensure the vendor was not suspended or debarred. Cause: Contract provisions were not evaluated compared to Uniform Guidance contract requirements. Contracts entered were not evaluated in accordance with Uniform Guidance as it relates to suspension and debarment. Effect: Ineffective controls over this are of compliance could result in a reasonable possibility the Cooperative would be noncompliant with the compliance requirements outlined above. Additionally, the cooperative may enter into a covered transaction with a vendor that is suspended or debarred. Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of 2 out of 4 vendors were selected for testing. Repeat Finding form Prior Year: No Recommendation: We recommend the Cooperative update their procurement policy to ensure it includes the required elements as it relates to the methods of procurement. In addition, we suggest that management implement procedures and control processes related to the review of contracts to ensure the procurement methods are being followed as it relates to covered transactions and those contracts include the required Uniform Guidance provisions. Also, management should ensure vendors are not suspended or debarred from doing business with the federal government. Views of Responsible Officials: Management agrees with the finding.

2024-005 - Lack of Written Federal Policies and Procedures Required by Uniform Guidance Finding Type: Material weakness in internal control over compliance Federal Program: 21.027 Coronavirus State and Local Fiscal Recovery Funds Compliance Requirement: Allowable Costs/Cost Principles, Procurement and Suspension and Debarment Condition/Finding: The Village has not developed or implemented the written policies and procedures required under the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). Required documentation is absent in areas such as internal controls over compliance, cash management, procurement, and allowable costs. Criteria: Per 2 CFR §200.303 and related sections (including §§200.305 and 200.318–320), non-federal entities expending federal awards must establish and maintain effective internal controls and must document policies and procedures governing compliance with applicable federal statutes, regulations, and terms of award. Cause: The Village has not formally developed Uniform Guidance-compliant policies due to limited administrative resources and competing operational priorities. Effect: The absence of formal written policies and procedures increases the risk of inconsistent or noncompliant treatment of federal expenditures. Without documented controls and expectations, the Village may fail to detect or prevent noncompliance with federal requirements in key grant administration areas. Recommendation: We recommend that the Village adopt written policies and procedures addressing the specific requirements outlined in the Uniform Guidance. These policies should include, but not be limited to, internal controls over compliance, procurement, cash management, subrecipient monitoring (if applicable), and allowable cost determinations. Management should ensure that these policies are communicated and periodically reviewed. View of Responsible Officials: Management’s response and planned corrective action can be found in the accompanying Corrective Action Plan.

FINDING 2024-002 Subject: Water and Waste Disposal Systems for Rural Communities - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Program: Water and Waste Disposal Systems for Rural Communities Assistance Listings Number: 10.760 Federal Award Number and Year (or Other Identifying Number): BAN-2 Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Other Matters Condition and Context As part of sound management of the federal award, the City was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The City had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. INDIANA STATE BOARD OF ACCOUNTS 16 CITY OF HUNTINGBURG SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Federal regulations allow for informal procurement methods when the value of the procurement for property or services does not exceed the simplified acquisition threshold, which is set at $250,000 unless a lower, more restrictive threshold is set by a nonfederal entity. As Indiana Code has set a more restrictive threshold of $150,000, informal procurement methods are permitted when the value of the procurement does not exceed $150,000. This informal process allows for methods other than the formal bid process. The informal process is divided between two methods based on thresholds, micro-purchases, typically for those purchases $10,000 or under, and small purchase procedures for those purchases above the micropurchase threshold but below the simplified acquisition threshold. Micro-purchases may be awarded without soliciting competitive price rate quotations. If small purchase procedures are used, then price or rate quotations must be obtained from an adequate number of qualified sources. Procurement - Simplified Acquisition During the audit period, the City had two vendors with purchases over the $150,000 threshold that were considered simplified acquisition procurements. Both vendors were tested. For one vendor, the City could not provide the procurement history or the rationale for the method of procurement, the selection of vendor, or the basis for price. The total amount spent with this vendor was $2,391,895. Procurement - Policy The City provided its purchasing policy for review, but it did not include the applicable federal regulations, such as procedures to avoid the acquisition of unnecessary or duplicative items and procedures to ensure that all solicitations incorporate a clear and accurate description of the technical requirements for the material, product, or service to be procured. Additionally, the City did not maintain written standards of conduct covering conflicts of interest and governing actions of its employees engaged in the selection, award, and administration of contracts. Suspension and Debarment Prior to entering into subawards and covered transactions with, recipients are required to verify that such contracts and subrecipients are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the Excluded Parties List System (EPLS), collecting a certification from that person, or adding a clause or condition to the covered transaction with that person. A population of four covered transactions for goods or services were paid from USDA award funds during the audit period. A sample of two vendors were selected for testing. Of the two vendors tested, one vendor was not verified to not be suspended nor debarred or otherwise excluded or disqualified from participating in federal assistance programs or activities. The lack of internal controls and noncompliance were isolated to the same single vendor for both the simplified acquisition and the suspension and debarment issues as noted above. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 17 CITY OF HUNTINGBURG SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318 states in part: "(a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standards identified in §§ 200.317 through 200.327. . . . (i) The non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. . . ." 2 CFR 200.320(b) states in part: "Formal procurement methods. When the value of the procurement for property or services under a Federal financial assistance awards exceeds the SAT, or a lower threshold established by a non-Federal entity, formal procurement methods are required. Formal procurement methods require following documented procedures. Formal procurement methods also require public advertising unless a non-competitive procurement can be used in accordance with § 200.319 or paragraph (c) of this section. The following formal methods of procurement are used for procurement of property or services above the simplified acquisition threshold or a value below the simplified acquisition threshold the non-Federal entity determines to be appropriate: (1) Sealed bids. A procurement method in which bids are publicly solicited and a firm fixed-price contract (lump sum or unit price) is awarded to the responsible bidder whose bid, conforming with all the material terms and conditions of the invitation for bids, is the lowest in price. . . . (2) Proposals. A procurement method in which either a fixed price or cost-reimbursement type contract is awarded. Proposals are generally used when conditions are not appropriate for the use of sealed bids. . . ." 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person." INDIANA STATE BOARD OF ACCOUNTS 18 CITY OF HUNTINGBURG SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Cause The vendor in question was an engineering firm that the City originally hired to do a study at $40,000 in 2018 related to the wastewater treatment plant project. Through the years, the City did amendments to the contract to include more engineering services and did not advertise for bids or verify that the engineering firm was not suspended or debarred from receiving federal funds. Effect Without the proper implementation of an effectively designed system of internal controls, the City cannot ensure that the services obtained provided full and open competition or the basis of the price. In addition, the City cannot ensure the vendors paid were eligible to participate in federal programs. Any program funds the City used to pay vendors that have been suspended or debarred would be unallowable, and the funding agency could potentially recover them. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the City. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the City's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. We recommended that management of the City establish a proper system of internal controls and develop policies and procedures to ensure contractors and subrecipients, as appropriate, are not suspended, debarred, or otherwise excluded prior to entering into contracts or subawards. We also recommended strengthening its policies and procedures to ensure appropriate supporting documentation for federal programs is retained to be presented for audit. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2024-003: Reporting Assistance Listing Program Title: CDBG – Entitlement/Special Purpose Grants Cluster: Community Development Block Grants/Entitlement Grants; COVID-19 - Community Development Block Grants/Entitlement Grants Assistance Listing Program Number: 14.218 Federal Agency: U.S. Department of Housing and Urban Development Award Year: 2024 Award Numbers: B-20-MC-08-0015, B-20-MW-08-0015, B-21-MC-08-0015, B-22-MC-08-0015, B-23-MC-08-0015 Pass-through Entity: N/A Criteria: 2 CFR 200.303 requires that the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The quarterly Cash on Hand reports and the annual FFATA report did not have documentation supporting a review by an employee other than the preparer prior to submission. The reports were prepared and submitted to the Department of Housing and Urban Development (“HUD”), but they were not reviewed by anyone other than the preparer prior to submission. Cause: The City does not have processes and controls in place to ensure that reports are reviewed and requirements are met. Effect or Potential Effect: Without a supervisory review, there is an increased risk of inaccurate reporting. Questioned Costs: None. Context: For the quarterly Cash on Hand reports and the annual FFATA report, there was no documentation supporting a supervisory review and approval of each of the reports. Identification as a Repeat Finding, If Applicable: Not Applicable Recommendation: We recommend the City establish polices and procedure to require documentation of a report reviewer other than the preparer, prior to submission of each required report. View of Responsible Officials: Management agrees with this finding.

Finding 2024-002: Suspension and Debarment Assistance Listing Program Title: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Program Number: 21.027 Federal Agency: U.S. Department of the Treasury Award Year: 2024 Criteria: The Federal Government requires that when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The City does not have adequate controls in place to ensure that suspension and debarment compliance requirements are met. Cause: Although the City does have a process in place for verifying vendors paid with federal funds are not suspended or debarred from receiving federal funds, this verification took place after a contract was entered into with the vendor instead of before. Effect or Potential Effect: In the absence of appropriate controls, the City could enter into a contract with a vendor or subrecipient that is suspended or debarred from participating in federal programs, which would result in noncompliance with federal program requirements. Questioned Costs: None. Context: Out of a sample of four vendors where suspension and debarment checks were completed by the City, this verification was not completed prior to the City entering into contracts with those vendors. Identification as a Repeat Finding, If Applicable: Not Applicable Recommendation: We recommend the City implement procedures to properly ensure that suspension and debarment verification occurs prior entering into a covered transaction with a vendor that receives federal funds. View of Responsible Officials: Management agrees with this finding.

Finding 2024-002: Suspension and Debarment Assistance Listing Program Title: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Program Number: 21.027 Federal Agency: U.S. Department of the Treasury Award Year: 2024 Criteria: The Federal Government requires that when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The City does not have adequate controls in place to ensure that suspension and debarment compliance requirements are met. Cause: Although the City does have a process in place for verifying vendors paid with federal funds are not suspended or debarred from receiving federal funds, this verification took place after a contract was entered into with the vendor instead of before. Effect or Potential Effect: In the absence of appropriate controls, the City could enter into a contract with a vendor or subrecipient that is suspended or debarred from participating in federal programs, which would result in noncompliance with federal program requirements. Questioned Costs: None. Context: Out of a sample of four vendors where suspension and debarment checks were completed by the City, this verification was not completed prior to the City entering into contracts with those vendors. Identification as a Repeat Finding, If Applicable: Not Applicable Recommendation: We recommend the City implement procedures to properly ensure that suspension and debarment verification occurs prior entering into a covered transaction with a vendor that receives federal funds. View of Responsible Officials: Management agrees with this finding.

Finding 2024-002: Suspension and Debarment Assistance Listing Program Title: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Program Number: 21.027 Federal Agency: U.S. Department of the Treasury Award Year: 2024 Criteria: The Federal Government requires that when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The City does not have adequate controls in place to ensure that suspension and debarment compliance requirements are met. Cause: Although the City does have a process in place for verifying vendors paid with federal funds are not suspended or debarred from receiving federal funds, this verification took place after a contract was entered into with the vendor instead of before. Effect or Potential Effect: In the absence of appropriate controls, the City could enter into a contract with a vendor or subrecipient that is suspended or debarred from participating in federal programs, which would result in noncompliance with federal program requirements. Questioned Costs: None. Context: Out of a sample of four vendors where suspension and debarment checks were completed by the City, this verification was not completed prior to the City entering into contracts with those vendors. Identification as a Repeat Finding, If Applicable: Not Applicable Recommendation: We recommend the City implement procedures to properly ensure that suspension and debarment verification occurs prior entering into a covered transaction with a vendor that receives federal funds. View of Responsible Officials: Management agrees with this finding.

Finding 2024-002: Suspension and Debarment Assistance Listing Program Title: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Program Number: 21.027 Federal Agency: U.S. Department of the Treasury Award Year: 2024 Criteria: The Federal Government requires that when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The City does not have adequate controls in place to ensure that suspension and debarment compliance requirements are met. Cause: Although the City does have a process in place for verifying vendors paid with federal funds are not suspended or debarred from receiving federal funds, this verification took place after a contract was entered into with the vendor instead of before. Effect or Potential Effect: In the absence of appropriate controls, the City could enter into a contract with a vendor or subrecipient that is suspended or debarred from participating in federal programs, which would result in noncompliance with federal program requirements. Questioned Costs: None. Context: Out of a sample of four vendors where suspension and debarment checks were completed by the City, this verification was not completed prior to the City entering into contracts with those vendors. Identification as a Repeat Finding, If Applicable: Not Applicable Recommendation: We recommend the City implement procedures to properly ensure that suspension and debarment verification occurs prior entering into a covered transaction with a vendor that receives federal funds. View of Responsible Officials: Management agrees with this finding.

Finding 2024-003: Reporting Assistance Listing Program Title: CDBG – Entitlement/Special Purpose Grants Cluster: Community Development Block Grants/Entitlement Grants; COVID-19 - Community Development Block Grants/Entitlement Grants Assistance Listing Program Number: 14.218 Federal Agency: U.S. Department of Housing and Urban Development Award Year: 2024 Award Numbers: B-20-MC-08-0015, B-20-MW-08-0015, B-21-MC-08-0015, B-22-MC-08-0015, B-23-MC-08-0015 Pass-through Entity: N/A Criteria: 2 CFR 200.303 requires that the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The quarterly Cash on Hand reports and the annual FFATA report did not have documentation supporting a review by an employee other than the preparer prior to submission. The reports were prepared and submitted to the Department of Housing and Urban Development (“HUD”), but they were not reviewed by anyone other than the preparer prior to submission. Cause: The City does not have processes and controls in place to ensure that reports are reviewed and requirements are met. Effect or Potential Effect: Without a supervisory review, there is an increased risk of inaccurate reporting. Questioned Costs: None. Context: For the quarterly Cash on Hand reports and the annual FFATA report, there was no documentation supporting a supervisory review and approval of each of the reports. Identification as a Repeat Finding, If Applicable: Not Applicable Recommendation: We recommend the City establish polices and procedure to require documentation of a report reviewer other than the preparer, prior to submission of each required report. View of Responsible Officials: Management agrees with this finding.

FINDING 2024-001 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Suspension and Debarment Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): Acct ID #00Bt000000165QAEAY, Contract #64595, Contract #66522 Compliance Requirement: Procurement and Suspension and Debarment Audit Finding: Significant DeficiencyRepeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-001. Condition and Context An internal control system, which would include segregation of duties, was not in place at the County in order to ensure compliance with requirements related to the grant agreement and the Procurement and Suspension and Debarment compliance requirement. The County elected to receive the standard revenue loss allowance, allowing the County to claim its total COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF) allocation of $7,093,582 as revenue loss to use for government services. The U.S. Department of the Treasury (Treasury) determined that there are no subawards under this eligible use category and that recipients' use of revenue loss funds would not give rise to subrecipient relationships given that there is no federal program or purpose to carry out in the case of the revenue loss portion of the award. Prior to entering into subawards and covered transactions with SLFRF award funds, recipients are required to verify that such contractors and subrecipients are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the Excluded Parties List System, collecting a certification from that person or entity, or adding a clause or condition to the covered transaction with that person or entity. Due to the Treasury's determination that the revenue loss eligible use category does not give rise to subawards, the County was only required to comply with suspension and debarment requirements related to covered transactions. We selected three covered transactions for testing. The County had procedures in place to verify that persons and entities related to each of the covered transactions were not suspended, debarred, or otherwise excluded; however, there was no review or approval process documented for us to verify that an internal control system was designed and operating properly. The lack of internal controls was systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause After the prior audit, the County established procedures to include a suspension and debarment clause in agreements and contracts, collect a certification from that person or entity, or check for exclusions using the Sam.gov website. However, no internal control procedure was documented that a second person had reviewed the procedure to ensure compliance. Effect Without the proper implementation of an effectively designed system of internal controls, the County could not ensure the persons and entities paid with federal funds were eligible to participate in federal programs. Any program funds the County would have used to pay contractors that had been suspended or debarred would have been unallowable, and the funding agency could have potentially recovered them. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County strengthen its system of internal controls to ensure that all vendors with covered transactions that are $25,000 or more, paid for completely or in part with federal funds, are not suspended, debarred, or otherwise excluded from participating in federal programs prior to entering any contracts. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Department of Homeland Security, State of Nebraska Office of Emergency Management Agency, 97.039, DR‐4420‐NE‐0017 Hazard Mitigation Grant Program Reporting Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Certain line items in the reports submitted for the quarters ended 3/31/2024 and 6/30/2024 contained costs from the incorrect period. Cause: The District utilized the “Job Analysis Report” and was unaware the report contained costs that were from the incorrect period. Effect: The District’s control process and procedures did not detect or correct the errors. Questioned Costs: No questioned costs over $25,000. Context/Sampling: Nonstatistical sampling was used. There were three quarterly reports submitted throughout the fiscal year. As such, three reports were selected for testing. Key line items were identified within the reports for testing. Repeat Finding form Prior Year: Yes, prior year finding 2023‐004. Recommendation: We recommend the District review the process surrounding the data utilized to put together the quarterly reports submitted to ensure the correct amounts are used and are properly supported. Views of Responsible Officials: Management agrees with the finding.

2024-001 Activities Allowed or Unallowed and Allowable Costs/Cost Principles Prior Year Finding Number: 2023-006 Year of Finding Origination: 2023 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Material Weakness and Modified Opinion Federal Agency: U.S. Department of Health and Human Services Program: 93.778 Medical Assistance Program Award Number and Year: 2405MN5ADM; 2024 Pass-Through Agency: Minnesota Department of Human Services Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Administrative program costs for Medical Assistance Program are submitted to the Minnesota Department of Human Services (DHS) through the DHS Income Maintenance (DHS-2550) report and the Social Service Fund (DHS-2556) report on a quarterly basis. DHS provides reporting instructions including information regarding eligible and ineligible costs. Condition: The following exceptions were noted in the sample of 40 expenditures tested for activities allowed or unallowed and allowable costs/cost principles: • One claim was included in a DHS-2550 report as eligible expenditures but was not eligible for federal reimbursement. • One claim included in a DHS-2556 report was reported as a reduction of Intergovernmental Federal Revenue rather than a Services and Charges expenditure. • For eight timesheets tested, the payroll costs were allocated on an incorrect full-time equivalent (FTE) split on the DHS-2550 and DHS-2556 reports. • One timesheet was included in the DHS-2556 reports for Social Service Time Study Random Moment Time Study (SSTS RMS) Participants Payroll Expense rather than Non SSTS RMS Participants Payroll Expense. Questioned Costs: Questioned costs identified were less than $25,000. Context: DHS relies on accurate identification and reporting of program costs to ensure grant funds paid to the County are allowable and provide detailed information necessary for maintaining proper oversight over federal programs. Total expenditures reported on the SEFA is $715,942, consisting of 1,419 transactions. The sample of 40 transactions totaled $88,180. The sample sizes were based on the guidance from Chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Effect: Errors in the identification and reporting of costs on the quarterly reports can impair DHS’ ability to provide required oversight over federal programs. Cause: The County’s controls over the identification of allowable activities and costs, preparation of the quarterly reports, and maintenance of payroll allocations in the accounting system were not sufficient to identify these errors. The County indicated the FTE split was updated during 2024 for non-payroll costs but not for the payroll costs. Recommendation: We recommend the County implement controls to ensure activities allowed and allowable costs are appropriately identified and accurately reported to DHS in accordance with federal program guidance and DHS instructions. We also recommend the County correct and resubmit reports submitted with unallowable activities or costs, costs allocated incorrectly, or activity reported incorrectly. View of Responsible Official: Acknowledge

2024-002 Eligibility Prior Year Finding Number: N/A Year of Finding Origination: 2024 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Significant Deficiency and Other Matter Federal Agency: U.S. Department of Health and Human Services Program: 93.778 Medical Assistance Program Award Number and Year: 2405MN5ADM; 2024 Pass-Through Agency: Minnesota Department of Human Services Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 42 U.S. Code of Federal Regulations §§ 435.911 and 435.945 require the state Medicaid agency to determine and verify eligibility of enrollees in Medicaid. The Minnesota Department of Human Services provides the Minnesota Health Care Programs Eligibility Policy Manual. The manual contains the Minnesota Department of Human Services eligibility policies for the Minnesota Health Care Programs, including the eligibility requirements of Medical Assistance. Specific eligibility requirements are included for participants’ citizenship verification, income limits, and assets. Minnesota Statutes § 256B.05 requires county agencies to administer Medical Assistance. Condition: The Minnesota Department of Human Services maintains the computer system, MAXIS, which is used by Chippewa County to support the eligibility determination process. In the case files tested for eligibility, not all documentation to support participant eligibility was available, updated, or input correctly. The following exceptions were noted in the sample of 40 case files tested: • One participant’s citizenship was not verified. • Two case files did not calculate or document the participant’s income correctly. • Two case files had an asset listed in MAXIS that did not match the documentation in the case file. Questioned Costs: Not applicable. The County administers the program, but the State of Minnesota pays benefits to participants in this program. Context: The State of Minnesota and the County split the eligibility determination process. Pursuant to Minnesota statutes, Chippewa County performs the “intake function” needed for this program, while the State maintains the MAXIS system, which supports the eligibility determination process. Participants receive benefits from the State. The population consisted of 824 active MAXIS case files in 2024; the sample size was 40 case files. The sample size was based on the guidance from Chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Effect: The lack of updated information in MAXIS and lack of verification of key eligibility-determining factors increase the risk that program participants will receive benefits when they are not eligible. Cause: Program personnel entering case file information into MAXIS did not ensure all required information was input or updated correctly or verified. Recommendation: We recommend Chippewa County implement additional procedures to provide reasonable assurance that all necessary documentation to support eligibility determinations exists, the program personnel properly input or update the documentation in MAXIS, and the program personnel follow up on issues in a timely manner. In addition, Chippewa County should consider providing further training to program personnel. View of Responsible Official: Acknowledge

Criteria: The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. In accordance with the requirements of 2 CFR Section 1402.300, the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR part 170 Reporting Subaward and Executive Compensation Information. Condition: During our subrecipient testing for the major program, we were unable to verify the submission dates of the FFATA Report via the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website. The Organization was unable to provide evidence of submission, lacking retained documentation that evidenced the actual submission dates of the FFATA reports. Cause: It was determined that the absence of supporting documentation was a result of the FSRS system migration to SAM.gov. The Organization neglected to keep documentation to support submission. Effect: The inability to verify the submission dates of the FFATA reports due to missing documentation may lead to compliance issues with federal reporting requirements. Questioned Costs: None. Context: This is a condition identified per review of the Organization’s compliance with the reporting provisions of the Uniform Guidance. Repeat Finding: This finding is not a repeat finding from the prior year. Recommendation: BDO recommends that the Organization establish a comprehensive system for retaining submission records, including timestamps and confirmation receipts, to ensure all future FFATA report submissions are verifiable. Views of Responsible Officials: Management agrees with the finding and recommendations set forth within and has developed a corrective action plan to address the instances of noncompliance identified and lapses in prescribed internal controls.

Criteria: The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. In accordance with the requirements of 2 CFR Section 1402.300, the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR part 170 Reporting Subaward and Executive Compensation Information. Condition: During our subrecipient testing for the major program, we were unable to verify the submission dates of the FFATA Report via the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website. The Organization was unable to provide evidence of submission, lacking retained documentation that evidenced the actual submission dates of the FFATA reports. Cause: It was determined that the absence of supporting documentation was a result of the FSRS system migration to SAM.gov. The Organization neglected to keep documentation to support submission. Effect: The inability to verify the submission dates of the FFATA reports due to missing documentation may lead to compliance issues with federal reporting requirements. Questioned Costs: None. Context: This is a condition identified per review of the Organization’s compliance with the reporting provisions of the Uniform Guidance. Repeat Finding: This finding is not a repeat finding from the prior year. Recommendation: BDO recommends that the Organization establish a comprehensive system for retaining submission records, including timestamps and confirmation receipts, to ensure all future FFATA report submissions are verifiable. Views of Responsible Officials: Management agrees with the finding and recommendations set forth within and has developed a corrective action plan to address the instances of noncompliance identified and lapses in prescribed internal controls.

2024-002 Compensation for Personal Services Coronavirus State & Local Fiscal Recovery Funds – Assistance Listing No. 21.027 – COVID-19 Funding Award Number: 24-IHFA 186302 – Award Period: October 1, 2023 through September 30, 2024 Award Number: Aurora ARPA – Award Period: April 1, 2024 through December 31, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Condition: Hours spent working on different funding sources/cost objectives from payroll timesheets did not agree to hours entered into the payroll allocation spreadsheets for five pay periods for sampled employees #1 and #2. Additionally, total hours worked and logged on timesheets did not agree to hours paid for two pay periods for sampled employees #1 and #3. These errors were not detected and corrected after-the-fact. Criteria: According to 2 CFR 200.303(a), non-Federal entities must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 2 CFR 200.430(i)(1), Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated Questioned Costs: Not determinable. Cause: The Organization’s established internal controls over salary and wage cost allocation did not operate as intended. Effect: Allowable costs could potentially be overpaid or underpaid or disallowed and required to be paid back to the Federal awarding agency (and/or pass-through entity). Recommendation: The Organization should strengthen their policies and procedures to support a system of internal control able to prevent and/or detect and correct errors timely ensuring costs are accurate, allowable, and properly allocated. Views of Responsible Officials and Planned Corrective Actions: Gateway Domestic Violence Services acknowledges there were errors made but can attest that the charges to funders were correct. See separately issued corrective action plan.

2024-002 Compensation for Personal Services Coronavirus State & Local Fiscal Recovery Funds – Assistance Listing No. 21.027 – COVID-19 Funding Award Number: 24-IHFA 186302 – Award Period: October 1, 2023 through September 30, 2024 Award Number: Aurora ARPA – Award Period: April 1, 2024 through December 31, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Condition: Hours spent working on different funding sources/cost objectives from payroll timesheets did not agree to hours entered into the payroll allocation spreadsheets for five pay periods for sampled employees #1 and #2. Additionally, total hours worked and logged on timesheets did not agree to hours paid for two pay periods for sampled employees #1 and #3. These errors were not detected and corrected after-the-fact. Criteria: According to 2 CFR 200.303(a), non-Federal entities must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 2 CFR 200.430(i)(1), Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated Questioned Costs: Not determinable. Cause: The Organization’s established internal controls over salary and wage cost allocation did not operate as intended. Effect: Allowable costs could potentially be overpaid or underpaid or disallowed and required to be paid back to the Federal awarding agency (and/or pass-through entity). Recommendation: The Organization should strengthen their policies and procedures to support a system of internal control able to prevent and/or detect and correct errors timely ensuring costs are accurate, allowable, and properly allocated. Views of Responsible Officials and Planned Corrective Actions: Gateway Domestic Violence Services acknowledges there were errors made but can attest that the charges to funders were correct. See separately issued corrective action plan.

U.S. Department of Agriculture Passed through the Alabama State Department of Education Program: Summer Food Service Program CFDA: 10.559 Grant Number: AF6-0000 Noncompliance/Significant Deficiency Eligibility Criteria Under 7 CFR 225.6(c) and 2 CFR 200.303, sponsors of the Summer Food Service Program must ensure that all sites meet federal eligibility criteria. Sponsors are responsible for collecting and maintaining documentation that demonstrates site eligibility and must conduct appropriate oversight of sites to ensure ongoing compliance. Condition During our audit, we identified two closed enrolled operating sites for which the YMCA did not provide documentation to support eligiblity based on enrollment of children. The YMCA did not perform sufficient oversight as a sponsor of the sites to verify that required eligibility records were obtained and maintained. Cause Operating sites are separate from the YMCA. As such, all enrollment and child records are maintained separately by the operating site. The YMCA verified that free meals may be provided to children based on the appropriate data maintained by schools; however, the YMCA failed to monitor that the operating sites were maintaining records to support that meals were only being provided to enrolled children. Effect Operating sites without documented eligibility may result in unallowable costs and reimbursements for ineligible meals or sites, placing the program at risk for disallowed funding. As a result, questioned costs totaling $4,163 were identified for meals claimed at the two sites lacking eligibility support. Recommendation We recommend the entity implement and enforce procedures to collect and retain all required eligibility documents for each SFSP site. Management's Response Management recognizes the critival role of eligibility documentation in maintaining compliance with SFSP regulations and ensuring program integrity.

2024-001 – Fiscal Policies and Procedures Not Fully Aligned with Uniform Guidance Federal Program: Temporary Assistance for Needy Families, Family Violence Prevention Services Act, ARP Supplemental and ARP Covid-19 Federal Assistance Listing Number: 93.558 and 93.671 Pass-Through Agency: Texas Health and Human Services Commission Pass-Through Grantor Number: HHS000380000040 Criteria: Non-federal entities are required under 2 CFR §200.303 to establish and maintain effective internal controls over federal awards that provide reasonable assurance of compliance with federal statutes, regulations, and terms and conditions of the award. Adequate written policies and procedures are a critical component of an effective internal control system. Condition: During our review of the Center’s fiscal policies and procedures, we noted that several key elements required for compliance with 2 CFR Part 200 were either missing or lacked sufficient detail. Specifically, the following areas were underdeveloped:  Conflict of interest policies were not clearly defined or aligned with 2 CFR § 200.112.  Procedures for determining allowable costs under 2 CFR §200.403–§200.405 were not well documented.  Subrecipient monitoring procedures required by 2 CFR §200.331 were not adequately addressed.  Record retention and access policies under 2 CFR §200.333–§200.338 were not clearly outlined. While some general policies were in place, they do not currently meet the level of specificity and comprehensiveness required under the Uniform Guidance. Cause: The Center is in the process of updating its financial policies and procedures to comply with Uniform Guidance requirements. A consultant has been engaged to assist with this process, and updates are expected to be finalized and approved by the Board of Directors in August 2025. Effect: The lack of complete and detailed policies increases the risk of noncompliance with federal requirements, especially in areas such as cost allowability, subrecipient oversight, and recordkeeping. It also creates challenges in ensuring consistent and compliant financial practices across the Center. Questioned Costs: $0 – No noncompliant expenditures were identified; however, the absence of sufficient policies represents a control deficiency. Recommendation: We recommend for the Center to prioritize the completion and formal adoption of revised fiscal policies and procedures, ensuring they fully align with the requirements of 2 CFR Part 200. These should include detailed written policies on conflict of interest, allowable costs, subrecipient monitoring, and record retention. Finalizing and implementing these policies ahead of the new fiscal year, as planned, will strengthen internal controls and help ensure compliance moving forward. Management’s Views and Corrective Action Plan: Management agrees with the finding. The Center is currently in the process of updating its fiscal policies and procedures to align with the requirements of 2 CFR Part 200. The Finance Committee is leading this effort and is reviewing each policy area identified, including conflict of interest, allowable costs, subrecipient monitoring, and record retention. Updated policies and procedures will be finalized and presented for Board approval by August 30, 2025. Once approved, the Center will ensure implementation across all departments and provide internal guidance to promote consistent application. Anticipated Completion Date: August 30, 2025 Responsible Party: Finance Committee, with support from Executive Director, Nichole Henry.

2024-001 – Fiscal Policies and Procedures Not Fully Aligned with Uniform Guidance Federal Program: Temporary Assistance for Needy Families, Family Violence Prevention Services Act, ARP Supplemental and ARP Covid-19 Federal Assistance Listing Number: 93.558 and 93.671 Pass-Through Agency: Texas Health and Human Services Commission Pass-Through Grantor Number: HHS000380000040 Criteria: Non-federal entities are required under 2 CFR §200.303 to establish and maintain effective internal controls over federal awards that provide reasonable assurance of compliance with federal statutes, regulations, and terms and conditions of the award. Adequate written policies and procedures are a critical component of an effective internal control system. Condition: During our review of the Center’s fiscal policies and procedures, we noted that several key elements required for compliance with 2 CFR Part 200 were either missing or lacked sufficient detail. Specifically, the following areas were underdeveloped:  Conflict of interest policies were not clearly defined or aligned with 2 CFR § 200.112.  Procedures for determining allowable costs under 2 CFR §200.403–§200.405 were not well documented.  Subrecipient monitoring procedures required by 2 CFR §200.331 were not adequately addressed.  Record retention and access policies under 2 CFR §200.333–§200.338 were not clearly outlined. While some general policies were in place, they do not currently meet the level of specificity and comprehensiveness required under the Uniform Guidance. Cause: The Center is in the process of updating its financial policies and procedures to comply with Uniform Guidance requirements. A consultant has been engaged to assist with this process, and updates are expected to be finalized and approved by the Board of Directors in August 2025. Effect: The lack of complete and detailed policies increases the risk of noncompliance with federal requirements, especially in areas such as cost allowability, subrecipient oversight, and recordkeeping. It also creates challenges in ensuring consistent and compliant financial practices across the Center. Questioned Costs: $0 – No noncompliant expenditures were identified; however, the absence of sufficient policies represents a control deficiency. Recommendation: We recommend for the Center to prioritize the completion and formal adoption of revised fiscal policies and procedures, ensuring they fully align with the requirements of 2 CFR Part 200. These should include detailed written policies on conflict of interest, allowable costs, subrecipient monitoring, and record retention. Finalizing and implementing these policies ahead of the new fiscal year, as planned, will strengthen internal controls and help ensure compliance moving forward. Management’s Views and Corrective Action Plan: Management agrees with the finding. The Center is currently in the process of updating its fiscal policies and procedures to align with the requirements of 2 CFR Part 200. The Finance Committee is leading this effort and is reviewing each policy area identified, including conflict of interest, allowable costs, subrecipient monitoring, and record retention. Updated policies and procedures will be finalized and presented for Board approval by August 30, 2025. Once approved, the Center will ensure implementation across all departments and provide internal guidance to promote consistent application. Anticipated Completion Date: August 30, 2025 Responsible Party: Finance Committee, with support from Executive Director, Nichole Henry.

2024-001 – Fiscal Policies and Procedures Not Fully Aligned with Uniform Guidance Federal Program: Temporary Assistance for Needy Families, Family Violence Prevention Services Act, ARP Supplemental and ARP Covid-19 Federal Assistance Listing Number: 93.558 and 93.671 Pass-Through Agency: Texas Health and Human Services Commission Pass-Through Grantor Number: HHS000380000040 Criteria: Non-federal entities are required under 2 CFR §200.303 to establish and maintain effective internal controls over federal awards that provide reasonable assurance of compliance with federal statutes, regulations, and terms and conditions of the award. Adequate written policies and procedures are a critical component of an effective internal control system. Condition: During our review of the Center’s fiscal policies and procedures, we noted that several key elements required for compliance with 2 CFR Part 200 were either missing or lacked sufficient detail. Specifically, the following areas were underdeveloped:  Conflict of interest policies were not clearly defined or aligned with 2 CFR § 200.112.  Procedures for determining allowable costs under 2 CFR §200.403–§200.405 were not well documented.  Subrecipient monitoring procedures required by 2 CFR §200.331 were not adequately addressed.  Record retention and access policies under 2 CFR §200.333–§200.338 were not clearly outlined. While some general policies were in place, they do not currently meet the level of specificity and comprehensiveness required under the Uniform Guidance. Cause: The Center is in the process of updating its financial policies and procedures to comply with Uniform Guidance requirements. A consultant has been engaged to assist with this process, and updates are expected to be finalized and approved by the Board of Directors in August 2025. Effect: The lack of complete and detailed policies increases the risk of noncompliance with federal requirements, especially in areas such as cost allowability, subrecipient oversight, and recordkeeping. It also creates challenges in ensuring consistent and compliant financial practices across the Center. Questioned Costs: $0 – No noncompliant expenditures were identified; however, the absence of sufficient policies represents a control deficiency. Recommendation: We recommend for the Center to prioritize the completion and formal adoption of revised fiscal policies and procedures, ensuring they fully align with the requirements of 2 CFR Part 200. These should include detailed written policies on conflict of interest, allowable costs, subrecipient monitoring, and record retention. Finalizing and implementing these policies ahead of the new fiscal year, as planned, will strengthen internal controls and help ensure compliance moving forward. Management’s Views and Corrective Action Plan: Management agrees with the finding. The Center is currently in the process of updating its fiscal policies and procedures to align with the requirements of 2 CFR Part 200. The Finance Committee is leading this effort and is reviewing each policy area identified, including conflict of interest, allowable costs, subrecipient monitoring, and record retention. Updated policies and procedures will be finalized and presented for Board approval by August 30, 2025. Once approved, the Center will ensure implementation across all departments and provide internal guidance to promote consistent application. Anticipated Completion Date: August 30, 2025 Responsible Party: Finance Committee, with support from Executive Director, Nichole Henry.

2024-001 – Fiscal Policies and Procedures Not Fully Aligned with Uniform Guidance Federal Program: Temporary Assistance for Needy Families, Family Violence Prevention Services Act, ARP Supplemental and ARP Covid-19 Federal Assistance Listing Number: 93.558 and 93.671 Pass-Through Agency: Texas Health and Human Services Commission Pass-Through Grantor Number: HHS000380000040 Criteria: Non-federal entities are required under 2 CFR §200.303 to establish and maintain effective internal controls over federal awards that provide reasonable assurance of compliance with federal statutes, regulations, and terms and conditions of the award. Adequate written policies and procedures are a critical component of an effective internal control system. Condition: During our review of the Center’s fiscal policies and procedures, we noted that several key elements required for compliance with 2 CFR Part 200 were either missing or lacked sufficient detail. Specifically, the following areas were underdeveloped:  Conflict of interest policies were not clearly defined or aligned with 2 CFR § 200.112.  Procedures for determining allowable costs under 2 CFR §200.403–§200.405 were not well documented.  Subrecipient monitoring procedures required by 2 CFR §200.331 were not adequately addressed.  Record retention and access policies under 2 CFR §200.333–§200.338 were not clearly outlined. While some general policies were in place, they do not currently meet the level of specificity and comprehensiveness required under the Uniform Guidance. Cause: The Center is in the process of updating its financial policies and procedures to comply with Uniform Guidance requirements. A consultant has been engaged to assist with this process, and updates are expected to be finalized and approved by the Board of Directors in August 2025. Effect: The lack of complete and detailed policies increases the risk of noncompliance with federal requirements, especially in areas such as cost allowability, subrecipient oversight, and recordkeeping. It also creates challenges in ensuring consistent and compliant financial practices across the Center. Questioned Costs: $0 – No noncompliant expenditures were identified; however, the absence of sufficient policies represents a control deficiency. Recommendation: We recommend for the Center to prioritize the completion and formal adoption of revised fiscal policies and procedures, ensuring they fully align with the requirements of 2 CFR Part 200. These should include detailed written policies on conflict of interest, allowable costs, subrecipient monitoring, and record retention. Finalizing and implementing these policies ahead of the new fiscal year, as planned, will strengthen internal controls and help ensure compliance moving forward. Management’s Views and Corrective Action Plan: Management agrees with the finding. The Center is currently in the process of updating its fiscal policies and procedures to align with the requirements of 2 CFR Part 200. The Finance Committee is leading this effort and is reviewing each policy area identified, including conflict of interest, allowable costs, subrecipient monitoring, and record retention. Updated policies and procedures will be finalized and presented for Board approval by August 30, 2025. Once approved, the Center will ensure implementation across all departments and provide internal guidance to promote consistent application. Anticipated Completion Date: August 30, 2025 Responsible Party: Finance Committee, with support from Executive Director, Nichole Henry.

2024-001 Eligibility Prior Year Finding Number: N/A Year of Finding Origination: 2024 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Significant Deficiency and Other Matter Federal Agency: U.S. Department of Health and Human Services Program: 93.778 Medical Assistance Program Award Number and Year: 2405MN5ADM; 2024 Pass-Through Agency: Minnesota Department of Human Services Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 42 U.S. Code of Federal Regulations §§ 435.911 and 435.945 require the state Medicaid agency to determine and verify eligibility of enrollees in Medicaid. The Minnesota Department of Human Services provides the Minnesota Health Care Programs Eligibility Policy Manual. The manual contains the Minnesota Department of Human Services eligibility policies for the Minnesota Health Care Programs, including the eligibility requirements of Medical Assistance. Specific eligibility requirements are included for participants’ Social Security number verification and income limits. Minnesota Statutes, section 256B.05, requires agencies to administer Medical Assistance. Condition: The Minnesota Department of Human Services maintains the computer system, METS, which is used by MNPrairie to support the eligibility determination process. In the case files tested for eligibility, not all documentation to support participant eligibility was available, updated, or input correctly. The following exceptions were noted in the sample of 40 case files tested: • One participant’s Social Security number was not verified. • Two case files did not calculate or document the participant’s income correctly. Questioned Costs: Not applicable. MNPrairie administers the program, but the State of Minnesota pays benefits to participants in this program. Context: The State of Minnesota and MNPrairie split the eligibility determination process. Generally, MNPrairie resolves eligibility issues when prompted by the system, while the State performs the initial review of the case files, including determining the information in METS is verified. Participants receive benefits from the State. The population consisted of 16,951 active METS cases enrolled in the Medical Assistance Program in 2024; the sample size was 40 case files. The sample size was based on the guidance from Chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Effect: The improper input or updating of information in METS and lack of verification of key eligibility-determining factors increases the risk that program participants will receive benefits when they are not eligible. Cause: Program personnel responsible for resolving eligibility issues in METS did not ensure all required information was input or updated correctly or verified. Recommendation: We recommend MNPrairie implement additional procedures to provide reasonable assurance that all documentation needed to resolve eligibility issues exists and program personnel properly input, update, or verify the documentation in METS. In addition, MNPrairie should consider providing further training to program personnel. View of Responsible Official: Acknowledge

2024-002 Reporting Prior Year Finding Number: N/A Year of Finding Origination: 2024 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Significant Deficiency and Other Matter Federal Agency: U.S. Department of Health and Human Services Program: 93.778 Medical Assistance Program Award Number and Year: 2405MN5ADM; 2024 Pass-Through Agency: Minnesota Department of Human Services Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Administrative program costs for the Medical Assistance Program are submitted to the Minnesota Department of Human Services (DHS) through the DHS Social Services Fund (DHS 2556) report on a quarterly basis. DHS provides reporting instructions, including information regarding eligible and ineligible costs. Condition: In the sample of two DHS-2556 reports, misclassifications of expenditures were found between the SSTS RMS Participants Payroll Expense (Line 2a) and Non SSTS RMS Participants Payroll Expense (Line 2b) report categories. In one instance, there was a net misclassification of $44,047 between reported Line 2a and Line 2b expenditures. In the other, there was a net misclassification of $10,444 between reported Line 2a and Line 2b expenditures. Questioned Costs: None. Context: DHS relies on accurate identification and reporting of program costs to ensure grant funds paid to MNPrairie are allowable and provide detailed information necessary for maintaining proper oversight over federal programs. The identified misclassifications had no effect on the total expenses claimed for federal funding and, therefore, had no effect on federal funding received. The population consisted of four quarterly DHS 2556 reports; the sample was two quarterly DHS 2556 reports. The sample size was based on the guidance from Chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Effect: Errors in the reporting of costs in the quarterly reports can impair DHS’ ability to provide required oversight over federal programs. Cause: MNPrairie’s controls over preparation of the quarterly reports were not sufficient to identify the reporting errors. Recommendation: We recommend MNPrairie implement controls to ensure all DHS reports are completed accurately and in accordance with DHS guidance. View of Responsible Official: Acknowledge

FINDING 2024-003 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Reporting Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): 2024 Compliance Requirement: Reporting Audit Findings: Material Weakness, Other Matters Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-005. Condition and Context Recipients are required to quarterly or annually submit Project and Expenditure (P&E) reports to the U.S. Department of the Treasury (Treasury). The reporting periods, as well as the respective due dates, are based upon type of recipient and its population, as well as the recipient's allocation amount. Information to be reported includes projects funded, expenditures, and contracts for the appropriate reporting period. The County was classified as a metropolitan county with a population below 250,000 residents that received an allocation of less than $10 million in COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF). As such, the initial P&E report, covering the period from March 3, 2021 to March 31, 2022, was required to be submitted to the Treasury by April 30, 2022. The subsequent annual reports are to cover one calendar year and must be submitted to the Treasury by April 30 each year. The County submitted one P&E report during the audit period; however, the report was submitted without a review or oversight process in place to prevent, or detect and correct, errors. As a result, cumulative obligations reported were overstated by $1,160,124. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 20 JEFFERSON COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Coronavirus State and Local Fiscal Recovery Funds Compliance and Reporting Guidance, page 10, states in part: ". . . 10. Reporting. All recipients of federal funds must complete financial, performance, and compliance reporting as required and outlined in Part 2 of this guidance. Expenditures may be reported on a cash or accrual basis, as long as the methodology is disclosed and consistently applied. Reporting must be consistent with the definition of expenditures pursuant to 2 CFR 200.1. Your organization should appropriately maintain accounting records for compiling and reporting accurate, compliant financial data, in accordance with appropriate accounting standards and principles. . . ." 31 CFR 35.4(c) states in part: "Reporting and requests for other information. During the period of performance, recipients shall provide to the Secretary periodic reports providing detailed accounting of the uses of funds, . . ." Cause The County reported the total program funds received in the cumulative obligations amount, instead of only reporting the funds that had been obligated. Due to the timing of the P&E report submission and prior audit completion, corrective actions from finding 2023-005 could not be implemented in time to correct this noncompliance. Effect Without the proper implementation of an effectively designed system of internal controls, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As such, the County did not report cumulative obligations properly when filing the P&E report for the period April 1, 2023 to March 31, 2024. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the County. In addition, not meeting the SLFRF reporting requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County strengthen its system of internal controls to provide for a segregation of duties in the preparation and review of federal reports to ensure appropriate reviews, approvals, and oversight are taking place. We also recommended the development of policies and procedures to ensure the County provides the Treasury with complete and accurate information for the P&E report. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Suspension and Debarment Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): 2024 Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-004. Condition and Context Suspension and Debarment Prior to entering into subawards and covered transactions with the COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF), recipients are required to verify that such contractors and subrecipients are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the Excluded Parties List System (EPLS), collecting a certification from that person, or adding a clause or condition to the covered transaction with that person. The County's procedure to verify the vendor was not suspended or debarred was not always implemented or effective. A population of six covered transactions totaling $482,650 that equaled or exceeded $25,000 paid from SLFRF funds were identified. All six covered transactions were selected for testing. For five of the six transactions totaling $412,650, the County did not verify the vendors' suspension or debarment status prior to payment due to the County not having any policies or procedures in place at the time of the transaction to verify that contractors were neither suspended nor debarred, or otherwise excluded or disqualified, from participating in federal assistance programs or activities. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 22 JEFFERSON COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 31 CFR 19.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you do business is not excluded or disqualified. You do this by: (a) Checking the EPLS; or (b) Collecting a certification from that person if allowed by this rule; or (c) Adding a clause or condition to the covered transaction with that person." Cause The County's purchasing policy did not include procedures to verify suspension and debarment status for covered transactions it intended to pay with federal funds. The County was not aware of the suspension and debarment requirements at the time the covered transactions were entered into. Due to the timing of prior audit completion, corrective actions could not be implemented in time to correct the noncompliance. Effect Without the proper implementation of an effectively designed system of internal controls, the County cannot ensure that contractors paid with federal funds are eligible to participate in federal programs. Any program funds the County used to pay contractors that have been suspended or debarred would be unallowable, and the funding agency could potentially recover them. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the County. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County strengthen its system of internal controls to ensure that all contractors that are paid $25,000 or more, all or in part with federal funds, are not suspended or debarred from participating in federal programs before entering into any contracts or subawards. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, and Period of Performance Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-006. Condition and Context The County had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties that would likely be effective in preventing, or detecting and correcting, material noncompliance related to expenditures made from the COVID-19 - State and Local Fiscal Recovery Funds (SLFRF). Prior to receipt of the SLFRF award funds, all eligible entities were required to execute a Financial Assistance Agreement (Agreement), which included the Award Terms and Conditions that recipients must comply with in carrying out the objectives of their award. Per the Agreement, the County was responsible for the effective administration of the federal award, as well as the application of sound management practices and administration of the federal funds in a manner consistent with the program objectives and the terms and conditions of the award. Recipients may use the SLFRF funds for any eligible expenses subject to the restrictions set forth in sections 602 and 603 of the Social Security Act as added by section 9901 of the American Rescue Plan Act of 2021. The SLFRF program provides substantial flexibility for each recipient to meet local needs within four separate eligible use categories. Recipients may use the SLFRF funds to:  Respond to the COVID-19 public health emergency and its negative economic impacts.  Respond to workers performing essential work during the COVID-19 public health emergency by providing premium pay to eligible workers of eligible employers that have eligible workers who are performing essential work.  Provide government services, to the extent COVID-19 caused a reduction in revenues collected in the most recent full fiscal year of the recipient.  Make necessary investments in water, sewer, or broadband infrastructure.  Provide emergency relief from natural disasters or the negative economic impacts of natural disasters. INDIANA STATE BOARD OF ACCOUNTS 18 SHELBY COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued)  Fund projects eligible under certain programs administered by the U.S. Department of Transportation.  Fund projects eligible under the programs established in Title I of the Housing and Community Development Act of 1974. Pursuant to the Agreement, the period of performance for the award began on the date the funds were disbursed to the County and ends on December 31, 2026. Recipients may only use funds to cover costs incurred during the period that began on March 3, 2021, and ends on December 31, 2024. Recipients must liquidate all obligations incurred by December 31, 2024, under the award no later than December 31, 2026, which is the end of the period of performance. A single employee received all invoices for financial obligations made from the SLFRF award. The employee prepared and reviewed the claims to ensure all expenditures were for allowable activities, met the cost objectives, and were within the period of performance prior to issuing payment from the SLFRF fund. The SLFRF claims were then included with the regular claims docket for the County Council's review and subsequent approval. However, the docket did not include sufficient detail nor was other documentation provided to the County Council in order for them to complete an appropriate level of review to determine if the expenses related to the SLFRF award were for allowable activities, met the cost objectives, and were within the period of performance. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause A proper system of internal controls over the SLFRF expenditures was not designed by management of the County, which would include segregation of key functions, to ensure the SLFRF funds were being used appropriately. Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the County's management of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. Effect Without the proper implementation of an effectively designed system of internal controls, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the County. INDIANA STATE BOARD OF ACCOUNTS 19 SHELBY COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County design and implement a proper system of internal controls including policies and procedures that would provide segregation of duties to ensure appropriate reviews, approvals, and oversight are taking place prior to payment of funds from the SLFRF award. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.