Findings Citing § 200.303

FINDING 2024-001 Subject: Special Education Cluster (IDEA) - Earmarking Federal Agency: Department of Education Federal Programs: Special Education Grants to States, COVID-19 - Special Education Grants to States, Special Education Preschool Grants, COVID-19 - Special Education Preschool Grants Assistance Listings Numbers: 84.027, 84.173 Federal Award Numbers and Years (or Other Identifying Numbers): 22611-046-PN01, 22611-046-ARP, 22619-046-PN01, 22619-046-ARP Pass-Through Entity: Indiana Department of Education Compliance Requirement: Matching, Level of Effort, Earmarking Audit Findings: Material Weakness, Modified Opinion Condition and Context The School Corporation is a member of the Porter County Education Services (Cooperative). During the audit period, the Cooperative operated the special education program and spent the federal money on behalf of all its members. As the grant agreement was between the Indiana Department of Education (IDOE) and each member school, the School Corporation was responsible for ensuring and providing oversight of the Cooperative. The School Corporation did not have internal controls in place to ensure that the Cooperative complied with the earmarking requirements. The Cooperative did not have adequate procedures in place to ensure that the required level of expenditures for nonpublic school students with disabilities was met for each member school. The Cooperative did not have effective internal controls to ensure nonpublic school expenditures were appropriately identified and reported. The Non-Public Proportionate Share expenditures for the 22611-046-PN01, 22611-046-ARP, 22619-46-PN01, and 22619-046-ARP grant awards could not be verified for the individual member schools. Total grant expenditures were posted as expended. The nonpublic proportionate share expenditures were determined by applying a percentage to the nonpublic school budgeted expenditures. As such, the Indiana State Board of Accounts was unable to identify if the minimum amount per the grant award was expended and properly reported to the IDOE as required. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 14 DUNELAND SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: . . . (g) Be adequately documented. . . ." 2 CFR 200.208(b) states in part: "The Federal awarding agency or pass-through entity may adjust specific Federal award conditions as needed . . ." 511 IAC 7-34-7(b) states: "The public agency, in providing special education and related services to students in nonpublic schools must expend at least an amount that is the same proportion of the public agency total subgrant under 20 U.S.C. 1411(f) as the number of nonpublic school students with disabilities, who are enrolled by their parents in nonpublic schools within its boundaries, is to the total number of students with disabilities of the same age range." Cause Through inquiry of the Cooperative management, they were unaware of the requirements to track nonpublic proportionate share expenditures directly for each member school. While the Cooperative did implement new processes and procedures to ensure expenditures were tracked by member schools starting in July 2022, all of the grant awards had been allocated to the member schools based on a percentage of the budget. Effect Without the proper implementation of an effectively designed system of internal controls, the School Corporation was unable to ensure the Cooperative compliance with earmarking requirements, and the Cooperative was unable to track expenditures for nonpublic services for each member school. Consequently, the amounts requested for reimbursement were not supported by actual expenditures but rather a percentage based on the budget per member school. Because of this, expenditures were not accurately reported to the oversight agency. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the School Corporation establish a proper system of internal controls and develop policies and procedures to ensure nonpublic proportionate share funds are appropriately allocated to the member school based on expenditures charged directly on behalf of the member school. Supporting documentation for these expenditures should be retained for audit. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-002 Subject: Special Education Cluster (IDEA) - Suspension and Debarment Federal Agency: Department of Education Federal Program: Special Education Grants to States Assistance Listings Number: 84.027 Federal Award Numbers and Years (or Other Identifying Numbers): 22611-046-PN01, 23611-046-PN01 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Other Matters Condition and Context The School Corporation is a member of the Porter County Education Services (Cooperative). During the audit period, the Cooperative operated the special education programs and spent the federal money on behalf of all its members. As the grant agreements were between the Indiana Department of Education (IDOE) and each member school, the School Corporation was responsible for ensuring and providing oversight of the Cooperative. The School Corporation did not have internal controls in place to ensure that the Cooperative complied with the suspension and debarment requirements. The Cooperative did not have effective internal controls to ensure compliance with the suspension and debarment requirements. Prior to entering into covered transactions with grant award funds, entities are required to verify that vendors under covered transactions are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods or services awarded under procurement and nonprocurement transactions (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the System for Award Management (SAM) exclusions, collecting a certification from that person, or adding a clause or condition to the covered transaction with that person. Upon inquiry of the Cooperative in order to review procedures in place for verifying that an entity with which it plans to enter into a covered transaction is not suspended, debarred, or otherwise excluded, the Cooperative explained that if the covered transaction had a contract, the contract was verified to make sure the clause for suspension and debarment was included. However, if the covered transaction did not involve a contract, the Cooperative did not have procedures in place to verify the suspension and debarment requirements. A population of five covered transactions for goods or services that equaled or exceeded $25,000 paid from the 22611-046-PN01 and 23611-046-PN01 grant award funds during the 2022-2023 fiscal year period was identified. Three of the five covered transactions did not have documentation to show that they were verified for the suspension and debarment requirements. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 16 DUNELAND SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person." Cause A proper system of internal controls was not designed by management of the School Corporation. Although the Cooperative was aware of this requirement and verified that a suspension and debarment clause was included in the contract, they were not aware that it applied to covered transactions without a contract. Effect Without adequate internal controls, the School Corporation cannot ensure that the vendors paid with federal funds were eligible to participate in federal programs. Any program funds the School Corporation used to pay vendors that were suspended and debarred would be unallowable, and the awarding agency could potentially recover them. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the School Corporation establish a proper system of internal controls and develop policies and procedures to ensure vendors are not suspended, debarred, or otherwise excluded prior to entering into any covered transactions. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-002 Subject: Special Education Cluster (IDEA) - Suspension and Debarment Federal Agency: Department of Education Federal Program: Special Education Grants to States Assistance Listings Number: 84.027 Federal Award Numbers and Years (or Other Identifying Numbers): 22611-046-PN01, 23611-046-PN01 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Other Matters Condition and Context The School Corporation is a member of the Porter County Education Services (Cooperative). During the audit period, the Cooperative operated the special education programs and spent the federal money on behalf of all its members. As the grant agreements were between the Indiana Department of Education (IDOE) and each member school, the School Corporation was responsible for ensuring and providing oversight of the Cooperative. The School Corporation did not have internal controls in place to ensure that the Cooperative complied with the suspension and debarment requirements. The Cooperative did not have effective internal controls to ensure compliance with the suspension and debarment requirements. Prior to entering into covered transactions with grant award funds, entities are required to verify that vendors under covered transactions are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods or services awarded under procurement and nonprocurement transactions (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking the System for Award Management (SAM) exclusions, collecting a certification from that person, or adding a clause or condition to the covered transaction with that person. Upon inquiry of the Cooperative in order to review procedures in place for verifying that an entity with which it plans to enter into a covered transaction is not suspended, debarred, or otherwise excluded, the Cooperative explained that if the covered transaction had a contract, the contract was verified to make sure the clause for suspension and debarment was included. However, if the covered transaction did not involve a contract, the Cooperative did not have procedures in place to verify the suspension and debarment requirements. A population of five covered transactions for goods or services that equaled or exceeded $25,000 paid from the 22611-046-PN01 and 23611-046-PN01 grant award funds during the 2022-2023 fiscal year period was identified. Three of the five covered transactions did not have documentation to show that they were verified for the suspension and debarment requirements. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 16 DUNELAND SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person." Cause A proper system of internal controls was not designed by management of the School Corporation. Although the Cooperative was aware of this requirement and verified that a suspension and debarment clause was included in the contract, they were not aware that it applied to covered transactions without a contract. Effect Without adequate internal controls, the School Corporation cannot ensure that the vendors paid with federal funds were eligible to participate in federal programs. Any program funds the School Corporation used to pay vendors that were suspended and debarred would be unallowable, and the awarding agency could potentially recover them. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the School Corporation establish a proper system of internal controls and develop policies and procedures to ensure vendors are not suspended, debarred, or otherwise excluded prior to entering into any covered transactions. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

2024-003 – Late return of Title IV funds and reviews of calculations, Cluster: Student Financial Assistance, Sponsoring Agency: Department of Education, Award Names: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans, Award Numbers: Various, Assistance Listing Titles: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans, Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, Award Year: 2023-2024, Pass-through entity: Not applicable, Criteria: Returns of Title IV funds are required to be deposited or transferred into the SFA account or, alternatively, electronic fund transfers are required to be initiated to the Department of Education as soon as possible, but no later than 45 days after the date the institution determines that the student withdrew. Returns by check are late if the check is issued more than 45 days after the institution determined the student withdrew or the date on the canceled check shows the check was endorsed more than 60 days after the date the institution determined that the student withdrew (34 CFR 668.173(b)). Additionally, 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition: Through testing of 100 students with Title IV awards who withdrew or otherwise left the University across four campuses, we noted the following at two campuses: • 16 of 25 student selections tested at one campus required a Title IV refund to be submitted to the Department of Education. In three of the 16 instances, the refund was not submitted to the Department of Education within 45 days. On average, they were submitted 61 days late. • One campus has a control by which an individual reviews a report of all withdrawn students to determine if a return of Title IV calculation is required and performs the refund calculation, if applicable. This individual signs off on the withdrawn students report to indicate that all students have been reviewed and calculations completed, if necessary, and a secondary review is performed by a Compliance Officer to ensure accuracy and compliance of refunds. Through testing of 25 students and tracing them to the withdrawn students report applicable for the date of their status change, while the report and refund calculation were prepared timely, the secondary review for 14 out of the 25 selections occurred on average 115 days after the initial report was prepared. Cause: • Management at the first campus indicated that the late returns of Title IV funds were due to competing priorities and lack of training on the implications of late returns. • Management at the second campus indicated that due to staffing changes, the secondary reviews did not happen in a timely manner. Effect: The lack of timeliness in the return of Title IV aid could result in the University accruing additional interest that will need to be assessed and paid back and lack of reviews of the calculation could result in an error being undetected. Questioned Costs: None noted. Recommendation: We recommend both campuses review their staffing and training protocols to ensure that in the event of turnover there are no gaps in the management of Title IV refund requirements and controls. Management’s Views and Corrective Action Plan: Management’s response is included in 'Management’s Views and Corrective Action Plan' included at the end of this report after the summary schedule of status of prior audit findings.

2024-003 – Late return of Title IV funds and reviews of calculations, Cluster: Student Financial Assistance, Sponsoring Agency: Department of Education, Award Names: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans, Award Numbers: Various, Assistance Listing Titles: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans, Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, Award Year: 2023-2024, Pass-through entity: Not applicable, Criteria: Returns of Title IV funds are required to be deposited or transferred into the SFA account or, alternatively, electronic fund transfers are required to be initiated to the Department of Education as soon as possible, but no later than 45 days after the date the institution determines that the student withdrew. Returns by check are late if the check is issued more than 45 days after the institution determined the student withdrew or the date on the canceled check shows the check was endorsed more than 60 days after the date the institution determined that the student withdrew (34 CFR 668.173(b)). Additionally, 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition: Through testing of 100 students with Title IV awards who withdrew or otherwise left the University across four campuses, we noted the following at two campuses: • 16 of 25 student selections tested at one campus required a Title IV refund to be submitted to the Department of Education. In three of the 16 instances, the refund was not submitted to the Department of Education within 45 days. On average, they were submitted 61 days late. • One campus has a control by which an individual reviews a report of all withdrawn students to determine if a return of Title IV calculation is required and performs the refund calculation, if applicable. This individual signs off on the withdrawn students report to indicate that all students have been reviewed and calculations completed, if necessary, and a secondary review is performed by a Compliance Officer to ensure accuracy and compliance of refunds. Through testing of 25 students and tracing them to the withdrawn students report applicable for the date of their status change, while the report and refund calculation were prepared timely, the secondary review for 14 out of the 25 selections occurred on average 115 days after the initial report was prepared. Cause: • Management at the first campus indicated that the late returns of Title IV funds were due to competing priorities and lack of training on the implications of late returns. • Management at the second campus indicated that due to staffing changes, the secondary reviews did not happen in a timely manner. Effect: The lack of timeliness in the return of Title IV aid could result in the University accruing additional interest that will need to be assessed and paid back and lack of reviews of the calculation could result in an error being undetected. Questioned Costs: None noted. Recommendation: We recommend both campuses review their staffing and training protocols to ensure that in the event of turnover there are no gaps in the management of Title IV refund requirements and controls. Management’s Views and Corrective Action Plan: Management’s response is included in 'Management’s Views and Corrective Action Plan' included at the end of this report after the summary schedule of status of prior audit findings.

2024-003 – Late return of Title IV funds and reviews of calculations, Cluster: Student Financial Assistance, Sponsoring Agency: Department of Education, Award Names: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans, Award Numbers: Various, Assistance Listing Titles: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans, Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, Award Year: 2023-2024, Pass-through entity: Not applicable, Criteria: Returns of Title IV funds are required to be deposited or transferred into the SFA account or, alternatively, electronic fund transfers are required to be initiated to the Department of Education as soon as possible, but no later than 45 days after the date the institution determines that the student withdrew. Returns by check are late if the check is issued more than 45 days after the institution determined the student withdrew or the date on the canceled check shows the check was endorsed more than 60 days after the date the institution determined that the student withdrew (34 CFR 668.173(b)). Additionally, 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition: Through testing of 100 students with Title IV awards who withdrew or otherwise left the University across four campuses, we noted the following at two campuses: • 16 of 25 student selections tested at one campus required a Title IV refund to be submitted to the Department of Education. In three of the 16 instances, the refund was not submitted to the Department of Education within 45 days. On average, they were submitted 61 days late. • One campus has a control by which an individual reviews a report of all withdrawn students to determine if a return of Title IV calculation is required and performs the refund calculation, if applicable. This individual signs off on the withdrawn students report to indicate that all students have been reviewed and calculations completed, if necessary, and a secondary review is performed by a Compliance Officer to ensure accuracy and compliance of refunds. Through testing of 25 students and tracing them to the withdrawn students report applicable for the date of their status change, while the report and refund calculation were prepared timely, the secondary review for 14 out of the 25 selections occurred on average 115 days after the initial report was prepared. Cause: • Management at the first campus indicated that the late returns of Title IV funds were due to competing priorities and lack of training on the implications of late returns. • Management at the second campus indicated that due to staffing changes, the secondary reviews did not happen in a timely manner. Effect: The lack of timeliness in the return of Title IV aid could result in the University accruing additional interest that will need to be assessed and paid back and lack of reviews of the calculation could result in an error being undetected. Questioned Costs: None noted. Recommendation: We recommend both campuses review their staffing and training protocols to ensure that in the event of turnover there are no gaps in the management of Title IV refund requirements and controls. Management’s Views and Corrective Action Plan: Management’s response is included in 'Management’s Views and Corrective Action Plan' included at the end of this report after the summary schedule of status of prior audit findings.

2024-003 – Late return of Title IV funds and reviews of calculations, Cluster: Student Financial Assistance, Sponsoring Agency: Department of Education, Award Names: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans, Award Numbers: Various, Assistance Listing Titles: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans, Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, Award Year: 2023-2024, Pass-through entity: Not applicable, Criteria: Returns of Title IV funds are required to be deposited or transferred into the SFA account or, alternatively, electronic fund transfers are required to be initiated to the Department of Education as soon as possible, but no later than 45 days after the date the institution determines that the student withdrew. Returns by check are late if the check is issued more than 45 days after the institution determined the student withdrew or the date on the canceled check shows the check was endorsed more than 60 days after the date the institution determined that the student withdrew (34 CFR 668.173(b)). Additionally, 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition: Through testing of 100 students with Title IV awards who withdrew or otherwise left the University across four campuses, we noted the following at two campuses: • 16 of 25 student selections tested at one campus required a Title IV refund to be submitted to the Department of Education. In three of the 16 instances, the refund was not submitted to the Department of Education within 45 days. On average, they were submitted 61 days late. • One campus has a control by which an individual reviews a report of all withdrawn students to determine if a return of Title IV calculation is required and performs the refund calculation, if applicable. This individual signs off on the withdrawn students report to indicate that all students have been reviewed and calculations completed, if necessary, and a secondary review is performed by a Compliance Officer to ensure accuracy and compliance of refunds. Through testing of 25 students and tracing them to the withdrawn students report applicable for the date of their status change, while the report and refund calculation were prepared timely, the secondary review for 14 out of the 25 selections occurred on average 115 days after the initial report was prepared. Cause: • Management at the first campus indicated that the late returns of Title IV funds were due to competing priorities and lack of training on the implications of late returns. • Management at the second campus indicated that due to staffing changes, the secondary reviews did not happen in a timely manner. Effect: The lack of timeliness in the return of Title IV aid could result in the University accruing additional interest that will need to be assessed and paid back and lack of reviews of the calculation could result in an error being undetected. Questioned Costs: None noted. Recommendation: We recommend both campuses review their staffing and training protocols to ensure that in the event of turnover there are no gaps in the management of Title IV refund requirements and controls. Management’s Views and Corrective Action Plan: Management’s response is included in 'Management’s Views and Corrective Action Plan' included at the end of this report after the summary schedule of status of prior audit findings.

Information on the Federal Program: Federal Program: HIV - Related Training and Technical Assistance - Aids Education and Training Centers Assistance Listing: 93.145 Federal Agency: U.S. Department of Health and Human Services – Health Resources and Services Administration (HRSA) Grant Award Number: 6 U1OHA30535-08-01 Award Periods: July 1, 2023 through June 30, 2024 Pass-Through Agency: Columbia University Grant Award Number: U1SHA46532 Award Periods: September 1, 2023 through August 31, 2024 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): 2 CFR 200.303 requires that a non-Federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Uniform Guidance 2 CFR section 200.510 states, “(b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the auditee’s financial statements, which must include the total Federal awards expended as determined in accordance with §200.502, Basis for determining Federal awards expended.” Condition: The Schedule of Expenditures of Federal Awards (the Schedule) did not accurately classify the HIV-Related Training and Technical Assistance – Aids Education and Training Centers program. The final Schedule was corrected for the misclassification.   Cause: The internal control over the SEFA reporting process was not operating effectively to appropriately classify grant awards on the SEFA. Effect or Potential Effect: Management included the HIV-Related Training and Technical Assistance grant (Assistance Listing 93.145) in the amount of $5,642,581 in the Research & Development (R&D) cluster. Questioned Costs: None. Context: Total R&D Cluster expenses included on the draft Schedule was $592,460,606 for the year ended June 30, 2024. Total R&D expenses included on the final Schedule were $586,818,025 for the year ended June 30, 2024. Total expenditures on the SEFA did not change. Identification as a Repeat Finding, if Applicable This is not a repeat finding. Recommendation: We recommend that management implement more robust controls to ensure accurate reporting of federal awards on the SEFA. Management’s Response: Department of Health and Human Services – Health Resources and Services Administration (HRSA) updated the award template utilizing a new federal format. Modification of this federal award template has allowed HRSA to indicate/flag (item 18 in the Notice of Grant Award - R&D “no”) whether the federal program is R&D in a manner not previously recorded or visible. This indicator flag now indicates AETC is non-R&D, therefore, we have reflected it appropriately in the FY24 SEFA. We will strengthen our controls for monitoring the cluster to ensure appropriate classification paying attention to any indications in the Notice of Grant Award.

Information on the Federal Program: Federal Program: HIV - Related Training and Technical Assistance - Aids Education and Training Centers Assistance Listing: 93.145 Federal Agency: U.S. Department of Health and Human Services – Health Resources and Services Administration (HRSA) Grant Award Number: 6 U1OHA30535-08-01 Award Periods: July 1, 2023 through June 30, 2024 Pass-Through Agency: Columbia University Grant Award Number: U1SHA46532 Award Periods: September 1, 2023 through August 31, 2024 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): 2 CFR 200.303 requires that a non-Federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Uniform Guidance 2 CFR section 200.510 states, “(b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the auditee’s financial statements, which must include the total Federal awards expended as determined in accordance with §200.502, Basis for determining Federal awards expended.” Condition: The Schedule of Expenditures of Federal Awards (the Schedule) did not accurately classify the HIV-Related Training and Technical Assistance – Aids Education and Training Centers program. The final Schedule was corrected for the misclassification.   Cause: The internal control over the SEFA reporting process was not operating effectively to appropriately classify grant awards on the SEFA. Effect or Potential Effect: Management included the HIV-Related Training and Technical Assistance grant (Assistance Listing 93.145) in the amount of $5,642,581 in the Research & Development (R&D) cluster. Questioned Costs: None. Context: Total R&D Cluster expenses included on the draft Schedule was $592,460,606 for the year ended June 30, 2024. Total R&D expenses included on the final Schedule were $586,818,025 for the year ended June 30, 2024. Total expenditures on the SEFA did not change. Identification as a Repeat Finding, if Applicable This is not a repeat finding. Recommendation: We recommend that management implement more robust controls to ensure accurate reporting of federal awards on the SEFA. Management’s Response: Department of Health and Human Services – Health Resources and Services Administration (HRSA) updated the award template utilizing a new federal format. Modification of this federal award template has allowed HRSA to indicate/flag (item 18 in the Notice of Grant Award - R&D “no”) whether the federal program is R&D in a manner not previously recorded or visible. This indicator flag now indicates AETC is non-R&D, therefore, we have reflected it appropriately in the FY24 SEFA. We will strengthen our controls for monitoring the cluster to ensure appropriate classification paying attention to any indications in the Notice of Grant Award.

Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Eligibility Audit Finding: Significant Deficiency Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the eligibility compliance requirement. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with eligibility requirements. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: There were $1,953 of questioned costs identified. Context: During the testing of internal controls over eligibility determinations for free and reduced meals, we noted management was unable to provide support for three of the 60 applications selected for testing. Additionally, for one of the 60 selections, the student was improperly classified as reduced when the annual income per the student’s application exceeded the corresponding threshold for that determination. Identification as a repeat finding, if applicable: No. Recommendation: We recommend that the School Corporation's management establish an internal control process to review all applications to determine if the student qualifies for free or reduced meals. There should be a formal sign off in place that the application has been reviewed and the student’s classification of free or reduced is appropriate. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Eligibility Audit Finding: Significant Deficiency Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the eligibility compliance requirement. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with eligibility requirements. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: There were $1,953 of questioned costs identified. Context: During the testing of internal controls over eligibility determinations for free and reduced meals, we noted management was unable to provide support for three of the 60 applications selected for testing. Additionally, for one of the 60 selections, the student was improperly classified as reduced when the annual income per the student’s application exceeded the corresponding threshold for that determination. Identification as a repeat finding, if applicable: No. Recommendation: We recommend that the School Corporation's management establish an internal control process to review all applications to determine if the student qualifies for free or reduced meals. There should be a formal sign off in place that the application has been reviewed and the student’s classification of free or reduced is appropriate. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Eligibility Audit Finding: Significant Deficiency Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the eligibility compliance requirement. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with eligibility requirements. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: There were $1,953 of questioned costs identified. Context: During the testing of internal controls over eligibility determinations for free and reduced meals, we noted management was unable to provide support for three of the 60 applications selected for testing. Additionally, for one of the 60 selections, the student was improperly classified as reduced when the annual income per the student’s application exceeded the corresponding threshold for that determination. Identification as a repeat finding, if applicable: No. Recommendation: We recommend that the School Corporation's management establish an internal control process to review all applications to determine if the student qualifies for free or reduced meals. There should be a formal sign off in place that the application has been reviewed and the student’s classification of free or reduced is appropriate. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program AL Numbers: 10.553, 10.555 Federal Award Numbers and Years: FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Qualified Opinion Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR section 200.303 states in part: "The non-Federal entity must use one of the following methods of procurement… (b) Simplified acquisition thresholds. The non-Federal entity is responsible for determining an appropriate simplified acquisition threshold based on internal controls, an evaluation of risk and its documented procurement procedures which must not exceed the threshold established in the FAR. When applicable, a lower simplified acquisition threshold used by the non-Federal entity must be authorized or not prohibited under State, local, or tribal laws or regulations. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the simplified acquisitions procurement method of the Procurement and Suspension and Debarment compliance requirement. Cause: The School Corporation's management noted that the vendor they chose to work with was one they could rely on to deliver high quality products on time. Management stated that during the years under audit, they found it hard to find other vendors that had quality items in stock that they could count on to be delivered on time when they were needed. Effect: The failure to establish an effective internal control system enabled noncompliance with the grant agreement and the simplified acquisition procurement method of the Procurement and Suspension and Debarment compliance requirement. Questioned Costs: There were no questioned costs identified. Context: During the audit period, we tested two vendors that fell within the Small Purchase procurement threshold. Small purchases are those vendors that the School Corporation has purchased between $10,000 and $150,000 of products and goods from during the fiscal year. For one of the two vendors selected for testing, we noted the School Corporation did not obtain price or rate quotations from other vendors or document the basis for purchasing from the vendor that was utilized. The School Corporation had $134,542 and $117,589 of expenditures with the vendor for fiscal years 2023 and 2024, respectively. The School Corporation was not able to provide verification that the vendor is not suspended or debarred. The lack of controls and noncompliance occurred throughout the audit period. There were no other issues noted during the testing of Procurement and Suspension and Debarment. Identification as a repeat finding, if applicable: Yes. See finding 2022-001 in the prior audit report. Recommendation: We recommended that the School Corporation's management establish controls related to the grant agreement and the small purchase procurement method of the Procurement and Suspension and Debarment compliance requirement. Management should obtain multiple quotes, document rationale for vendor selection and perform suspension and debarment checks. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program AL Numbers: 10.553, 10.555 Federal Award Numbers and Years: FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Qualified Opinion Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR section 200.303 states in part: "The non-Federal entity must use one of the following methods of procurement… (b) Simplified acquisition thresholds. The non-Federal entity is responsible for determining an appropriate simplified acquisition threshold based on internal controls, an evaluation of risk and its documented procurement procedures which must not exceed the threshold established in the FAR. When applicable, a lower simplified acquisition threshold used by the non-Federal entity must be authorized or not prohibited under State, local, or tribal laws or regulations. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the simplified acquisitions procurement method of the Procurement and Suspension and Debarment compliance requirement. Cause: The School Corporation's management noted that the vendor they chose to work with was one they could rely on to deliver high quality products on time. Management stated that during the years under audit, they found it hard to find other vendors that had quality items in stock that they could count on to be delivered on time when they were needed. Effect: The failure to establish an effective internal control system enabled noncompliance with the grant agreement and the simplified acquisition procurement method of the Procurement and Suspension and Debarment compliance requirement. Questioned Costs: There were no questioned costs identified. Context: During the audit period, we tested two vendors that fell within the Small Purchase procurement threshold. Small purchases are those vendors that the School Corporation has purchased between $10,000 and $150,000 of products and goods from during the fiscal year. For one of the two vendors selected for testing, we noted the School Corporation did not obtain price or rate quotations from other vendors or document the basis for purchasing from the vendor that was utilized. The School Corporation had $134,542 and $117,589 of expenditures with the vendor for fiscal years 2023 and 2024, respectively. The School Corporation was not able to provide verification that the vendor is not suspended or debarred. The lack of controls and noncompliance occurred throughout the audit period. There were no other issues noted during the testing of Procurement and Suspension and Debarment. Identification as a repeat finding, if applicable: Yes. See finding 2022-001 in the prior audit report. Recommendation: We recommended that the School Corporation's management establish controls related to the grant agreement and the small purchase procurement method of the Procurement and Suspension and Debarment compliance requirement. Management should obtain multiple quotes, document rationale for vendor selection and perform suspension and debarment checks. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program AL Numbers: 10.553, 10.555 Federal Award Numbers and Years: FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Qualified Opinion Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR section 200.303 states in part: "The non-Federal entity must use one of the following methods of procurement… (b) Simplified acquisition thresholds. The non-Federal entity is responsible for determining an appropriate simplified acquisition threshold based on internal controls, an evaluation of risk and its documented procurement procedures which must not exceed the threshold established in the FAR. When applicable, a lower simplified acquisition threshold used by the non-Federal entity must be authorized or not prohibited under State, local, or tribal laws or regulations. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the simplified acquisitions procurement method of the Procurement and Suspension and Debarment compliance requirement. Cause: The School Corporation's management noted that the vendor they chose to work with was one they could rely on to deliver high quality products on time. Management stated that during the years under audit, they found it hard to find other vendors that had quality items in stock that they could count on to be delivered on time when they were needed. Effect: The failure to establish an effective internal control system enabled noncompliance with the grant agreement and the simplified acquisition procurement method of the Procurement and Suspension and Debarment compliance requirement. Questioned Costs: There were no questioned costs identified. Context: During the audit period, we tested two vendors that fell within the Small Purchase procurement threshold. Small purchases are those vendors that the School Corporation has purchased between $10,000 and $150,000 of products and goods from during the fiscal year. For one of the two vendors selected for testing, we noted the School Corporation did not obtain price or rate quotations from other vendors or document the basis for purchasing from the vendor that was utilized. The School Corporation had $134,542 and $117,589 of expenditures with the vendor for fiscal years 2023 and 2024, respectively. The School Corporation was not able to provide verification that the vendor is not suspended or debarred. The lack of controls and noncompliance occurred throughout the audit period. There were no other issues noted during the testing of Procurement and Suspension and Debarment. Identification as a repeat finding, if applicable: Yes. See finding 2022-001 in the prior audit report. Recommendation: We recommended that the School Corporation's management establish controls related to the grant agreement and the small purchase procurement method of the Procurement and Suspension and Debarment compliance requirement. Management should obtain multiple quotes, document rationale for vendor selection and perform suspension and debarment checks. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Information on the federal program: Subject: Education Stabilization Fund (ESSER) – Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 – Education Stabilization Fund Assistance Listing Number: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the ‘Internal Control Integrated Framework’, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 Financial reporting . . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program." Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirements. Cause: The School Corporation's management implemented a review control over the annual data reports, however, it was not sufficient enough to detect and prevent errors in annual data reports submitted to the Indiana Department of Education. Effect: Annual data reports submitted during the audit period to the Indiana Department of Education contained material errors compared to underlying transaction detail for the period reported. Questioned Costs: There were no questioned costs identified. Context: The School Corporation was required to submit Annual Data Reports to the Indiana Department of Education (IDOE) during the audit period to meet federal reporting requirements for ESSER grant awards. We noted that the ESSER II and ESSER III amounts reported on the Year 3 report ($288,565 and $115,716, respectively) did not agree to the underlying expenditure records ($139,081 and $88,437, respectively) for the period of July 1, 2022 through June 30, 2023. Additionally, the School Corporation was not able to provide any support for the 86 full-time equivalent (FTE) positions on September 30, 2022, reported on the Year 3 CrossAct report or the 110 full-time equivalent (FTE) positions on September 30, 2023, reported on the Year 4 CrossAct report. Identification as a repeat finding: No. Recommendation: We recommend management review internal controls over the review of annual data reports to ensure the data to be submitted agrees to underlying transaction detail or other supporting documentation prior to the submission of the annual data report. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Information on the federal program: Subject: Education Stabilization Fund (ESSER) – Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 – Education Stabilization Fund Assistance Listing Number: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the ‘Internal Control Integrated Framework’, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 Financial reporting . . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program." Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirements. Cause: The School Corporation's management implemented a review control over the annual data reports, however, it was not sufficient enough to detect and prevent errors in annual data reports submitted to the Indiana Department of Education. Effect: Annual data reports submitted during the audit period to the Indiana Department of Education contained material errors compared to underlying transaction detail for the period reported. Questioned Costs: There were no questioned costs identified. Context: The School Corporation was required to submit Annual Data Reports to the Indiana Department of Education (IDOE) during the audit period to meet federal reporting requirements for ESSER grant awards. We noted that the ESSER II and ESSER III amounts reported on the Year 3 report ($288,565 and $115,716, respectively) did not agree to the underlying expenditure records ($139,081 and $88,437, respectively) for the period of July 1, 2022 through June 30, 2023. Additionally, the School Corporation was not able to provide any support for the 86 full-time equivalent (FTE) positions on September 30, 2022, reported on the Year 3 CrossAct report or the 110 full-time equivalent (FTE) positions on September 30, 2023, reported on the Year 4 CrossAct report. Identification as a repeat finding: No. Recommendation: We recommend management review internal controls over the review of annual data reports to ensure the data to be submitted agrees to underlying transaction detail or other supporting documentation prior to the submission of the annual data report. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Reporting, Special Tests and Provisions - Nonprofit School Food Service Accounts Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and continual process. The process is based on fundamental principles that operate as a whole. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. INDIANA STATE BOARD OF ACCOUNTS 20 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Risk Assessment - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring - Reporting and Special Tests and Provisions - Nonprofit School Food Service Accounts The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Reporting The School Corporation's Food Service Director was solely responsible for submitting the Monthly Sponsor Claims for reimbursement. There was no evidence of an oversight, review, or approval process to ensure the accuracy and completeness of the reports prior to submission. Control Activities - Special Tests and Provisions - Nonprofit School Food Service Accounts The Treasurer was solely responsible for posting all revenues and expenditures of the nonprofit school food service program into the School Corporation's accounting software. There was no evidence of an oversight, review, or approval process to ensure that only activity of the nonprofit school food service program was posted to the food service account or to ensure that all reimbursements were correctly credited to the nonprofit school food service account. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Due to the small size of the School Corporation, there was often only one individual involved with various aspects of the federal program with limited opportunity for proper segregation of duties. Additionally, management has not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. INDIANA STATE BOARD OF ACCOUNTS 21 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Finally, reimbursement requests could be inaccurate when submitted and the activity of the school food service account could be incorrectly recorded leading to incorrect requests for reimbursement or other errors in reporting or management of the food service account. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure that reports for reimbursement are complete and accurate, and the activity of the school food service account is properly recorded. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10.556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Other Matters Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 22 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities A sample of 60 claims was selected for testing. Of the 60 claims selected for testing, 43 claims were vendor claims and 17 were payroll claims. Issues were identified with 5 of the vendor claims as noted below:  Three claims, totaling $700, were paid based solely upon summary statements from the vendor. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant.  Two claims, totaling $313, were paid with no supporting documentation. The School Corporation was unable to provide additional documentation, such as invoices, to detail what items or services had been purchased. Without adequate supporting documentation, we could not determine if the expenses incurred were for activities and costs allowable per the grant. The total amount, $1,013, paid without adequate supporting documentation was considered questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 23 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. . . . (g) Be adequately documented. . . ." 7 CFR 210.14(a) states in part: ". . . Revenues received by the nonprofit school food service are to be used only for the operation or improvement of such food service, except that, such revenues shall not be used to purchase land or buildings, unless otherwise approved by FNS, or to construct buildings. . . ." 7 CFR 220.7(e)(1)(ii) states in part: ". . . use all revenues received by such food service only for the operation or improvement of that food service . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not follow proper recordkeeping procedures. The Treasurer paid claims from federal program funds with no support or based on summary statements. INDIANA STATE BOARD OF ACCOUNTS 24 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, we could not determine if federal program funds were used to pay only for the operation or improvement of the food service. Furthermore, the lack of detailed documentation was not in compliance with the cost principles. Continued payment with no support or only summary statements could lead to payments for unallowable activities and additional questioned costs. Questioned Costs Questioned costs in the amount of $1,013 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards have appropriate supporting documentation to ensure expenditures are allowable per the terms and conditions of the federal award and adhere to the cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Child Nutrition Cluster - Procurement and Suspension and Debarment Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Special Milk Program for Children Assistance Listings Numbers: 10.553, 10.555, 10556 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 25 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities - Procurement The School Corporation made purchases from two and three vendors during fiscal years 2022- 2023 and 2023-2024, respectively, for which expenditures fell under the small purchase threshold. The School Corporation could not provide any documentation that the procurement method used was appropriate or that the procurements provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented. The School Corporation made purchases from five and four vendors during 2022-2023 and 2023-2024, respectively, for which expenditures fell under the micro-purchase threshold. The history of the procurement, including rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for any of the vendors. Control Activities - Suspension and Debarment The School Corporation utilized two vendors during 2022-2023 and 2023-2024 for which purchases throughout the year exceeded $25,000. The School Corporation was unable to provide any evidence that they verified that the vendors were not suspended or debarred from participation in federal programs. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 26 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318(a) states: "The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or service required under a federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standard identified in §§ 200.317 through 200.327." 2 CFR 200.320 states in part: "The non-Federal entity must have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (1) Micro-purchases — (i) Distribution. The acquisition of supplies or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (See the definition of micro-purchase in § 200.1). To the maximum extent practicable, the non-Federal entity should distribute micro-purchases equitably among qualified suppliers. (ii) Micro-purchase awards. Micro-purchases may be awarded without soliciting competitive price or rate quotations if the non-Federal entity considers the price to be reasonable based on research, experience, purchase history or other information and documents it files accordingly. Purchase cards can be used for micropurchases if procedures are documented and approved by the non-Federal entity. . . . (2) Small purchases — (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking the SAM.gov Exclusions, or (b) Collecting a certification from that person, or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the small size and location of the School Corporation were the determining factors when making purchasing decisions as many vendors will not service the School Corporation. Therefore, the School Corporation has used the same vendors for many years. As such, the School Corporation did not follow the proper procurement procedures to document the reason that competition was limited. Accordingly, the School Corporation also did not check the vendors' suspension and debarment status. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Furthermore, by not properly completing the procurement process the School Corporation could have overpaid goods or services. Additionally, the School Corporation could have made payment to a vendor that was suspended or debarred. Payments to a suspended or debarred vendor are unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Additionally, we recommend that the School Corporation's management verify applicable vendors are not suspended or debarred prior to making payment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Education Stabilization Fund - Internal Controls Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed Audit Finding: Material Weakness Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. The lack of controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 29 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: COVID-19 - Education Stabilization Fund - Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. INDIANA STATE BOARD OF ACCOUNTS 30 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was a participating member in The Exceptional Children's Cooperative (Cooperative) which provided special education services to students on behalf of the School Corporation. The School Corporation utilized $15,672 in program funds to pay for a portion of the School Corporation's required obligations to the Cooperative. This arrangement existed prior to the pandemic, and none of the obligations were related to responding to the pandemic. Additionally, the School Corporation used $12,000 in program funds to pay a retainer fee for information technology services on a contract that existed prior to the COVID-19 pandemic. The School Corporation also used $147,809 in program funds to pay the salary and benefits of a certified staff member who was employed prior to the pandemic and whose job duties were not related to responding to the pandemic. We consider the total of these payments, $175,481, to be questioned costs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 31 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) American Rescue Plan Act section 2001(e) states in part: "Uses of Funds. - A local education agency that receives funds under this section - . . . (2) shall use the remaining funds for any of the following: . . . (E) Coordination of preparedness and response efforts of local education agencies with State, local, Tribal, and territorial public health departments, and other relevant agencies, to improve coordinated responses among such entities to prevent, prepare for, and respond to coronavirus. . . . (G) Developing and implementing procedures and systems to improve the preparedness and response efforts of local educational agencies. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . (g) be adequately documented. . . ." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation's management had not developed a system of internal controls to ensure that expenditures paid from COVID-19 - Education Stabilization Funds were for costs allowed by the grant terms and conditions and in compliance with the allowable cost principles. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Without a proper system of internal controls in place that operated effectively, material noncompliance that resulted in questioned costs remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funds to the School Corporation. INDIANA STATE BOARD OF ACCOUNTS 32 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $175,481 were identified as noted in the Condition and Context. Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls to ensure expenditures made from federal awards are for cost allowed per the terms and conditions of the federal award and in compliance with the allowable cost principles. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425C, 84.425D, 84.425U, 84.425W Federal Award Numbers and Years (or Other Identifying Numbers): S425C200018, S425D210013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. With respect to federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and terms and conditions of the federal awards. Internal control is not one event or circumstance, but a dynamic and iterative process. The internal control process is based on fundamental principles that operate as a whole but are best understood when analyzed individually. The fundamental principles are related to five components of internal control which are as follows: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. If a component is not effective, or the components are not operating together in an integrated manner, then an internal control system cannot be effective. Deficiencies as noted below were identified in the risk assessment, monitoring, and control activities components. Risk Assessment The School Corporation has not established a formal risk assessment process. There is no documented risk assessment policy, nor is there evidence of periodic risk identification, analysis, or evaluation. INDIANA STATE BOARD OF ACCOUNTS 33 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Monitoring The School Corporation did not conduct ongoing or periodic reviews to ensure that internal controls were operating as intended and to identify areas for improvement. Furthermore, the School Corporation did not have a process to follow up on corrective actions written as a response to audit findings. Control Activities The School Corporation was required to submit annual data reports to the Indiana Department of Education via JotForm, a form/report builder. Data to be submitted included, but was not limited to, current period expenditures, prior period expenditures, and key line items such as "Number of Specific Positions Supported with ESSER Funds," "Allocation of ESSER funds . . . ," "LEA expenditures by ESSER Subgrant fund . . . ," and "Full-Time Equivalency Positions." As part of sound management of the federal award, the School Corporation was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The School Corporation had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. During the audit period, the School Corporation submitted one ESSER I report, two ESSER II reports, two ESSER III reports, and one ARP HCY II Report, for a total of six reports. There was no evidence of an oversight, review, or approval process to prevent, or detect and correct, errors prior to submission. All six reports were selected for testing. Four of the reports were not supported by the School Corporation's records, and their accuracy and completeness could not be verified. The following errors were identified:  The ESSER II, Year 2 and Year 3 reports, which covered the periods of July 1, 2021 to June 30, 2022, and July 1, 2022 to June 30, 2023, respectively, Key Line Items were not able to be traced to supporting documentation. For both reports, the supplies line item could not be traced to the School Corporation's records. For ESSER II, Year 3, the School Corporation reported Other Purchased Services, but the School Corporation's supporting documentation did not include any items that would be classified as such.  The ESSER III, Year 2 report, which covered the period of July 1, 2021 to June 30, 2022, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported the purchase of Chromebooks as Purchased Property Services, which was not the appropriate classification for the expenditure.  The ESSER III, Year 3 report, which covered the period of July 1, 2022 to June 30, 2023, Key Line Items were not able to be traced to supporting documentation. The School Corporation reported amounts related to Purchased Property Services and Personnel Services - Salaries that were not supported by the School Corporation's records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 34 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program. . . ." 34 CFR 76.731 states: "A State and a subgrantee shall keep records to show its compliance with program requirements." Cause Management of the School Corporation had not taken steps to design and implement policies and procedures to assess risks facing the School Corporation or to establish and operate monitoring activities that monitor the internal control system. Additionally, the School Corporation did not act upon its corrective action plan submitted in response to the same finding included in the prior audit and did not take further steps to ensure compliance. Effect As a result of the five components of internal control not being adequately designed and implemented, the internal control system cannot be effective. Thus, general risks or specific risks from fraud and significant changes could negatively impact the School Corporation, identified internal control deficiencies could continue, and unidentified flaws within the internal control system could exist. Additionally, due to a lack of review and segregation of duties, the School Corporation submitted ESSER II and ESSER III reports that were not supported by the School Corporation's records. As a result, material noncompliance occurred and remained undetected. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 35 CANNELTON CITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the School Corporation's management establish a proper system of internal controls, which would include policies and procedures related to risk assessment and monitoring. Additionally, we recommended that the School Corporation's management establish a proper system of internal controls and strengthen its policies and procedures to ensure all reports submitted are accurate. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.