Findings Citing § 200.303

Finding 2025‐005 – Cash Management Information on the federal program: Federal awarding agency: United States Department of Education (ED) Federal program: Student Financial Assistance Cluster: Federal Direct Student Loans, Assistance Listing No. 84.268 Award years: 2024‐2025 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Cash Management Program Requirements for Direct Loans – Monthly Reconciliations Schools participating in the Direct Loan program are required to perform monthly Direct Loan reconciliations (34 CFR 685.300(b)(5)). Electronic Announcements DL-22-07 and GENERAL-22-86 explain that a school must reconcile the funds it received from G5 with actual disbursement records the school submitted to COD. Each month, COD sends the school a School Account Statement, which is ED’s official record of the school’s cash and disbursement records and identifies the difference between the net draws from G5 and the actual disbursement information reported to COD by the school. The school is required to account for any differences by reconciling ED’s records (School Account Statements) with the school’s financial and business records. Condition: The University did not provide evidence that the School Account Statements (SAS) from ED were used to reconcile to the University’s financial and business records on a monthly basis during the year ended May 31, 2025. Cause: The University did not have effective internal controls and procedures in place to ensure the use of SAS in monthly reconciliations. The University indicated that they used SAS in their monthly reconciliations; however, they did not retain evidence that the SAS was used, including accounting for differences between SAS and the University’s financial and business records. Effect or potential effect: Lack of external monthly reconciliations between the University’s records and SAS could result in incorrect data in the University’s records and ED systems and cash management and disbursement reporting timelines not being met. Questioned costs: $0 Context: While the University provided evidence of internal daily reconciliations, the University did not provide evidence that they utilized SAS for monthly reconciliations, as required. Total Student Financial Assistance Cluster expenditures for the year ended May 31, 2025, were $138,008,610, of which $118,404,580 were for Direct Loans. Identification as a repeat finding, if applicable: Yes – 2023-003 Recommendation: The University should review and revise its internal controls and procedures surrounding the monthly reconciliations to SAS and retain evidence of such reconciliations, including SAS. Views of responsible officials: Management agrees with the finding and has developed a corrective action plan in which the Office of Financial Assistance will maintain evidence of monthly reconciliations between SAS and the University’s financial and business records. The corrective action was implemented by February 1, 2026.

Finding 2025‐006 Procurement and Suspension and Debarment Information on the federal program: Federal awarding agency: United States Department of Education (ED) Federal program: School Safely National Activities, Assistance Listing No. 84.184X Award year: 2024‐2025 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.318 (i) General Procurement Standards states, “the non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price.” Condition: The University did not maintain records for procurements sufficient to detail the history of the procurement, including the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Cause: The University did not have effective internal controls and procedures in place to ensure the University maintained records for procurements sufficient to detail the history of the procurement, including the rationale for the method of procurement and other required elements. Effect or potential effect: The University did not comply with the general procurement standards per the Uniform Guidance to maintain sufficient detail of the history of the procurement, including the rationale of the method of procurement. The University also did not retain evidence of internal controls related to approval of procurements. The performance of internal controls, including approval documentation of the procurement, is necessary to ensure compliance with federal procurement requirements. Questioned costs: $167,398 – Questioned costs were calculated based on the amount of two procurements for which the history of the procurement, including the rationale of the procurement method, was not documented ($73,980 plus $93,418). Context: We issued a material weakness related to internal control over compliance with procurement requirements in the prior year. Based upon the implementation date for the corrective action of May 31, 2025, provided by management, the finding related to this internal control had not been remediated for the period under audit. As such, we did not test the operating effectiveness of this internal control and are issuing a material weakness consistent with the prior year finding. We selected and tested the two procurements in the population over $10,000 with expenditures totaling $167,398 for the year ended May 31, 2025 for the School Safely National Activities program. For these procurements of an occupational therapist contractor ($73,980) and another vendor for supplies and materials ($93,418), the University did not obtain quotes or document sole source justification or the history of the procurement, including the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. We consider the expenditures related to these procurements to be questioned costs due to lack of supporting documentation for the procurement, as noted above. The University’s total School Safely National Activities program expenditures were $1,310,305 for the year ended May 31, 2025. Of this amount, $262,030 related to procurements of goods and services during the year, of which 2 procurements were over $10,000. Identification as a repeat finding, if applicable: Yes – 2024-004; 2023-004 Recommendation: The University should retain written documentation for procurements, documenting the history of the procurement prior to the procurement of goods or services including, but not limited to, the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. The University should also retain evidence of internal controls, including approval documentation of the procurement, performed prior to entering into procurements. Views of responsible officials: Management agrees with the finding and has developed a corrective action plan in which the University will document the methodology used to select sole source or preferred vendor procurements through completion of the Sole Source/Preferred Vendor Justification Form. The corrective action will be implemented by March 1, 2026.

Finding 2025‐007 Procurement and Suspension and Debarment Information on the federal program: Federal awarding agency: United States Department of Education (ED) Federal program: School Safely National Activities, Assistance Listing No. 84.184X Award year: 2024‐2025 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In accordance with 2 CFR part 180 non-federal entities are prohibited from contracting with, or making subawards to parties that are suspended or debarred, or otherwise excluded. “Covered transactions” include contracts for goods and services awarded under a non-procurement transaction that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220. When a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA) and available at SAM.gov | Home (click on Search Record, then click on Advanced Search-Exclusions) (Note: The OMB guidance at 2 CFR Part 180 and agency implementing regulations still refer to the SAM Exclusions as the Excluded Parties List System (EPLS)), (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). Condition: The University did not have evidence that the University performed suspension and debarment checks for contractors on SAM.gov prior to entering into the contracts. Cause: The University either did not perform and/or retain evidence of checks for suspension and debarment for contractors. The University does not have a clear written policy or effective internal control over compliance with suspension and debarment requirements. Effect or potential effect: The University did not comply with suspension and debarment requirements. Without having effective internal controls over suspension and debarment, procurements could be entered into with a suspended or debarred entity. Questioned costs: $167,398 – Questioned costs were calculated based on the amount of two procurements for which no check for suspension or debarment was made for the vendors ($73,980 plus $93,418). Context: We issued a material weakness related to internal control over compliance with suspension and debarment requirements in the prior year. Based upon the implementation dates for the corrective action of February 24, 2025 and May 31, 2025, provided by management, the finding related to this internal control had not been remediated for the period under audit. As such, we did not test the operating effectiveness of this internal control and are issuing a material weakness consistent with the prior year finding. We selected and tested 2 procurements over $25,000 each with expenditures totaling $167,398, for the year ended May 31, 2025 for the School Safely National Activities program. The procurements were for an occupational therapist contractor ($73,980) and another vendor of supplies and materials ($93,418). The University had no evidence of suspension and debarment checks being performed prior to entering into the procurements. The University’s total School Safely National Activities program expenditures were $1,310,305 for the year ended May 31, 2025. Of this amount, $167,398 related to contracts or procurements of goods and services over $25,000. Identification as a repeat finding, if applicable: Yes – 2024-005 Recommendation: The University should develop and implement procedures and internal control to ensure that suspension and debarment requirements are complied with, and that support for the dates and the results of suspension and debarment checks on SAM.gov are retained. Also, the University should revise its procurement policy to include procedures for suspension and debarment. Views of responsible officials: Management agrees with the finding and has developed a corrective action plan which includes retention of documentation of suspension and debarment searches on SAM.gov and adding verbiage to contracts/purchase orders related to suspension and debarment. The corrective action was implemented by May 31, 2025.

Finding 2025-008 – Allowable Costs/Cost Principles and Matching, Level of Effort, and Earmarking Information on the federal program: Federal awarding agency: United States Department of Education (ED) Federal program: School Safely National Activities, Assistance Listing No. 84.184X Award year: 2024‐2025 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.430 (i) states “Standards for Documentation of Personnel Expenses (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflected the work performed. These records must: (i) be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) be incorporated into the official records of the non-Federal entity; (iii) reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) encompass both federal assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity’s written policy; (v) comply with the established accounting policies and practices of the non-Federal entity.” Condition: The University did not have effective internal controls over the timely preparation and approval of employees’ time and effort certifications. Cause: The University did not execute their internal controls for the timely preparation and approval of employees’ time and effort certifications on a timely basis. Effect or potential effect: Unallowable and/or inaccurate payroll expenditures could be charged to the federal program due to the delay in the preparation and approval of the time and effort certifications. Level of effort per grant award notification and grant proposal documents may not be met as required for the applicable employees with level of effort requirements, the program director/principal investigator and co-investigators, for the School Safely National Activities Program. Questioned costs: None. Context: It is the University’s policy to have time and effort certifications prepared and approved for grant employees on a semesterly basis. For 9 of 14 payroll expenditures selected for testing, the University’s employees prepared their time and effort certifications between 4 and 10 months after the applicable semester ended, with approvals made after that time. The grant documents provide for level of effort requirements for the program for five employees, including the program director/principal investigator with a level of effort of 25% and 4 co-investigators with level of effort of 2.5%. The University’s total School Safely National Activities program expenditures were $1,310,305 for the year ended May 31, 2025. Of this amount, $209,270 related to payroll expenditures, including fringe benefits. Identification of a repeat finding: Not applicable. Recommendation: We recommend the University execute its internal controls to provide for the preparation and approval of employees’ time and effort certifications on a timely basis after the end of each semester. Views of responsible officials: Management agrees with the finding and has developed a corrective action plan in which the University updated the time and effort reporting form and the Grants Accounting Office will ensure the forms are completed timely. The corrective action was implemented by February 6, 2026.

Finding 2025-003 Identification of the Federal Program: U.S. Department of Housing and Urban Development: AL 14.267 – Continuum of Care Program Compliance Requirement: Procurement, Suspension and Debarment Type of Finding: Significant deficiency in internal controls over compliance. Criteria 2 CFR 200.303(a) of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The nonfederal entity’s documented procurement procedures must conform to the procurement standards identified in 2 CFR 200.317 through 200.327. 2 CFR 200 Appendix II requires certain provisions be included in contracts if criteria are met. As outlined in 2 CFR 180, recipients must not utilize any contractor which is suspended or debarred or is otherwise excluded from the central contractor registry. Statement of condition and cause The Organization’s procurement policy did not include all the required elements as outlined in the Uniform Guidance. Additionally, the Organization did not retain documentation to support the procedures performed to ensure compliance with suspension and debarment requirements. Effect Lack of complete procurement, suspension, and debarment policies and not retaining documentation to support compliance with suspension and debarment requirements could result in noncompliance with the Uniform Guidance. Questioned Costs N/A Repeat Finding No Recommendation We recommend that management develop a written procurement policy that conforms with the Uniform Guidance. In addition, we recommend that management implement procedures and control processes to retain documentation supporting compliance with major federal program compliance requirements regarding suspension and debarment. Management response See Corrective Action Plan

Criteria: 2 CFR section 200.303 states in part: “The non-Federal entity must establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity in managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ‘Standards for Internal Control in the Federal Government’ issued by the Comptroller General of the United States or the ‘Internal Control Integrated Framework’, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: An effective internal control system was not in place to ensure compliance with requirements related to the grant agreement and the Cash Management compliance requirements. Cause: Management is not utilizing the Head Start financial information from the general ledger and accounting software when preparing Head Start draws. Information used for the draws is compiled separately and no reconciliation between draws and the financial system occurs. Effect: Expenditures charged to the Head Start programs could potentially not be included in the Head Start draws. Recommendation: Each Head Start draw should be compiled and reconciled back to the financial statement and then reviewed by a secondary fiscal department employee. Management’s Response: The Agency acknowledges this error and agrees with the recommendations. The Agency provides the additional context that it has been determined that where incorrect drawdowns were made - they were underdrawn, not overdrawn. No drawdowns were determined to include anything beyond known, justifiable, and allowable expenses. Previous T &TA support from the Office of Head Start and monitoring reviews from other fiscal agencies had not previously revealed this concern and recommendations were made to carry out drawdowns in this manner. The Finance department is actively working with the new recommendation from the auditors to use the accounting system (MIP) and to implement a new payroll and reconciliation procedure which will prevent future errors.

Criteria: 2 CFR section 200.303 states in part: “The non-Federal entity must establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity in managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ‘Standards for Internal Control in the Federal Government’ issued by the Comptroller General of the United States or the ‘Internal Control Integrated Framework’, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: An effective internal control system was not in place to ensure compliance with requirements related to the grant agreement and the Cash Management compliance requirements. Cause: Management is not utilizing the Head Start financial information from the general ledger and accounting software when preparing Head Start draws. Information used for the draws is compiled separately and no reconciliation between draws and the financial system occurs. Effect: Expenditures charged to the Head Start programs could potentially not be included in the Head Start draws. Recommendation: Each Head Start draw should be compiled and reconciled back to the financial statement and then reviewed by a secondary fiscal department employee. Management’s Response: The Agency acknowledges this error and agrees with the recommendations. The Agency provides the additional context that it has been determined that where incorrect drawdowns were made - they were underdrawn, not overdrawn. No drawdowns were determined to include anything beyond known, justifiable, and allowable expenses. Previous T &TA support from the Office of Head Start and monitoring reviews from other fiscal agencies had not previously revealed this concern and recommendations were made to carry out drawdowns in this manner. The Finance department is actively working with the new recommendation from the auditors to use the accounting system (MIP) and to implement a new payroll and reconciliation procedure which will prevent future errors.

Finding 2025-003 Identification of the Federal Program: U.S. Department of Housing and Urban Development: AL 14.267 – Continuum of Care Program Compliance Requirement: Procurement, Suspension and Debarment Type of Finding: Significant deficiency in internal controls over compliance. Criteria 2 CFR 200.303(a) of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The nonfederal entity’s documented procurement procedures must conform to the procurement standards identified in 2 CFR 200.317 through 200.327. 2 CFR 200 Appendix II requires certain provisions be included in contracts if criteria are met. As outlined in 2 CFR 180, recipients must not utilize any contractor which is suspended or debarred or is otherwise excluded from the central contractor registry. Statement of condition and cause The Organization’s procurement policy did not include all the required elements as outlined in the Uniform Guidance. Additionally, the Organization did not retain documentation to support the procedures performed to ensure compliance with suspension and debarment requirements. Effect Lack of complete procurement, suspension, and debarment policies and not retaining documentation to support compliance with suspension and debarment requirements could result in noncompliance with the Uniform Guidance. Questioned Costs N/A Repeat Finding No Recommendation We recommend that management develop a written procurement policy that conforms with the Uniform Guidance. In addition, we recommend that management implement procedures and control processes to retain documentation supporting compliance with major federal program compliance requirements regarding suspension and debarment. Management response See Corrective Action Plan

Criteria: 2 CFR section 200.303 states in part: “The non-Federal entity must establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity in managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ‘Standards for Internal Control in the Federal Government’ issued by the Comptroller General of the United States or the ‘Internal Control Integrated Framework’, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: An effective internal control system was not in place to ensure compliance with requirements related to the grant agreement and the Cash Management compliance requirements. Cause: Management is not utilizing the Head Start financial information from the general ledger and accounting software when preparing Head Start draws. Information used for the draws is compiled separately and no reconciliation between draws and the financial system occurs. Effect: Expenditures charged to the Head Start programs could potentially not be included in the Head Start draws. Recommendation: Each Head Start draw should be compiled and reconciled back to the financial statement and then reviewed by a secondary fiscal department employee. Management’s Response: The Agency acknowledges this error and agrees with the recommendations. The Agency provides the additional context that it has been determined that where incorrect drawdowns were made - they were underdrawn, not overdrawn. No drawdowns were determined to include anything beyond known, justifiable, and allowable expenses. Previous T &TA support from the Office of Head Start and monitoring reviews from other fiscal agencies had not previously revealed this concern and recommendations were made to carry out drawdowns in this manner. The Finance department is actively working with the new recommendation from the auditors to use the accounting system (MIP) and to implement a new payroll and reconciliation procedure which will prevent future errors.

Criteria: 2 CFR section 200.303 states in part: “The non-Federal entity must establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity in managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ‘Standards for Internal Control in the Federal Government’ issued by the Comptroller General of the United States or the ‘Internal Control Integrated Framework’, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: An effective internal control system was not in place to ensure compliance with requirements related to the grant agreement and the Cash Management compliance requirements. Cause: Management is not utilizing the Head Start financial information from the general ledger and accounting software when preparing Head Start draws. Information used for the draws is compiled separately and no reconciliation between draws and the financial system occurs. Effect: Expenditures charged to the Head Start programs could potentially not be included in the Head Start draws. Recommendation: Each Head Start draw should be compiled and reconciled back to the financial statement and then reviewed by a secondary fiscal department employee. Management’s Response: The Agency acknowledges this error and agrees with the recommendations. The Agency provides the additional context that it has been determined that where incorrect drawdowns were made - they were underdrawn, not overdrawn. No drawdowns were determined to include anything beyond known, justifiable, and allowable expenses. Previous T &TA support from the Office of Head Start and monitoring reviews from other fiscal agencies had not previously revealed this concern and recommendations were made to carry out drawdowns in this manner. The Finance department is actively working with the new recommendation from the auditors to use the accounting system (MIP) and to implement a new payroll and reconciliation procedure which will prevent future errors.

Assistance Listing, Federal Agency, and Program Name - 97.044, U.S. Department of Homeland Security, Assistance to Firefighters Grant Federal Award Identification Number and Year - N /A Pass through Entity - N/A Finding Type - Material weakness Repeat Finding - No Criteria - Per 2 CFR 200.303(a), the nonfederal entity must establish and maintain effective internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. These internal controls should be in compliance with the guidance in the "Standards for Internal Control in the Federal Government," issued by the Comptroller General of the United States, or the "Internal Control Integrated Framework," issued by the Committee of Sponsoring Organization of the Treadway Commission (COSO). Condition - The Township did not have the appropriate controls in place to ensure reports and reimbursement requests that were required to be submitted under the grant were complete and accurate as well as ensuring the matching requirement was properly reviewed. If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - N/A Identification of How Questioned Costs Were Computed - N/A Context - During testing of required reporting, as well as reimbursement requests submitted, it was noted that there was no evidence of supervisory reviews prior to submission of these documents. It was also noted there was no review in place over the matching requirment. Cause and Effect - The Township did not have the proper controls in place that lead to lack of appropriate reviews of reporting and requests for reimbursement could have resulted in instances of noncompliance. Recommendation - The Township should review its processes and controls in these areas to ensure that all reporting and reimbursement requests are appropriately reviewed. Views of Responsible Officials and Planned Corrective Actions - The Township agrees with the finding and will work to put controls in place to ensure reviews are performed appropriately.

2025-002 - Lack of Written Federal Program Policies. Type: Material Weakness. Condition: The Village does not have documented policies and procedures specific to the administration of the Coronavirus State and Local Fiscal Recovery Funds program. This includes the absence of written guidance on key compliance areas such as payments, procurement, allowability of costs charged to federal programs, compensation, and travel costs under Uniform Guidance. Criteria: Per 2 CFR 200.303 and 200.331 of the Uniform Guidance, non-federal entities are required to establish and maintain effective internal controls and written policies to ensure compliance with federal statutes, regulations, and the terms and conditions of federal awards. These policies should be tailored to the specific requirements of each federal program. Cause: The entity has not developed formal written policies and procedures for the Coronavirus State and Local Fiscal Recovery Funds program, possibly due to reliance on informal practices or general administrative policies that do not address federal-specific requirements. Effect: Without documented policies, there is an increased risk of noncompliance with federal requirements, inconsistent program administration, and lack of accountability. This may result in questioned costs, audit findings, or potential repayment of federal funds. Recommendation: We recommend that the Village develop and implement written policies and procedures specific to the Coronavirus State and Local Fiscal Recovery Funds program. These should include: - Payments in accordance with §200.302 (6), - Procurement in accordance with §200.318, - Allowability of costs charged to federal programs in accordance with §200.302 (7), - Compensation in accordance with §200.430 and §200.431, - Travel costs in accordance with §200.474. Training should also be provided to staff responsible for administering the program to ensure consistent application of these policies. Views of Responsible Officials: Management acknowledges the auditor’s finding regarding the absence of formally documented federal program policies. We recognize the importance of maintaining written procedures to ensure consistent compliance with Uniform Guidance requirements and to strengthen internal controls over federal awards. While informal practices have historically guided our federal program administration, we agree that formalizing these policies will enhance transparency, accountability, and operational efficiency. Management is currently in the process of developing written policies covering key areas such as procurement, allowable costs, subrecipient monitoring, and cash management. We anticipate completing this documentation and implementing the policies by February 28, 2026. We are committed to continuous improvement and appreciate the auditor’s recommendations as part of our efforts to maintain strong compliance and stewardship of federal funds.

Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Project-Based Rental Assistance Assistance Listing Number: 14.195 Federal Award Identification Number and Year: 121EH007 Pass-Through Agency: N/A Award Period: April 1, 2024, to March 31, 2025 Compliance Requirement Affected: Eligibility Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: According to §200.303 Internal Controls of 2 CFR Part 200, the non‐Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non‐Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Income thresholds, on HUD-50059 tenant recertification forms, were not properly updated to the applicable period, using available income limits published by HUD for the County of Santa Cruz. Questioned costs: None noted. Context: A nonstatistical sample of 12 out of 100 tenant files were selected for testing for the Section 8 Housing Assistance Payments Program. The discrepancy, in the maximum income limit, was identified during the auditor's testing of tenant eligibility to participate in the affordable housing program. Cause: Management oversight on properly updating the income limit thresholds. Effect: Noncompliance results in possible exclusion of eligible applicants as the income limits increased from the income limits used. Repeat Finding: Yes Recommendation: We recommend that the organization review the changes in income limits published by HUD during the tenant certification and recertification process in order to properly update income limits accordingly on form HUD-50059. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Project-Based Rental Assistance Assistance Listing Number: 14.195 Federal Award Identification Number and Year: 121EH007 Pass-Through Agency: N/A Award Period: April 1, 2024, to March 31, 2025 Compliance Requirement Affected: Eligibility Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or speciic requirement: According to §200.303 Internal Controls of 2 CFR Part 200, the non‐Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non‐Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Initial certification and/or recertification HUD-50059 tenant eligibility forms lacked proper review by a management agent or an acting management agent. Questioned costs: None noted. Context: A nonstatistical sample of 12 out of 100 tenant files were selected for testing for the Section 8 Housing Assistance Payments Program. The lack of proper review of tenant certification and/or tenant recertification forms was identified during the auditor's testing of tenant eligibility. Cause: Lack of a management agent or acting management agent in place at the time of tenant certification or recertification. Effect: Noncompliance results in the potential for mathematical errors in accuracy of calculation of tenant rent portion or identification of proper income limit thresholds. Repeat Finding: Yes Recommendation: We recommend that the organization have a process in place for secondary review, of the HUD-50059 certification and recertification forms, by either a management agent or an acting management agent, in the absence of a management agent to check for mathematical accuracy of tenant rent calculation and for use of proper income thresholds. Views of responsible officials: There is no disagreement with the audit finding

Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Project-Based Rental Assistance Assistance Listing Number: 14.195 Federal Award Identification Number and Year: 121EH007 Pass-Through Agency: N/A Award Period: April 1, 2024, to March 31, 2025 Compliance Requirement Affected: Cash Management Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: According to §200.303 Internal Controls of 2 CFR Part 200, the non‐Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non‐Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: HUD Housing Assistance Payment forms lacked proper review by a management agent or an acting management agent. Questioned costs: None noted. Context: A nonstatistical sample of 3 out of 12 HUD Housing Assistance Payment forms were selected for testing for the Section 8 Housing Assistance Payments Program. The lack of proper review of HUD Housing Assistance Payment forms was identified during the auditor's testing of cash management. Cause: Lack of a management agent or acting management agent in place at the time of preparing HUD Housing Assistance Payment forms. Effect: Noncompliance results in the potential for mathematical errors in accuracy of calculation of request for payment on the HUD Housing Assistance Payment forms. Repeat Finding: Yes Recommendation: We recommend that the organization have a process in place for secondary review, of the HUD Housing Assistance Payment forms, by either a management agent or an acting management agent, in the absence of a management agent to check for mathematical accuracy of housing assistance payment request. Views of responsible officials: There is no disagreement with the audit finding.

Finding: 2025-001 Incomplete Tenant Records – Section 8 HCV Program (ALN 14.871) Condition: During our review of forty (40) tenant files under the Section 8 Housing Choice Voucher (HCV) Program, we identified multiple instances of missing documentation and compliance lapses: 1. For one (1) tenant, income verification was not performed for the current year, and prior year income was rolled forward. The HUD-50058 (Family Report) form was reviewed in the PIC system but was not present in the tenant file. 2. For one (1) tenant, the Approved Lease, HUD-52517 (Request for Tenancy Approval), and HUD- 52641 (HAP Contract) forms were not present in the tenant file. Criteria: Under 2 CFR § 200.303, non-Federal entities are required to “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Additionally, 2 CFR § 200.302(b)(3) mandates that entities “maintain records which adequately identify the source and application of funds provided for federally-assisted activities.” HUD regulations governing the Section 8 Housing Choice Voucher Program (ALN 14.871) further require that tenant files include complete and timely documentation of income verification, lease approvals, and execution of required HUD forms such as HUD-50058 (Family Report), HUD-52517 (Request for Tenancy Approval), and HUD-52641 (Housing Assistance Payments Contract). These documents are essential to support eligibility determinations and ensure accurate Housing Assistance Payments. Cause: The deficiencies appear to result from inconsistent implementation of file maintenance procedures and inadequate internal controls over documentation and compliance tracking. There may also be a lack of staff training or oversight regarding HUD documentation requirements. Effect: Incomplete tenant records compromise the Housing Authority’s ability to demonstrate compliance with HUD regulations and the proper use of Federal funds. Missing documentation such as income verification and executed lease agreements may result in eligibility determinations that cannot be substantiated, increasing the risk of noncompliance. These issues could lead to program findings, reputational harm, or future funding restrictions if not addressed. Questioned Costs: There were no determinable questioned costs identified during the review. While documentation gaps were noted, the absence of supporting records did not allow for a reliable calculation of financial impact. Recommendation: We recommend that the Housing Authority strengthen internal controls over tenant file documentation by implementing a standardized checklist to ensure all required forms and records are consistently retained. Staff should receive periodic training on HUD documentation and compliance requirements to reinforce expectations and reduce errors. Management should also conduct routine internal reviews to verify that income verification and lease documentation are properly completed and maintained. These measures will help ensure that tenant eligibility and payment determinations are adequately supported and compliant with federal regulations. Reply and Corrective Action: To address these findings, the Housing Authority will implement a standardized checklist for all tenant file changes, ensuring that all required forms and records are consistently retained. The Program Administrator and staff will conduct monthly reviews of completed reexaminations to verify that all necessary documentation is present and properly filed. All paperwork related to annual reexaminations, transfers, move-ins, and interims will be scanned into the Lindsey software system within five working days of receipt, prior to physical filing. The Program Administrator will organize monthly training sessions on HCV/S8 program requirements, with participation tracked to ensure all staff attend. Weekly spot checks will be performed to confirm that the checklist is being used appropriately. These actions will be supported by updated training materials, access to the Lindsey software, and dedicated staff time for audits and training. To mitigate risks such as incomplete documentation, missed scanning deadlines, or low training attendance, the Housing Authority will implement pre-audit checklists, set automated reminders for staff, and make training mandatory. Management will monitor the implementation of these corrective actions and conduct follow-up reviews to ensure sustained compliance with HUD regulations.

Assistance Listing, Federal Agency, and Program Name - 14.905; U.S. Department of Housing and Urban Development; Lead Hazard Reduction Demonstration Program Federal Award Identification Number and Year - 252697 Pass through Entity - City of Chicago Department of Public Health Finding Type - Material weakness and material noncompliance with laws and regulations Repeat Finding - No Criteria - 2 CFR 200.303(a) states each recipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition - The Organization did not review period end reimbursement requests for costs that had been expended and requested in prior months. The lack of proper review resulted in the Organization charging duplicate costs of $95,294. Questioned Costs - $95,294 Identification of How Questioned Costs Were Computed - During the period under audit there were two period-end reimbursement requests. Such requests include expenditures from the entire grant period (January 1, 2024 December 31, 2024). Expenditures on the two reimbursement requests were compared in their entirety to expenditures on reimbursement requests earlier in the year. Management determined there were total duplicate costs of $95,294. Context - Of the 25 expenditures tested for allowable costs, two contractor samples were charged in the period-end reimbursement request and in a previous reimbursement request. Subsequently the Organization evaluated the costs charged to the grant and identified contractor invoices in the amount of $95,294 that were erroneously charged to the grant and reported on the schedule of expenditures of federal awards. Cause and Effect - Timely and accurate review over period-end reimbursement requests was not performed and duplicate costs were requested for reimbursement. Recommendation - The Organization should establish formalized review processes and controls to ensure proper identification of expenditures that have been submitted for reimbursement. Views of Responsible Officials and Corrective Action Plan - The Organization agrees with recommendation. Beginning May 1, 2025, the CFO maintains a payout tracker which is updated every time a vendor payout is made and tracks that payment to the reimbursement request and the final payment by the pass-through agency. This process ensures that a payout is not included in a payout request multiple times. The Staff Accountant also maintains a tracker of all reimbursement requests to track with the program budgets and for inclusion in the MIP accounting system. In addition, new personnel are involved in the process with a more formal approval and authorization process implemented. The Organization’s staff has communicated these duplicate requests to the appropriate personnel at the granting agency and are coordinating the repayment of the excess funds as determined by the granting agency.

2025-001 - Internal Control over Compliance and Compliance with Subrecipient Monitoring Requirements Information on the Federal Program: United States Department of Treasury Assistance Listing Number: 21.027 Assistance Listing Name: Coronavirus State and Local Fiscal Recovery Fund Pass-Through Entity: Prince George’s Country Maryland Pass-Through Entity Number: 52-6000-998 Award Period: February 28, 2024 through June 30, 2025 Criteria– In accordance with §200.303(a), Internal Controls, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §180.300, Suspension and Debarment, non-federal entities cannot enter into awards, subawards, or contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Non-federal entities must either check for exclusions in the System for Award Management (SAM); collect a certification from the entity, or add a clause or condition to the covered transaction with the entity prior to entering into a covered transaction with a non-federal entity. In addition, in accordance with §180.415(b), non-federal entities cannot renew or extend covered transactions (other than no-cost time extension) with any excluded person, or under which an excluded person is a principal, unless the non-federal entity obtains an exception under §180.135. 2 CFR §200.332(b), Requirements for pass-through entities, indicates that pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and that the subaward document includes the best available information provided within 2 CFR §200.332(b)(1). Condition – During our testing of the two subrecipients under this program, we noted that management did not determine whether the subrecipients were suspended or debarred prior to entering into the agreement with the subrecipients or when the subaward agreements were amended. Additionally, the agreements between The Community Foundation and the subrecipients did not contain certain key information, such as the assistance listing number, as required by 2 CFR §200.332(b)(1). Context – During our review of The Community Foundation’s compliance with the Uniform Guidance requirements, we noted that there were two subrecipients under the applicable federal program. Both subrecipients were selected for testing, resulting in a 100% examination rather than a sample-based approach. Upon identification of compliance errors, management subsequently verified the status of the subrecipients in the System for Award Management (“SAM”) to confirm that neither was suspended nor debarred. We reviewed supporting documentation from SAM and confirmed that both subrecipients were not suspended or debarred. Following the audit procedures, which identified missing data elements required by 2 CFR §200.332(b)(1), management issued communications to each subrecipient, providing the relevant information that had initially been omitted from the subaward agreements. Cause - The Community Foundation’s policies include requirements to determine whether vendors/subrecipients are suspended are debarred when working on Federal programs. The individuals executing the agreements between The Community Foundation and the two subrecipients did not properly follow the procurement policy with respect to checks for suspension and debarment. In addition, the individuals executing the agreements with the two subrecipients did not properly review the regulations and did not identify the need to include the information in 2 CFR §200.332(b)(1). Effect or Potential Effect - The lack of adherence to the established internal control policies and procedures can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements which could ultimately lead to disallowed costs for the major federal program. Questioned Costs - There are no questioned costs. Repeat Finding - This is not a repeat finding from prior year. Recommendation - We recommend that The Community Foundation ensure consistent adherence to its policies and procedures. Given that federal funding is not received on a recurring basis, certain policies and procedures may become outdated. We further recommend that, upon receipt of federal funding in the future, management designate an individual with appropriate knowledge and experience to review applicable federal regulations and update policies and procedures as necessary to maintain compliance. Views of Responsible Officials – Management agrees with the finding and has implemented corrective actions, including verifying subrecipients’ eligibility in SAM.gov before awarding or amending federal subawards, updating subaward templates to meet federal requirements, and revising procurement and cash management policies for compliance. The Controller will act as Compliance Coordinator for future federal funding, overseeing regulation review, staff training, and quarterly compliance checks, with any deficiencies reported to the CFO for prompt resolution. These measures aim to ensure ongoing adherence to federal grant requirements.

2025-001 Misappropriation of Funds Material Weakness in Internal Control Condition: Subsequent to the close of the fiscal year, the Authority was notified by its banking institution of potentially fraudulent activity involving disbursements made to a company owned by an employee of the Authority. Upon investigation, management determined that the employee, who had access to the Authority’s check issuance process, directed $155,706 in payments to an entity they owned and controlled. These payments were not for legitimate goods or services. The disbursements were charged across multiple accounts, including both federal and non-federal program expenditures. The federal program expenditures were charged to the Public and Indian Housing program. Context: The fraudulent activity was identified by the Authority’s bank through transaction monitoring and reported to management. The employee was subsequently terminated, criminally charged, and has pled guilty. The Authority is seeking restitution; however, specific repayment terms have not yet been finalized as of the date of this report. Criteria: Under 2 CFR 200.303, the Authority must establish and maintain effective internal controls over federal awards that provide reasonable assurance of compliance with federal statutes, regulations, and the terms and conditions of the awards. 2 CFR 200.403 requires that costs charged to federal awards be necessary, reasonable, and allocable. Additionally, 24 CFR 990.108 limits Public Housing Operating Fund expenditures to eligible operating expenses necessary for the operation of public housing. Payments made to a company owned by an employee for which no goods or services were received do not meet these allowability requirements. Cause: The Authority did not maintain adequate segregation of duties or sufficient monitoring controls over the vendor setup, invoice processing, and check issuance functions. Specifically, one individual had authority to create vendors, approve invoices, and issue checks without independent review or secondary approval. At the time the fraud occurred, disbursement activity was not subject to an independent secondary review of the overall check run, including the listing of payees and amounts, which could have identified payments issued to an unauthorized or fictitious vendor. Effect: Unauthorized payments totaling $155,706 were made over the nineteen-month period, resulting in a misstatement of both federal and non-federal expenditures. As a result, certain federal program costs were unallowable under 2 CFR 200.403 and 24 CFR 990.108. These expenditures include $115,850 of questioned costs charged to the Public and Indian Housing program during the fiscal year. Auditor’s Recommendations: The Authority should strengthen internal controls over the accounts payable and disbursement process by segregating duties between vendor setup, invoice approval, and check issuance; implementing a dual-approval process for new vendors and all check disbursements; conduct independent reviews of payment reports; and review all expenditures charged to federal programs to identify and reimburse any unallowable costs. Management Response: See Corrective Action Plan.

Federal Agency: United States Department of Education Federal Program: Rehabilitation Services – Vocational Rehabilitation Grants to States (84.126) Federal Award Numbers: H126A220048 (OCFS), H126A230048 (OCFS), H126A240048 (OCFS), H126A250048 (OCFS) Federal Award Years: 2022, 2023, 2024, 2025 State Agency: Office of Children and Family Services Reference: 2025-001 Criteria Reporting RSA 911, Case Service Report (RSA 911) (OMB PRA No. 1820 0508). The RSA 911 is a set of data elements that state Vocational Rehabilitation (VR) agencies must submit to the Office of Children and Family Services. The data elements obtained from state VR agency service records and case management systems document the application for and/or provision of VR services to individuals with disabilities, including program outcomes and demographic information. The RSA 911 data set instructions are available at https://rsa.ed.gov/sites/default/files/subregulatory/pd 19 03.pdf. Key Line Items – Supporting documentation must be included in the service record or case management system for the data elements listed below. Dates reported in the case management system must match the supporting documentation. The following data elements contain critical information: 1. Date of Application (element 7) 2. Date of Eligibility Determination (element 38) 3. Date of Initial Individualized Plan for Employment (IPE) (element 398) 4. Start Date of Employment in Primary Occupation (element 350) 5. Employment Outcome at Exit (element 356) 6. Date of Exit (element 353) 7. Hourly Wage at Exit (element 359) Internal Controls 2 CFR 200.303(a) states the non federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of Children and Family Services (OCFS) did not maintain complete and accurate data with the quarterly submissions of the RSA 911 report. A sample of 40 cases was selected from the department. For each case, the seven key line items were tested to verify the data reported in the case management system matched supporting documentation. The list below summarizes the key line elements the department could not provide supporting documentation or discrepancies were noted as follows: • Date of Application (Element 7) – Three cases where no signed application could be provided to support the date that the underlying application was received as reported on the RSA 911. • Date of Initial IPE (Element 398) – One case where no signed IPE could be provided to support the date of initial IPE reported on the RSA 911. Cause The condition is due to deficiencies in the review process, which failed to correctly evidence proper review of the supporting documentation via signature of the application and IPE as required for the RSA 911 reporting. The imprecise review process led to reporting deficiencies. Possible Asserted Effect Failure to perform proper review of the data recorded in the case management system prior to the submission of the RSA 911 report can result in incorrect data elements of the seven key line items noted for the Case Service Report. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Recommendation We recommend OCFS to ensure its review process of the underlying cases operates at a precision necessary to identify incorrect data to ensure complete and accurate data is submitted on the RSA 911 reports. This will help mitigate the risk of reporting deficiencies and ensure the reliability of the data used for decision making and program evaluations. View of Responsible Officials Recommendation accepted. Please refer to corrective action plan.

Federal Agency: United States Department of Education Federal Program: Rehabilitation Services – Vocational Rehabilitation Grants to States (84.126) Federal Award Numbers: H126A220047 (SED), H126A230047(SED), H126A240047 (SED), H126A250047 (SED) Federal Award Years: 2022, 2023, 2024, 2025 State Agency: State Education Department Reference: 2025-002 Criteria Reporting RSA 911, Case Service Report (RSA 911) (OMB PRA No. 1820 0508). The RSA 911 is a set of data elements that state Vocational Rehabilitation (VR) agencies must submit to the United States Department of Education. The data elements obtained from state VR agency service records and case management systems document the application for and/or provision of VR services to individuals with disabilities, including program outcomes and demographic information. The RSA 911 data set instructions are available at https://rsa.ed.gov/sites/default/files/subregulatory/pd 19 03.pdf. Key Line Items – Supporting documentation must be included in the service record or case management system for the data elements listed below. Dates reported in the case management system must match the supporting documentation. The following data elements contain critical information: 1. Date of Application (element 7) 2. Date of Eligibility Determination (element 38) 3. Date of Initial Individualized Plan for Employment (IPE) (element 398) 4. Start Date of Employment in Primary Occupation (element 350) 5. Employment Outcome at Exit (element 356) 6. Date of Exit (element 353) 7. Hourly Wage at Exit (element 359) Internal Controls 2 CFR 200.303(a) states the non federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The State Education Department (SED) did not maintain complete and accurate data with the quarterly submissions of the RSA 911 report. A sample of 60 cases was selected from the department. For each case, the seven key line items were tested to verify the data reported in the case management system matched supporting documentation. The list below summarizes the key line elements the department could not provide supporting documentation or discrepancies were noted as follows: • Date of Application (Element 7) – Two cases where no documentation could be provided to support the date that the underlying application was received as reported on the RSA 911. • Date of Initial IPE (Element 398) – One case where the date of Initial IPE reported in the RSA 911 did not agree to the date on the underlying IPE. Cause The condition is due to deficiencies in the input and review process, which failed to correctly input information per the supporting documentation required for the RSA 911 report. The imprecise review process led to reporting deficiencies. Possible Asserted Effect Failure to perform proper review of the data recorded in the case management system prior to the submission of the RSA 911 report can result in incorrect data elements of the seven key line items noted for the Case Service Report. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2024 Single Audit Report as finding number 2024 004 at pages 25 27. Recommendation We recommend SED to ensure its review process of the underlying cases operates at a precision necessary to identify incorrect data to ensure complete and accurate data is submitted on the RSA 911 reports. This will help mitigate the risk of reporting deficiencies and ensure the reliability of the data used for decision making and program evaluations. View of Responsible Officials Recommendation accepted. Please refer to corrective action plan.

Federal Agency: United States Department of Education Federal Program: Rehabilitation Services – Vocational Rehabilitation Grants to States (84.126) Federal Award Numbers: H126A220047 (SED), H126A230047(SED), H126A240047 (SED), H126A250047 (SED) Federal Award Years: 2022, 2023, 2024, 2025 State Agency: State Education Department Reference: 2025-003 Criteria Period of Performance Under section 111(a)(1) of the Rehabilitation Act, the Department pays to each state each federal fiscal year an amount equal to the federal share of the cost of providing VR services and administering the VR program. Consistent with the definition of “period of performance” at 2 CFR section 200.1 and the requirements governing information that must be contained in a Grant Award Notification (GAN) at 2 CFR section 200.211, the VR GAN specifies the beginning and end dates for each VR grant award. Therefore, state VR agencies may incur obligations or make expenditures under a grant award if they are incurred during the period of performance for that award. Any obligations or expenditures incurred outside of that period of performance would need to be paid with funds available from a different VR grant award. Internal Controls 2 CFR 200.303(a) states the non federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The State Education Department (SED) did not maintain complete data along with the supporting documentation for the period of performance. A sample of 60 transactions was selected from SED records. For each case, an invoice, pay period, and/or manual journal entries were tested to verify the data reported in the NYGR0302 report. It was also checked to ensure that the disbursement was properly reviewed, approved, and that the selected amount met the requirement of an allowable activity incurred during the period of performance and liquidated within the required time period. During our review of fiscal year 2025 transactions, we identified that 4 out of the 60 sampled transactions occurred outside the designated period of performance. The grant award period ended on September 30, 2024, with a liquidation period extending 120 days beyond that date, until January 28, 2025. Specifically, for grant number H126A230047, these four services were incurred in either October or November 2024, which is after the designated period of performance. This indicates a significant lapse in the controls governing the timing of obligations and expenditures related to VR grant funds. Cause The condition related to a deficiency in the operation of the review process not occurring at a precision necessary to identify missing information during the review that is required to be in compliance with the grant’s period of performance. Possible Asserted Effect The identified issue of a transaction occurring outside the period of performance and being liquidated beyond the required liquidation period could have significant implications for SED. This non compliance with federal regulations may result in financial penalties, reduced future funding, and potential repayment of misused funds. Questioned Costs $23,190 (representing the 4 transactions found to have occurred outside the specified period of performance. The population amounted to $117,470,987, of which sixty, totaling $2,948,245, were selected for test work.) Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was identified in the 2024 Single Audit Report as finding number 2024-003 at pages 23-24. Recommendation We recommend SED implement a new control mechanism for reviewing funds before distribution. This control should include a pre distribution review process with a dedicated team or staff verifying the period of performance for each VR grant award, ensuring all obligations and expenditures fall within the specified dates. Additionally, an automated system or manual control is recommended to be developed or enhanced to flag any transactions outside the period of performance or liquidation period. View of Responsible Officials Recommendation accepted. Please refer to corrective action plan.

Federal Agency: United States Department of Homeland Security Federal Program: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (97.036) Federal Award Numbers: 4480DRNYP00000001 and 4694DRNYP00000001 Federal Award Years: 2020, 2023 State Agency: Division of Homeland Security and Emergency Services Reference: 2025-012 Criteria Special Reporting for Federal Funding Accountability and Transparency Act In accordance with the FEMA PA Program Policy Guide, the Federal Funding Accountability and Transparency Act (FFATA) requires that FEMA manage and administer awards in a manner so as to ensure that federal funding is expended and associated programs are implemented in full accordance with the U.S. Constitution, federal law, and public policy requirements. These requirements include, but are not limited to those protecting free speech, religious liberty, public welfare, the environment, and prohibiting discrimination. FEMA must communicate to recipients all relevant public policy requirements, including those in general appropriations provisions, and incorporate them either directly or by reference in the terms and conditions of the award. Recipients are responsible for complying with all requirements of the award. For all federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non federal entity at 2 C.F.R. Parts 25 and 170. FFATA requires recipients to register in the FFATA Subaward Reporting System and report on all awards and subawards equal to or greater than $30,000. Internal Controls Lastly, 2 CFR 200.303(a) states the non federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Homeland Security and Emergency Services (DHSES) did not timely report awards granted to subrecipients for the Disaster Assistance – Public Assistance program as summarized in the table below during the period April 2024 through March 2025 as required by FFATA. FFATA reporting should be made in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract award modification was made. DHSES does not have sufficient internal controls in place to verify the data being reported/entered into the FFATA report to the underlying subaward source documents to ensure the completeness and accuracy of the data being reported. Cause The condition found was due to inadequate tracking of subaward reports, which led to the omission of one subaward amendment and the late reporting of two subawards. For the incorrect subaward amounts, from review of SAM.gov it appeared that DHSES reported subaward amendments as new awards for the total cumulative obligations, including previous obligation versions that had already been reported, rather than as edits to existing subaward reports within SAM.gov as indicated in the guidance provided by SAM.gov. This led to the over reporting of subaward obligations for the selected subaward. Management communicated and provided internal email support that the noncompliance concerning the incorrect subaward amounts stemmed from errors that occurred as a result of the system transition from FSRS to SAM.gov. Possible Asserted Effect The failure to timely report subawards and inaccuracies in the reported amounts resulted in noncompliance with FFATA requirements. This noncompliance could lead to increased scrutiny from federal agencies and potential penalties or corrective actions imposed on DHSES. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Recommendation We recommend DHSES review and enhance its procedures, tracking mechanisms, and internal controls to ensure that all amounts passed through to subrecipients under subawards are reported timely and accurately in accordance with the FFATA federal regulations to prevent future occurrences. View of Responsible Officials Recommendation accepted. Please refer to corrective action plan.

2025-001: Applicant Provided the Incorrect Amount of LIHEAP Award. Assistance Listing Number: 93.568 Name of Federal Agency: Department of Health and Human Services Program Title: LIHEAP Compliance Requirement: Eligibility Pass-through Entity: Florida Department of Commerce Federal Grant/Contract Number and Grant Year E1991 2023 Finding Type: Significant Deficiency in Internal Control Questioned Costs: $3,577 Condition: Application for assistance under the LIHEAP program was approved for an amount which did not agree to the amount applicable for the applicant’s income and age per the Low-Income Home Energy Assistance Program Payment Matrix as provided by the Florida Department of Commerce. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The required eligibility determinations should be performed and the individual determined to be eligible in accordance with the compliance requirements of the program and the HHS Poverty Guidelines and State Medium Income Estimates. Cause: Human error in the calculation of the amount the individual was eligible for under the program that was not caught during the review and approval process. Effect: Providing incorrect funding to applicants may result in the loss of funding under the program. Prevalence: For a sample of 25 individuals provided LIHEAP benefits during fiscal year 2025, one participant was found to have been given an incorrect amount based on the Matrix provided by the Florida Department of Commerce resulting in an additional amount awarded of $100. Not a repeat finding and not found to be a systemic issue. Recommendation: Continued review of the calculations for amounts to be provided for applicants to ensure they meet the amounts determined under the Matrix provided by the Florida Department of Commerce.

Finding 2025-003: Allowable Activities and Costs – Internal Control and Compliance Deficiencies (Noncompliance and Significant Deficiency) Criteria: Per 2 CFR 200.303 and 2 CFR 200.403, non-federal entities must establish and maintain effective internal controls over federal awards and ensure that costs charged to federal programs are allowable, properly documented, and in accordance with the terms and conditions of the grant. Condition: During our testing of grant expenditures, we identified the following deficiencies related to allowable activities and costs: - None of the invoices and request forms tested had sign-offs showing review and approval before the grant packet was submitted to the state for reimbursement. - - Indirect costs are required to be calculated at 10% of each invoice per the grant agreement. However, invoice packets 15 and 23 did not have indirect costs calculated at the required rate. For payroll costs, proper supporting documentation was not provided. Cause: The deficiencies noted were due to a lack of established procedures to ensure all grant-related expenditures are properly reviewed, authorized, and supported prior to submission for reimbursement. In some cases, staff turnover and oversight contributed to the errors. Effect: Failure to maintain adequate internal controls and documentation over grant expenditures increases the risk of unallowable costs being charged to the grant, noncompliance with grant terms, and potential disallowance of costs by the granting agency. Recommendation: We recommend the entity implement procedures to ensure that all grant request packets are reviewed and approved by appropriate personnel prior to submission, that indirect costs are accurately calculated in accordance with grant terms, and that all payroll costs are supported by appropriate documentation such as timesheets. Additionally, all amounts billed should be reconciled to supporting documentation before submission. Management’s Response: We will establish and maintain effective internal controls over federal awards and ensure that costs charged to federal programs are allowable, properly documented, and in accordance with the terms and conditions of the grant.

Finding 2025-004: Eligibility – Inadequate Review and Documentation of Tutor Timesheets (Noncompliance and Material Weakness) Criteria: Per the grant contract and 2 CFR 200.303, the entity must maintain effective internal controls to ensure that only eligible costs are charged to the grant. The contract specifically requires that tutor timesheets be reviewed and signed by the site coordinator and director, with an additional review by the grant coordinator, prior to submission for payment. Condition: During our testing of tutor payroll, we noted that none of the tutor timesheets tested had received the required signatures from the grant coordinator and/or grant director. Additionally, 104 timesheets were missing from the population tested. Cause: The lack of required signatures and missing timesheets resulted from insufficient procedures to ensure all timesheets are properly reviewed, authorized, and retained in accordance with grant requirements. Effect: Failure to obtain required approvals and maintain complete documentation increases the risk of ineligible or unsupported costs being charged to the grant, and may result in questioned costs or disallowance by the granting agency. Recommendation: We recommend the entity implement procedures to ensure all tutor timesheets are reviewed and signed by the site coordinator, grant coordinator, and director prior to submission to the finance department for payment. Additionally, all timesheets should be retained and available for audit. Management’s Response: We will maintain effective internal controls to ensure timesheets are reviewed and signed by site coordinators and director with an additional review by grant coordinator with initials documented on timesheets prior to submission.

2025-003 - Lack of Written Federal Program Policies. Type: Material Weakness. Condition: The Village does not have documented policies and procedures specific to the administration of the Water and Waste Disposal for Rural Communities program. This includes the absence of written guidance on key compliance areas such as procurement, subrecipient monitoring, allowable costs, and reporting requirements under Uniform Guidance. Criteria: Per 2 CFR 200.303 and 200.331 of the Uniform Guidance, non-federal entities are required to establish and maintain effective internal controls and written policies to ensure compliance with federal statutes, regulations, and the terms and conditions of federal awards. These policies should be tailored to the specific requirements of each federal program. Cause: The entity has not developed formal written policies and procedures for the Water and Waste Disposal for Rural Communities program, possibly due to reliance on informal practices or general administrative policies that do not address federal-specific requirements. Effect: Without documented policies, there is an increased risk of noncompliance with federal requirements, inconsistent program administration, and lack of accountability. This may result in questioned costs, audit findings, or potential repayment of federal funds. Questioned Costs: n/a. Recommendation: We recommend that the Village develop and implement written policies and procedures specific to the Water and Waste Disposal Systems for Rural communities program. These should include: - Procurement standards in accordance with 2 CFR 200.318 – 200.327. - Subrecipient monitoring protocols. - Guidelines for allowable costs and cost principles. - Reporting and recordkeeping requirements. - Internal control procedures to ensure compliance. Training should also be provided to staff responsible for administering the program to ensure consistent application of these policies. Views of Responsible Officials: Management acknowledges the auditor’s finding regarding the absence of formally documented federal program policies. We recognize the importance of maintaining written procedures to ensure consistent compliance with Uniform Guidance requirements and to strengthen internal controls over federal awards. While informal practices have historically guided our federal program administration, we agree that formalizing these policies will enhance transparency, accountability, and operational efficiency. Management is currently in the process of developing written policies covering key areas such as procurement, allowable costs, subrecipient monitoring, and cash management. We anticipate completing this documentation and implementing the policies by February 28, 2026. We are committed to continuous improvement and appreciate the auditor’s recommendations as part of our efforts to maintain strong compliance and stewardship of federal funds.

Department of Homeland Security, State of Illinois Office of Emergency Management, Federal Financial Assistance Listing 97.036, 4728‐DR‐IL Disaster Grants – Public Assistance Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance Material Weakness in Internal Control over Compliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: Materials expenditures were claimed for reimbursement with no documented formal review and approval. Cause: The Cooperative did not retain documentation to support the review and approval over material costs claimed for reimbursement under the program. Effect: Without a formal documentation of review of expenses, demonstrating the expenditures comply with federal regulations is difficult. Questioned Costs: No questioned costs over $25,000. Context/Sampling: Nonstatistical sampling was used. Sample size was 60 transactions which accounted for $1,925,243 out of $2,310,004 of federal program expenditures of which $1,736,952 was submitted for reimbursement. Repeat Finding form Prior Year: No Recommendation: We recommend the Cooperative review the process for documenting the review and approval over material costs. Views of Responsible Officials: Management agrees with the finding.

2024-002. Failure to Maintain Accurate Accounting Records for Federal Awards Criteria: Title 2 U. S. Code of Federal Regulations (CFR) Section 200.303, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) requires the recipient of federal awards to establish and maintain internal control over federal awards that provide reasonable assurance that the recipient is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. One of the objectives of internal control over compliance is to ensure that federal transactions are properly recorded and accounted for in the accounting records in order to permit the preparation of reliable financial statements, including the Schedule of Expenditures of Federal Awards. Condition: Federal grant revenues in the amount of $270,907 were not properly recorded in the accounting records. Cause: Undetermined. Effect: Federal award transactions could be improperly reported in the financial statements and the Schedule of Expenditures of Federal Awards. Recommendation: All future federal grant revenue should be properly recorded in the accounting records.

Finding 2024-001: Rural Rental Housing Loans Assistance Listing Number: 10.415 U.S. Department of Agriculture Compliance Requirement: Eligibility Type of finding: Internal Control Over Compliance (significant deficiency) Criteria: The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards require that the non-Federal entity establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award (2 CFR 200.303(a)). Condition: The Organization did not implement a review or monitoring process to ensure propriety in eligibility determinations and tenant lease agreements for the period June 2024 – December 2024. Specifically, there was no review of eligibility determinations and tenant lease agreements for 8 of 12 tenant files reviewed. Cause: The Administrative Assistants took over completing all tenant eligibility determinations after the previous Executive Director retired in May 2024 resulting in a lack of separate review. Effect: Noncompliance with the Rural Rental Housing Loan requirements may exist and not be detected by the Organization. Recommendation: The Organization should strengthen its internal controls with adopted policies and procedures to ensure a review process is established through adequate segregation of duties. The Organization should consider assessing and realigning the duties and responsibilities of the Executive Director and Alamosa Administrative Assistant to provide for a review process of tenant eligibility determinations. Grantee’s Response: See corrective action plan.

Finding 2024-001: Rural Rental Housing Loans Assistance Listing Number: 10.415 U.S. Department of Agriculture Compliance Requirement: Eligibility Type of finding: Internal Control Over Compliance (significant deficiency) Criteria: The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards require that the non-Federal entity establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award (2 CFR 200.303(a)). Condition: The Organization did not implement a review or monitoring process to ensure propriety in eligibility determinations and tenant lease agreements for the period June 2024 – December 2024. Specifically, there was no review of eligibility determinations and tenant lease agreements for 8 of 12 tenant files reviewed. Cause: The Administrative Assistants took over completing all tenant eligibility determinations after the previous Executive Director retired in May 2024 resulting in a lack of separate review. Effect: Noncompliance with the Rural Rental Housing Loan requirements may exist and not be detected by the Organization. Recommendation: The Organization should strengthen its internal controls with adopted policies and procedures to ensure a review process is established through adequate segregation of duties. The Organization should consider assessing and realigning the duties and responsibilities of the Executive Director and Alamosa Administrative Assistant to provide for a review process of tenant eligibility determinations. Grantee’s Response: See corrective action plan.

Finding 2024-001: Rural Rental Housing Loans Assistance Listing Number: 10.415 U.S. Department of Agriculture Compliance Requirement: Eligibility Type of finding: Internal Control Over Compliance (significant deficiency) Criteria: The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards require that the non-Federal entity establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award (2 CFR 200.303(a)). Condition: The Organization did not implement a review or monitoring process to ensure propriety in eligibility determinations and tenant lease agreements for the period June 2024 – December 2024. Specifically, there was no review of eligibility determinations and tenant lease agreements for 8 of 12 tenant files reviewed. Cause: The Administrative Assistants took over completing all tenant eligibility determinations after the previous Executive Director retired in May 2024 resulting in a lack of separate review. Effect: Noncompliance with the Rural Rental Housing Loan requirements may exist and not be detected by the Organization. Recommendation: The Organization should strengthen its internal controls with adopted policies and procedures to ensure a review process is established through adequate segregation of duties. The Organization should consider assessing and realigning the duties and responsibilities of the Executive Director and Alamosa Administrative Assistant to provide for a review process of tenant eligibility determinations. Grantee’s Response: See corrective action plan.

Finding 2024-002: Lower Income Housing Assistance Program - Section 8 New Construction and Substantial Rehabilitation Assistance Listing Number: 14.182 U.S. Department of Housing and Urban Development (Repeat of Finding 2023-002 and 2022-002) Compliance Requirements: Cash Management, Eligibility, Reporting, Special Tests and Provisions Type of finding: Internal Control Over Compliance (significant deficiency) Criteria: The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards require that the non-Federal entity establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award (2 CFR 200.303(a)). Condition: The Organization has not implemented a review or monitoring process to ensure propriety in eligibility determinations, tenant lease agreements, housing assistance payment requests, and return of funds for vacant units and rent adjustments to contract rent included on the monthly Housing Assistance Payment vouchers. Cause: The compliance responsibilities of the Organization are performed by one person which has made it difficult to establish a proper review process over cash management, eligibility, reporting, and special tests and provisions requirements. Effect: Noncompliance with the Lower Income Housing Assistance Program - Section 8 New Construction and Substantial Rehabilitation requirements may exist and not be detected by the Organization. Recommendation: The Organization should strengthen its internal controls with adopted policies and procedures to ensure a review process is established through adequate segregation of duties. The Organization should consider assessing and realigning the duties and responsibilities of administrative staff allowing the administrator to act in a more supervisory position. Grantee’s Response: See corrective action plan.

2 CFR §2400.101 gives regulatory effect to the Department of Housing and Urban Development for 2 CFR §200.303(a) which states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Furthermore, 2 CFR §200.430(i)(1)(i) states "charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal controls which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. The “City of Columbus Fiscal Policies and Procedures for the Administration of HUD Grants Manual” Part II Section C – Standards for Documentation of Personal Services provides the following: All grant funded staff (both city staff and subrecipient staff) will utilize personal activity reports (timesheets). All timesheets will reflect total hours worked, identify the federal grant hours worked, and be signed by either the employee or the supervisor. Furthermore, the City of Columbus Department of Development has established a procedure of timesheet review which requires supervisors review employee timesheets within one week of the pay period end date. This review is evidenced by an electronic signature on the employee-completed timesheet.While the City does have an internal control policy in place in accordance with 2 CFR 430(i)(1)(i), supervisors were not always adhering to the policy which resulted in a deficiency in the application of the control process. During payroll control testing over AL #14.239 Home Investment Partnership Program, it was noted 3 out of the 5 selected worklogs (60%) were not signed by the supervisor within the one-week requirement as required by City policy. Supervisory sign offs occurred between 12 and 32 working days (not including weekends) following the end of the pay period.Failure to follow the established internal control policy and ensuring all time sheets are appropriately approved by a knowledgeable supervisor, within one week of the pay period end date, could result in unallowable costs being allocated to a federal program and could ultimately result in noncompliance and/or a questioned cost. The City should review established policies and procedures with supervisory personnel and evaluate if additional control procedures should be in place to ensure all timesheets are appropriately reviewed timely prior to allocation to a federal program.

2 CFR §2400.101 gives regulatory effect to the Department of Housing and Urban Development for 2 CFR §200.303(a) which states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Furthermore, 2 CFR §200.430(i)(1)(i) states "charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal controls which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. The “City of Columbus Fiscal Policies and Procedures for the Administration of HUD Grants Manual” Part II Section C – Standards for Documentation of Personal Services provides the following: All grant funded staff (both city staff and subrecipient staff) will utilize personal activity reports (timesheets). All timesheets will reflect total hours worked, identify the federal grant hours worked, and be signed by either the employee or the supervisor. Furthermore, the City of Columbus Department of Development has established a procedure of timesheet review which requires supervisors review employee timesheets within one week of the pay period end date. This review is evidenced by an electronic signature on the employee-completed timesheet.While the City does have an internal control policy in place in accordance with 2 CFR 430(i)(1)(i), supervisors were not always adhering to the policy which resulted in a deficiency in the application of the control process. During payroll control testing over AL #14.239 Home Investment Partnership Program, it was noted 3 out of the 5 selected worklogs (60%) were not signed by the supervisor within the one-week requirement as required by City policy. Supervisory sign offs occurred between 12 and 32 working days (not including weekends) following the end of the pay period.Failure to follow the established internal control policy and ensuring all time sheets are appropriately approved by a knowledgeable supervisor, within one week of the pay period end date, could result in unallowable costs being allocated to a federal program and could ultimately result in noncompliance and/or a questioned cost. The City should review established policies and procedures with supervisory personnel and evaluate if additional control procedures should be in place to ensure all timesheets are appropriately reviewed timely prior to allocation to a federal program.

2 CFR §2400.101 gives regulatory effect to the Department of Housing and Urban Development for 2 CFR §200.303(a) which states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Furthermore, 2 CFR §200.430(i)(1)(i) states "charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal controls which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. The “City of Columbus Fiscal Policies and Procedures for the Administration of HUD Grants Manual” Part II Section C – Standards for Documentation of Personal Services provides the following: All grant funded staff (both city staff and subrecipient staff) will utilize personal activity reports (timesheets). All timesheets will reflect total hours worked, identify the federal grant hours worked, and be signed by either the employee or the supervisor. Furthermore, the City of Columbus Department of Development has established a procedure of timesheet review which requires supervisors review employee timesheets within one week of the pay period end date. This review is evidenced by an electronic signature on the employee-completed timesheet.While the City does have an internal control policy in place in accordance with 2 CFR 430(i)(1)(i), supervisors were not always adhering to the policy which resulted in a deficiency in the application of the control process. During payroll control testing over AL #14.239 Home Investment Partnership Program, it was noted 3 out of the 5 selected worklogs (60%) were not signed by the supervisor within the one-week requirement as required by City policy. Supervisory sign offs occurred between 12 and 32 working days (not including weekends) following the end of the pay period.Failure to follow the established internal control policy and ensuring all time sheets are appropriately approved by a knowledgeable supervisor, within one week of the pay period end date, could result in unallowable costs being allocated to a federal program and could ultimately result in noncompliance and/or a questioned cost. The City should review established policies and procedures with supervisory personnel and evaluate if additional control procedures should be in place to ensure all timesheets are appropriately reviewed timely prior to allocation to a federal program.

2 CFR §2400.101 gives regulatory effect to the Department of Housing and Urban Development for 2 CFR §200.303(a) which states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Furthermore, 2 CFR §200.430(i)(1)(i) states "charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal controls which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. The “City of Columbus Fiscal Policies and Procedures for the Administration of HUD Grants Manual” Part II Section C – Standards for Documentation of Personal Services provides the following: All grant funded staff (both city staff and subrecipient staff) will utilize personal activity reports (timesheets). All timesheets will reflect total hours worked, identify the federal grant hours worked, and be signed by either the employee or the supervisor. Furthermore, the City of Columbus Department of Development has established a procedure of timesheet review which requires supervisors review employee timesheets within one week of the pay period end date. This review is evidenced by an electronic signature on the employee-completed timesheet.While the City does have an internal control policy in place in accordance with 2 CFR 430(i)(1)(i), supervisors were not always adhering to the policy which resulted in a deficiency in the application of the control process. During payroll control testing over AL #14.239 Home Investment Partnership Program, it was noted 3 out of the 5 selected worklogs (60%) were not signed by the supervisor within the one-week requirement as required by City policy. Supervisory sign offs occurred between 12 and 32 working days (not including weekends) following the end of the pay period.Failure to follow the established internal control policy and ensuring all time sheets are appropriately approved by a knowledgeable supervisor, within one week of the pay period end date, could result in unallowable costs being allocated to a federal program and could ultimately result in noncompliance and/or a questioned cost. The City should review established policies and procedures with supervisory personnel and evaluate if additional control procedures should be in place to ensure all timesheets are appropriately reviewed timely prior to allocation to a federal program.

2 CFR §2400.101 gives regulatory effect to the Department of Housing and Urban Development for 2 CFR §200.303(a) which states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Furthermore, 2 CFR §200.430(i)(1)(i) states "charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal controls which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. The “City of Columbus Fiscal Policies and Procedures for the Administration of HUD Grants Manual” Part II Section C – Standards for Documentation of Personal Services provides the following: All grant funded staff (both city staff and subrecipient staff) will utilize personal activity reports (timesheets). All timesheets will reflect total hours worked, identify the federal grant hours worked, and be signed by either the employee or the supervisor. Furthermore, the City of Columbus Department of Development has established a procedure of timesheet review which requires supervisors review employee timesheets within one week of the pay period end date. This review is evidenced by an electronic signature on the employee-completed timesheet.While the City does have an internal control policy in place in accordance with 2 CFR 430(i)(1)(i), supervisors were not always adhering to the policy which resulted in a deficiency in the application of the control process. During payroll control testing over AL #14.239 Home Investment Partnership Program, it was noted 3 out of the 5 selected worklogs (60%) were not signed by the supervisor within the one-week requirement as required by City policy. Supervisory sign offs occurred between 12 and 32 working days (not including weekends) following the end of the pay period.Failure to follow the established internal control policy and ensuring all time sheets are appropriately approved by a knowledgeable supervisor, within one week of the pay period end date, could result in unallowable costs being allocated to a federal program and could ultimately result in noncompliance and/or a questioned cost. The City should review established policies and procedures with supervisory personnel and evaluate if additional control procedures should be in place to ensure all timesheets are appropriately reviewed timely prior to allocation to a federal program.

2 CFR §2400.101 gives regulatory effect to the Department of Housing and Urban Development for 2 CFR §200.303(a) which states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Furthermore, 2 CFR §200.430(i)(1)(i) states "charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal controls which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. The “City of Columbus Fiscal Policies and Procedures for the Administration of HUD Grants Manual” Part II Section C – Standards for Documentation of Personal Services provides the following: All grant funded staff (both city staff and subrecipient staff) will utilize personal activity reports (timesheets). All timesheets will reflect total hours worked, identify the federal grant hours worked, and be signed by either the employee or the supervisor. Furthermore, the City of Columbus Department of Development has established a procedure of timesheet review which requires supervisors review employee timesheets within one week of the pay period end date. This review is evidenced by an electronic signature on the employee-completed timesheet.While the City does have an internal control policy in place in accordance with 2 CFR 430(i)(1)(i), supervisors were not always adhering to the policy which resulted in a deficiency in the application of the control process. During payroll control testing over AL #14.239 Home Investment Partnership Program, it was noted 3 out of the 5 selected worklogs (60%) were not signed by the supervisor within the one-week requirement as required by City policy. Supervisory sign offs occurred between 12 and 32 working days (not including weekends) following the end of the pay period.Failure to follow the established internal control policy and ensuring all time sheets are appropriately approved by a knowledgeable supervisor, within one week of the pay period end date, could result in unallowable costs being allocated to a federal program and could ultimately result in noncompliance and/or a questioned cost. The City should review established policies and procedures with supervisory personnel and evaluate if additional control procedures should be in place to ensure all timesheets are appropriately reviewed timely prior to allocation to a federal program.

2 CFR §2400.101 gives regulatory effect to the Department of Housing and Urban Development for 2 CFR §200.303(a) which states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Furthermore, 2 CFR §200.430(i)(1)(i) states "charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal controls which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. The “City of Columbus Fiscal Policies and Procedures for the Administration of HUD Grants Manual” Part II Section C – Standards for Documentation of Personal Services provides the following: All grant funded staff (both city staff and subrecipient staff) will utilize personal activity reports (timesheets). All timesheets will reflect total hours worked, identify the federal grant hours worked, and be signed by either the employee or the supervisor. Furthermore, the City of Columbus Department of Development has established a procedure of timesheet review which requires supervisors review employee timesheets within one week of the pay period end date. This review is evidenced by an electronic signature on the employee-completed timesheet.While the City does have an internal control policy in place in accordance with 2 CFR 430(i)(1)(i), supervisors were not always adhering to the policy which resulted in a deficiency in the application of the control process. During payroll control testing over AL #14.239 Home Investment Partnership Program, it was noted 3 out of the 5 selected worklogs (60%) were not signed by the supervisor within the one-week requirement as required by City policy. Supervisory sign offs occurred between 12 and 32 working days (not including weekends) following the end of the pay period.Failure to follow the established internal control policy and ensuring all time sheets are appropriately approved by a knowledgeable supervisor, within one week of the pay period end date, could result in unallowable costs being allocated to a federal program and could ultimately result in noncompliance and/or a questioned cost. The City should review established policies and procedures with supervisory personnel and evaluate if additional control procedures should be in place to ensure all timesheets are appropriately reviewed timely prior to allocation to a federal program.

2 CFR §2400.101 gives regulatory effect to the Department of Housing and Urban Development for 2 CFR §200.303(a) which states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Furthermore, 2 CFR §200.430(i)(1)(i) states "charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal controls which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. The “City of Columbus Fiscal Policies and Procedures for the Administration of HUD Grants Manual” Part II Section C – Standards for Documentation of Personal Services provides the following: All grant funded staff (both city staff and subrecipient staff) will utilize personal activity reports (timesheets). All timesheets will reflect total hours worked, identify the federal grant hours worked, and be signed by either the employee or the supervisor. Furthermore, the City of Columbus Department of Development has established a procedure of timesheet review which requires supervisors review employee timesheets within one week of the pay period end date. This review is evidenced by an electronic signature on the employee-completed timesheet.While the City does have an internal control policy in place in accordance with 2 CFR 430(i)(1)(i), supervisors were not always adhering to the policy which resulted in a deficiency in the application of the control process. During payroll control testing over AL #14.239 Home Investment Partnership Program, it was noted 3 out of the 5 selected worklogs (60%) were not signed by the supervisor within the one-week requirement as required by City policy. Supervisory sign offs occurred between 12 and 32 working days (not including weekends) following the end of the pay period.Failure to follow the established internal control policy and ensuring all time sheets are appropriately approved by a knowledgeable supervisor, within one week of the pay period end date, could result in unallowable costs being allocated to a federal program and could ultimately result in noncompliance and/or a questioned cost. The City should review established policies and procedures with supervisory personnel and evaluate if additional control procedures should be in place to ensure all timesheets are appropriately reviewed timely prior to allocation to a federal program.

2 CFR §2400.101 gives regulatory effect to the Department of Housing and Urban Development for 2 CFR §200.303(a) which states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Furthermore, 2 CFR §200.430(i)(1)(i) states "charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal controls which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. The “City of Columbus Fiscal Policies and Procedures for the Administration of HUD Grants Manual” Part II Section C – Standards for Documentation of Personal Services provides the following: All grant funded staff (both city staff and subrecipient staff) will utilize personal activity reports (timesheets). All timesheets will reflect total hours worked, identify the federal grant hours worked, and be signed by either the employee or the supervisor. Furthermore, the City of Columbus Department of Development has established a procedure of timesheet review which requires supervisors review employee timesheets within one week of the pay period end date. This review is evidenced by an electronic signature on the employee-completed timesheet.While the City does have an internal control policy in place in accordance with 2 CFR 430(i)(1)(i), supervisors were not always adhering to the policy which resulted in a deficiency in the application of the control process. During payroll control testing over AL #14.239 Home Investment Partnership Program, it was noted 3 out of the 5 selected worklogs (60%) were not signed by the supervisor within the one-week requirement as required by City policy. Supervisory sign offs occurred between 12 and 32 working days (not including weekends) following the end of the pay period.Failure to follow the established internal control policy and ensuring all time sheets are appropriately approved by a knowledgeable supervisor, within one week of the pay period end date, could result in unallowable costs being allocated to a federal program and could ultimately result in noncompliance and/or a questioned cost. The City should review established policies and procedures with supervisory personnel and evaluate if additional control procedures should be in place to ensure all timesheets are appropriately reviewed timely prior to allocation to a federal program.

2024-001 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds – Assistance Listing No. 21.027 Significant Deficiency in Internal Control Over Compliance – Appropriate Internal Control Structure Related to Compliance Requirements I. Procurement and Suspension and Debarment Criteria: 2 CFR 200.303 includes requirements related to internal controls for federal award programs, including that CICP must, among other things, “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)”. Condition and Context: We noted CICP did not complete their procurement checklist timely for one specific vendor, in accordance with their written policies. The procurement checklist is CICP’s key control for monitoring procurement and suspension and debarment of vendors. The vendor relationship was an existing relationship, but the vendor had not previously been used for any activities related to federal awards. CICP had other written documentation which provided evidence they followed their procurement process; however, no written documentation was maintained indicating suspension or debarment was reviewed prior to using the vendor for activities related to the federal award. Cause and Effect: Not completing the procurement checklist timely could result in noncompliance related to procurement and suspension and debarment. Recommendation: We recommend the procurement checklist be completed in line with the written policies of CICP. Views of Responsible Officials and Planned Corrective Action: CICP agrees with the recommendation and it was implemented effective 2/14/2025.

Finding 2024-005 – Internal Controls over Federal Awards (Significant Deficiency and Noncompliance)( Repeat finding) Information on the Federal Program: U.S. Department of Justice, Assistance Listing No.16.575 Victims of Crime Act (VOCA) Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal control over the Federal awards that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: We selected 50 disbursements for testing. Of those 50, 25 were for payroll and 25 were non-payroll disbursements. Of the 25 non-payroll, 4 lacked documentation of approval for payment.Cause: The Organization did not properly document controls established in its accounting manual to review and approve expenses charged to the grant. Effect: The Organization did not obtain proper approvals according to the policy of established controls. Questioned costs: None Recommendation: We recommend the Organization strengthen its policies and procedures surrounding disbursement and allocation processes to document the review and approval process to meet the control standards. Views of Responsible Officials: Management agrees with this finding. See Management’s View and Corrective Action Plan included at the end of the report.

Finding 2024-001 Reporting Criteria: Pursuant to 2 CFR section 200.303(a), the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Revolving Loan Fund (RLF) recipients must administer RLFs in accordance with an RLF Plan approved by EDA. Pursuant to 13 CFR 307.14 (a) All RLF Recipients, including those receiving Recapitalization Grants for existing RLFs, must complete and submit an RLF report, using Form ED-209, in a format and at a frequency as required by EDA. Pursuant to 13 CFR 307.14 (b) All RLF Recipients must certify as part of the RLF report to EDA that the RLF is operating in accordance with the applicable RLF Plan and that the information provided is complete and accurate. Condition: There were no adequate internal controls to identify and correct material misstatements in key line items in the Form ED-209, Revolving Loan Fund Financial Report (report) for the Legacy or Cares Revolving Loan Funds or submit the reports timely. The key line items contain critical information and should reconcile to the Authority's financial documents and account balances. Cause: The current internal control system in place was not adequate to ensure: loan reporting procedures were followed in accordance with the RLF Plan approved by the EDA. Effect: The reports do not contain accurate information. This is a repeat finding of 2023-001. Recommendation: We have the following recommendations: 1) the Authority should implement procedures to ensure that the RLF program is administered in accordance with the plan approved by the EDA, 2) the Authority should implement procedures to ensure that required reports are reviewed for accuracy prior to being submitted by the due date. View of Responsible Official: Management agrees with the finding. See separate corrective action plan.

Finding 2024-001 Reporting Criteria: Pursuant to 2 CFR section 200.303(a), the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Revolving Loan Fund (RLF) recipients must administer RLFs in accordance with an RLF Plan approved by EDA. Pursuant to 13 CFR 307.14 (a) All RLF Recipients, including those receiving Recapitalization Grants for existing RLFs, must complete and submit an RLF report, using Form ED-209, in a format and at a frequency as required by EDA. Pursuant to 13 CFR 307.14 (b) All RLF Recipients must certify as part of the RLF report to EDA that the RLF is operating in accordance with the applicable RLF Plan and that the information provided is complete and accurate. Condition: There were no adequate internal controls to identify and correct material misstatements in key line items in the Form ED-209, Revolving Loan Fund Financial Report (report) for the Legacy or Cares Revolving Loan Funds or submit the reports timely. The key line items contain critical information and should reconcile to the Authority's financial documents and account balances. Cause: The current internal control system in place was not adequate to ensure: loan reporting procedures were followed in accordance with the RLF Plan approved by the EDA. Effect: The reports do not contain accurate information. This is a repeat finding of 2023-001. Recommendation: We have the following recommendations: 1) the Authority should implement procedures to ensure that the RLF program is administered in accordance with the plan approved by the EDA, 2) the Authority should implement procedures to ensure that required reports are reviewed for accuracy prior to being submitted by the due date. View of Responsible Official: Management agrees with the finding. See separate corrective action plan.

Finding 2024.001: Eligibility - Significant Deficiency Grantor: U.S. Department of Agriculture Federal Program Names: WIC Special Supplemental Nutrition Program for Women, Infants and Children Federal Assistance Listing Numbers: 10.557 Federal Award Identification Number and Year: 79194 - 2023, 76709 - 2023 and 88458 - 2024 Name of Pass-through Entity: Indiana State Department of Health Criteria In accordance with 2CFR 200.303(a), Internal Controls, a nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The specific eligibility requirements are unique to each federal program, in accordance with the terms and conditions of the Federal award pertaining to the program. Condition During our testing over eligibility requirements, we were unable to review sufficient documentation to support that benefit recipients were eligible for benefits. Cause The Center's internal controls over eligibility were not consistently followed to ensure the presence of documentation to support that all benefit recipients were eligible for benefits. Effect Lack of sufficient support over eligibility could result in ineligible individuals receiving benefits. Questioned Costs None. Context We selected 40 beneficiaries charged to the federal program to test compliance and controls over eligibility. Out of 40 individuals tested, we noted 4 instances where there was no documentation to support that the benefit recipients were eligible for benefits and the internal controls over eligibility were followed. Identification of Repeat Finding None. Recommendation We recommend that management provide training to those responsible for verifying eligibility to ensure that documentation and internal control over eligibility is maintained. Views of Responsible Officials Management agrees with the audit finding and will strengthen internal controls and accountability to correct the deficiency.

Department of Transportation Federal Financial Assistance Listing 20.106; Awards AIP3-46-0050-59, AIP3-46-0050-62, AIP3-46-0050-63, and AIP3-46-0050-64. COVID-19 Airport Improvement Program Reporting Material Weakness in Internal Control over Compliance; Material Noncompliance Criteria - 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal controls over the federal awards that provide assurance that the entity is managing the federal awards in compliance with federal statutes, regulations, and the conditions of the federal award. 2 CFR 200.327 and 2 CFR 200.328 require the auditee to collect financial information and monitor its activities under federal awards to assure compliance with applicable federal requirements and performance expectations are being achieved and report these items in accordance with the program requirements. Condition - The SF-425 annual report dated September 30, 2024, for award AIP3-46-0050-64 underreported the federal share of expenditures by $23,588, while the FAA Form 5100-127 annual report dated December 31, 2023, for all awards underreported the total capital expenditures and construction in progress by $2,729,962. Cause - The Authority does not have an internal control structure designed to ensure amounts reported on SF-425 and FAA Form 5100-127 reports are adequately reviewed and agree to underlying accounting records. Effect - Lack of compliance with designed internal controls over reporting could result in the Authority reporting incorrect or incomplete information. Questioned Costs - None reported. Context/Sampling - A nonstatistical sample of 7 reports out of 27 reports. Repeat Finding from Prior Year – Yes, prior year finding 2023-002 Recommendation - Management should determine and formalize reporting responsibilities between the Airport and the State and establish review processes to ensure that amounts included in SF-425 and FAA Form 5100-127 reports agree with the underlying accounting records. Views of Responsible Officials - Management agrees with the finding.

Department of Transportation Federal Financial Assistance Listing 20.106; Awards AIP3-46-0050-59, AIP3-46-0050-62, AIP3-46-0050-63, and AIP3-46-0050-64. COVID-19 Airport Improvement Program Reporting Material Weakness in Internal Control over Compliance; Material Noncompliance Criteria - 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal controls over the federal awards that provide assurance that the entity is managing the federal awards in compliance with federal statutes, regulations, and the conditions of the federal award. 2 CFR 200.327 and 2 CFR 200.328 require the auditee to collect financial information and monitor its activities under federal awards to assure compliance with applicable federal requirements and performance expectations are being achieved and report these items in accordance with the program requirements. Condition - The SF-425 annual report dated September 30, 2024, for award AIP3-46-0050-64 underreported the federal share of expenditures by $23,588, while the FAA Form 5100-127 annual report dated December 31, 2023, for all awards underreported the total capital expenditures and construction in progress by $2,729,962. Cause - The Authority does not have an internal control structure designed to ensure amounts reported on SF-425 and FAA Form 5100-127 reports are adequately reviewed and agree to underlying accounting records. Effect - Lack of compliance with designed internal controls over reporting could result in the Authority reporting incorrect or incomplete information. Questioned Costs - None reported. Context/Sampling - A nonstatistical sample of 7 reports out of 27 reports. Repeat Finding from Prior Year – Yes, prior year finding 2023-002 Recommendation - Management should determine and formalize reporting responsibilities between the Airport and the State and establish review processes to ensure that amounts included in SF-425 and FAA Form 5100-127 reports agree with the underlying accounting records. Views of Responsible Officials - Management agrees with the finding.

Department of Transportation Federal Financial Assistance Listing 20.106; Awards AIP3-46-0050-59, AIP3-46-0050-62, AIP3-46-0050-63, and AIP3-46-0050-64. COVID-19 Airport Improvement Program Reporting Material Weakness in Internal Control over Compliance; Material Noncompliance Criteria - 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal controls over the federal awards that provide assurance that the entity is managing the federal awards in compliance with federal statutes, regulations, and the conditions of the federal award. 2 CFR 200.327 and 2 CFR 200.328 require the auditee to collect financial information and monitor its activities under federal awards to assure compliance with applicable federal requirements and performance expectations are being achieved and report these items in accordance with the program requirements. Condition - The SF-425 annual report dated September 30, 2024, for award AIP3-46-0050-64 underreported the federal share of expenditures by $23,588, while the FAA Form 5100-127 annual report dated December 31, 2023, for all awards underreported the total capital expenditures and construction in progress by $2,729,962. Cause - The Authority does not have an internal control structure designed to ensure amounts reported on SF-425 and FAA Form 5100-127 reports are adequately reviewed and agree to underlying accounting records. Effect - Lack of compliance with designed internal controls over reporting could result in the Authority reporting incorrect or incomplete information. Questioned Costs - None reported. Context/Sampling - A nonstatistical sample of 7 reports out of 27 reports. Repeat Finding from Prior Year – Yes, prior year finding 2023-002 Recommendation - Management should determine and formalize reporting responsibilities between the Airport and the State and establish review processes to ensure that amounts included in SF-425 and FAA Form 5100-127 reports agree with the underlying accounting records. Views of Responsible Officials - Management agrees with the finding.