Findings Citing § 200.303

Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Foster Care Title IV-E State Administering Department: California Department of Social Services (CDSS) ALN: 93.658 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2501CAFOST; October 1, 2024- September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.302 – Financial management (b) The recipient's and subrecipient's financial management system must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements Chapter I – Office of Management and Budget Government-Wide Guidance for Federal Financial Assistance Part 170 – Reporting Subaward and Executive Compensation Information Subpart A – General § 170.105 Applicability (a) Applicability in general. This part applies to a Federal agency’s Federal financial assistance as defined in § 170.300. This part applies to all recipients and subrecipients of Federal awards who meet the reporting requirements of paragraph (c) of this section, unless exempt under Federal statute or by paragraph (d) of this section. Appendix A to Part 170—Award Term I. Reporting Subawards and Executive Compensation (a) Reporting of first-tier subawards — (1) Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. (2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act (FFATA) subaward reporting functionality (formerly FSRS and now reported through SAM.gov) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. (c) Reporting of total compensation of subrecipient executives — (1) Applicability. Unless a first-tier subrecipient is exempt as provided in paragraph (d) of this appendix, the recipient must report the executive total compensation of each of the subrecipient's five most highly compensated executives for the subrecipient's preceding completed fiscal year, if: (i) The total Federal funding authorized to date under the subaward equals or exceeds $30,000; (ii) In the subrecipient's preceding fiscal year, the subrecipient received: (A) 80 percent or more of its annual gross revenues from Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act; and, (B) $25,000,000 or more in annual gross revenues from Federal procurement contracts (and subcontracts), and Federal awards (and subawards) subject to the Transparency Act; and (iii) The public does not have access to information about the compensation of the executives through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986 after receiving this subaward. (To determine if the public has access to the compensation information, see the U.S. Security and Exchange Commission total compensation filings at http://www.sec.gov/answers/execomp.htm.) (2) Reporting Requirements. Subrecipients must report to the recipient their executive total compensation described in paragraph (c)(1) of this appendix. The recipient is required to submit this information to the FFATA subaward reporting functionality (formerly FSRS and now reported through SAM.gov) at http://www.fsrs.gov no later than the end of the month following the month in which the subaward was made. As of March 2025, this functionality has been migrated to SAM.gov, which now serves as the system of record for FFATA subaward reporting. Condition: Audit procedures included a review of the entire population of 58 FFATA subaward submissions for the Foster Care program reported in SAM.gov during the year ended June 30, 2025, and a comparison of those submissions to the related funding actions. Testing identified that all 58 subawards, representing 100 percent of the population, were reported after the required reporting deadline. Based on inquiry and review of supporting documentation, CDSS prepared and submitted the FFATA reporting file; however, certain submitted records were rejected by the reporting system and required correction and resubmission. Because the submission and review process was performed too close to the applicable reporting deadline, there was insufficient time to identify, resolve, and successfully resubmit the rejected records before the deadline. As a result, FFATA subaward information was not reported within the timeframe required by federal reporting requirements. The results of testing indicate that controls over FFATA reporting did not operate with sufficient precision to ensure submitted records were timely reviewed, validated, and accepted prior to applicable reporting deadlines. Accordingly, FFATA reporting was not consistently completed in a timely manner in accordance with federal requirements. Questioned costs: None Context: See “Condition.” Cause: CDSS did not maintain controls over the FFATA reporting process that operated with sufficient precision to ensure subaward submissions were completed, validated, and accepted before applicable federal reporting deadlines. Specifically, FFATA reports were submitted too near the reporting deadline to allow sufficient time to identify, investigate, and correct rejected submissions. In addition, CDSS did not have monitoring procedures to review submission status, follow up on system-generated rejection notices, and verify that all submitted records had been successfully accepted in SAM.gov before the reporting deadline. As a result, submission errors were not resolved timely, resulting in late reporting of all reportable subawards. Effect: Untimely reporting reduced the timeliness, transparency, and reliability of publicly available federal spending information and limited the ability of federal agencies, oversight bodies, and the public to promptly monitor the distribution of federal funds to subrecipients. In addition, the lack of controls to timely identify and resolve rejected submissions increases the risk that future FFATA reporting deadlines may not be met. Repeat finding: No Recommendation: We recommend that CDSS strengthen its department-wide controls over FFATA reporting to ensure reportable subawards are identified, reviewed, and submitted within required federal reporting deadlines. Specifically, CDSS should establish and implement centralized procedures to track subaward actions, amendments, allocation changes, and other reportable funding events; monitor applicable FFATA reporting deadlines; and maintain documentation demonstrating that reportable subawards have been evaluated and reported timely. In addition, CDSS should implement review controls that operate with sufficient precision to verify that all reportable subawards have been identified, reporting deadlines have been met, and FFATA submissions are complete, accurate, and supported by underlying award documentation prior to submission in SAM.gov. These procedures should include documented supervisory review, reconciliation of reportable subaward activity to source documentation, and periodic monitoring to identify and resolve untimely or omitted submissions. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report. Response to views of responsible officials: We acknowledge CDSS's position that an initial FFATA submission was made on November 27, 2024, and that only two records required correction and resubmission. However, CDSS did not provide sufficient documentation to support the asserted November 27 submission date, such as submission confirmations, systemgenerated reports, audit logs, or other contemporaneous evidence demonstrating that the subaward information was successfully submitted before the reporting deadline. The audit evidence available for inspection reflected a submission date after the required deadline for all 58 Foster Care subawards. Although CDSS indicated that only two records failed during the original upload process, documentation supporting that assertion and the cause of the upload failure was not provided for audit review. Accordingly, based on the evidence available, we were unable to verify that FFATA reporting requirements were met by the applicable deadline. Therefore, we continue to conclude that the finding is valid as presented.

Special Tests and Provisions Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Foster Care Title IV-E State Administering Department: California Department of Social Services (CDSS) ALN: 93.658 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401CAFOST; October 1, 2023- September 30, 2024 2501CAFOST; October 1, 2024- September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 45 – Public Welfare Subtitle B – Regulations Relating to Public Welfare Chapter XIII – Administration for Children and Families, Department of Health and Human Services Subpart G – The Administration on Children, Youth and Families, Foster Care Maintenance Payments, Adoption Assistance, and Child and Family Services Part 1356 – Requirements Applicable to Title IV-E § 1356.21 – Foster care maintenance payments program implementation requirements (a) Statutory and regulatory requirements of the Federal foster care program To implement the foster care maintenance payments program provisions of the title IV-E plan and to be eligible to receive Federal financial participation (FFP) for foster care maintenance payments under this part, a title IV-E agency must meet the requirements of this section, 45 CFR 1356.22, 45 CFR 1356.30, and sections 472, 475(1), 475(4), 475(5), 475(6), and for a Tribal title IV-E agency section 479(B)(c)(1)(C)(ii)(II) of the Act. (m) Review of payments and licensing standards In meeting the requirements of section 471(a)(11) of the Act, the title IV-E agency must review at reasonable, specific, time-limited periods to be established by the agency: (1) The amount of the payments made for foster care maintenance to assure their continued appropriateness, and that the amount made to a licensed or approved relative or kinship foster family home is the same as the amount that would have been made if the child was placed in a licensed or approved non-relative foster family home; § 1356.60 Fiscal requirements (title IV-E) (a) Federal matching funds for foster care maintenance and adoption assistance payments. (1) Federal financial participation (FFP) is available to title IV-E agencies under an approved title IV-E plan for allowable costs in expenditures for: (i) Foster care maintenance payments as defined in section 475(4) of the Act, made in accordance with §§ 1356.20 through 1356.30, section 472 of the Act. (c) Federal matching funds for other title IV-E agency administrative expenditures for foster care and adoption assistance under title IV-E Federal financial participation is available at the rate of fifty percent (50%) for administrative expenditures necessary for the proper and efficient administration of the title IV-E plan. The State's cost allocation plan shall identify which costs are allocated and claimed under this program. Condition: Audit procedures included testing 60 county claims for reimbursement and evaluating whether the payment rates applied were consistent with applicable foster care ratesetting guidance issued by the California Department of Social Services (CDSS). Of the 60 claims tested, 19 utilized rates that did not agree to the authorized rates in effect at the time the reimbursement was claimed. The differences between the rates applied and the authorized rates ranged from approximately 1% to 43%, indicating that reimbursement calculations were not consistently based on current statewide rate guidance. Foster care rate-setting guidance is updated periodically throughout the fiscal year and requires counties to implement revised rates as changes become effective. Testing indicated that counties did not consistently implement updated rates, and CDSS did not maintain monitoring procedures that operated with sufficient precision to verify the timely adoption of revised rates or to identify and correct the use of outdated rates. As a result, reimbursement claims were not consistently calculated using current authorized payment rates. Accordingly, CDSS did not maintain effective internal controls to ensure foster care reimbursement payments were consistently determined using current, authorized rates in accordance with applicable program requirements. Questioned costs: None Context: See “Condition.” Cause: CDSS did not maintain internal controls that operated with sufficient precision to ensure updated foster care rate-setting guidance was timely communicated, implemented, and consistently applied by counties. Specifically, monitoring controls were not designed or performed at a level capable of verifying county adoption of revised rates, identifying instances in which outdated rates continued to be used, or timely detecting and correcting rate discrepancies. As a result, changes to authorized statewide rates were not consistently incorporated into county reimbursement calculations, increasing the risk that payments were calculated using outdated rate schedules. Effect: The use of outdated rates resulted in foster care payments that were not consistently based on current authorized rate schedules, increasing the risk that expenditures charged to the program were misstated. Specifically, payments may have been overpaid or underpaid and were not consistently supported as allowable foster care maintenance or administrative expenditures. In addition, the lack of monitoring over implementation of updated rates reduces assurance that costs were properly calculated, applied, and classified in accordance with program requirements, affecting the reliability of reported expenditures. Repeat finding: No Recommendation: CDSS should strengthen internal controls over payment rate setting by establishing procedures to ensure that rate updates are timely implemented and consistently applied. This should include issuing clear implementation guidance to counties when rate changes occur, requiring confirmation of adoption of updated rates, and performing periodic monitoring or reconciliations to verify that payment rates used in county claims align with current authorized rate schedules. CDSS should also implement review controls to identify and correct instances where outdated rates are used before claims are finalized and reported. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2534CACCDD; October 1, 2024 – September 30, 2027 2534CACCDM; October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Subpart E – Cost Principles § 200.403 – Factors affecting allowability of costs Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (h) Administrative closeout costs may be incurred until the due date of the final report(s). If incurred, these costs must be liquidated prior to the due date of the final report(s) and charged to the final budget period of the award unless otherwise specified by the Federal agency. All other costs must be incurred during the approved budget period. At its discretion, the Federal agency is authorized to waive prior written approvals to carry forward unobligated balances to subsequent budget periods. See § 200.308(g)(3). Condition: For awards with period of performance start dates occurring during the fiscal year, audit procedures included testing 60 transactions recorded in the general ledger during the initial month of the award. Based on these procedures, we identified 25 instances where a portion of costs charged to the grant related to services performed prior to the approved period of performance start date of October 1, 2024. The total amount of costs charged outside of the period of performance at the beginning of the award was $7,013,956. Questioned costs: $7,013,956 Context: See “Condition.” Cause: The condition is due to ineffective controls over aligning expenditure recording with the approved period of performance, including insufficient review procedures to ensure that costs are charged to Federal awards based on the actual service period rather than timing of payment or accrual. In addition, controls did not adequately prevent or detect the systematic charging of pre-award service costs to newly awarded funding sources. Effect: Charging costs incurred prior to the period of performance results in noncompliance with Federal requirements and causes expenditures to be improperly shifted to ineligible funding periods. This practice overstates allowable costs at the beginning of the award and increases the risk that funds are used for activities not authorized under the award, potentially resulting in questioned costs and required repayment. Repeat finding: No Recommendation: We recommend that management strengthen internal controls over costs charged to Federal awards by implementing procedures to ensure that expenditures are aligned with the approved period of performance. This should include controls to verify, prior to recording, that service periods and underlying activities fall within authorized award dates. In addition, the Department should implement supervisory and/or system-based controls to detect and prevent costs recorded outside the period of performance, including mechanisms that flag transactions associated with pre-award or post-expiration service periods and ensure that costs are consistently charged to the appropriate funding source based on when services were performed. These actions will help ensure that costs charged to Federal awards are allowable and properly timed, reduce the risk of unallowable charges, and improve compliance with period of performance requirements under Uniform Guidance. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101CACDC6; October 1, 2020 – September 30, 2024 2334CACCDD; October 1, 2022 – September 30, 2025 2334CACCDF; October 1, 2022 – September 30, 2025 2334CACCDM; October 1, 2022 – September 30, 2025 2434CACCDD; October 1, 2023 – September 30, 2026 2434CACCDF; October 1, 2023 – September 30, 2026 2434CACCDM; October 1, 2023 – September 30, 2025 2534CACCDD; October 1, 2024 – September 30, 2027 2534CACCDF; October 1, 2024 – September 30, 2027 2534CACCDM; October 1, 2024 – September 30, 2026 2534CACCDY; December 21, 2024 – September 30, 2028 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Complianceand Material Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.302 – Financial management (b) The recipient's and subrecipient's financial management system must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. §200.328 Financial reporting (c) The recipient or subrecipient must submit financial reports as required by the Federal award. Reports submitted annually by the recipient or subrecipient must be due no later than 90 calendar days after the reporting period. Reports submitted quarterly or semiannually must be due no later than 30 calendar days after the reporting period. (d) The final financial report submitted by the recipient must be due no later than 120 calendar days after the conclusion of the period of performance. A subrecipient must submit a final financial report to a pass-through entity no later than 90 calendar days after the conclusion of the period of performance. § 200.329 Monitoring and reporting program performance (a) Monitoring by the recipient and subrecipient The recipient and subrecipient are responsible for the oversight of the Federal award. The recipient and subrecipient must monitor their activities under Federal awards to ensure they are compliant with all requirements and meeting performance expectations. Monitoring by the recipient and subrecipient must cover each program, function, or activity. See also § 200.332. Title 45 – Public Welfare Subtitle A – Department of Health and Human Services Subchapter A – General Administration Part 98 – Child Care and Development Fund Subpart G – Financial Management § 98.60 – Availability of funds (d) The following obligation and liquidation provisions apply to States and Territories: (1) Discretionary Fund allotments shall be obligated in the fiscal year in which funds are awarded or in the succeeding fiscal year. Unliquidated obligations as of the end of the succeeding fiscal year shall be liquidated within one year. (2)(i) Mandatory Funds for States requesting Matching Funds per § 98.55 shall be obligated in the fiscal year in which the funds are granted and are available until expended. (4) Both the Federal and non-Federal share of the Matching Fund shall be obligated in the fiscal year in which the funds are granted and liquidated no later than the end of the succeeding fiscal year. (5) Determination of whether funds have been obligated and liquidated will be based on State or local law or, if there is no applicable State or local law, the regulation at 2 CFR 200.1, Expenditures and Obligations. § 98.65 Audits and financial reporting (a) Each Lead Agency shall have an audit conducted after the close of each program period in accordance with 2 CFR part 200, subpart F, and the Single Audit Act Amendments of 1996. (b) Lead Agencies are responsible for ensuring that subgrantees are audited in accordance with appropriate audit requirements. (c) Not later than 30 days after the completion of the audit, Lead Agencies shall submit a copy of their audit report to the legislature of the State or, if applicable, to the Tribal Council(s). Lead Agencies shall also submit a copy of their audit report to the HHS Inspector General for Audit Services, as well as to their cognizant agency, if applicable. (d) Any amounts determined through an audit not to have been expended in accordance with these statutory or regulatory provisions, or with the Plan, and that are subsequently disallowed by the Department shall be repaid to the Federal government, or the Secretary will offset such amounts against any other CCDF funds to which the Lead Agency is or may be entitled. (e) Lead Agencies shall provide access to appropriate books, documents, papers and records to allow the Secretary to verify that CCDF funds have been expended in accordance with the statutory and regulatory requirements of the program, and with the Plan. (f) The audit required in paragraph (a) of this section shall be conducted by an agency that is independent of the State, Territory or Tribe as defined by generally accepted government auditing standards issued by the Comptroller General, or a public accountant who meets such independent standards. (g) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended. (h) At a minimum, a State or territorial Lead Agency's quarterly report shall include the following information on expenditures under CCDF grant funds, including Discretionary (which includes realloted funding and any funds transferred from the TANF block grant), Mandatory, and Matching Funds (which includes redistributed funding); and State Matching and Maintenance-of- Effort (MOE) Funds: (1) Child care administration; (2) Quality activities, including any sub-categories of quality activities as required by ACF; (3) Direct services for both grant or contracted slots and certificates; (4) Non-direct services, including: (i) Establishment and maintenance of computerized child care information systems; (ii) Certificate program cost/eligibility determination; (iii) All other non-direct services; and (5) Such other information as specified by the Secretary. § 98.67 – Fiscal requirements (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. Condition: Audit procedures included a review of the entire population of ACF-696 financial reports submitted for the CCDF Cluster. Our testing identified that certain reported amounts did not agree or reconcile to the underlying general ledger, resulting in a total variance of $491,119,535. Additionally, audit procedures identified that internal controls over reporting were not operating effectively to ensure the accurate submission of reports. Specifically, certain reports contained inaccuracies at the time of submission, and controls were not performed with sufficient precision to verify that reported information was complete and accurate in accordance with federal reporting requirements. Questioned costs: None Context: See “Condition.” Cause: The controls over the preparation and review of ACF-696 reports were not performed with sufficient precision to identify and resolve discrepancies between reported amounts and the underlying general ledger. Specifically, controls were not designed or operating at a level precise enough to ensure that reported data was accurate, reconciled, and submitted in a timely manner in accordance with federal requirements. As a result, variances and reporting errors were not detected or corrected prior to submission. Effect: Without a documented reconciliation between the ACF-696 reports and the general ledger, the Department cannot demonstrate that reported expenditures were accurate, complete, and supported by accounting records. This increases the risk that expenditures, obligations, liquidations, unobligated balances, or expenditure categories reported to ACF may be misstated. Inaccurate ACF-696 reporting may affect ACF’s ability to monitor compliance with CCDF spending, obligation, liquidation, and availability requirements. Repeat finding: Yes – 2024-015 Recommendation: Management should establish a formal reconciliation process to ensure that ACF-696 expense reports align with the general ledger. This process should include assigning responsibility to a designated finance team member for performing and documenting reconciliations, implementing a monthly reconciliation schedule, and promptly investigating and resolving any variances with documented approvals. Additionally, financial reporting policies should be updated to incorporate reconciliation requirements, and staff should receive training on compliance and reconciliation procedures to strengthen internal controls and reduce the risk of reporting inaccuracies. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report. Response to views of responsible officials: We acknowledge management's explanation that variances between the ACF-696 reports and the general ledger resulted from timing differences associated with subsequent cost allocations, accruals, and other adjustments. However, the issue identified during the audit was not the existence of timing differences, but that the reconciliation process did not adequately identify, explain, and support significant variances. Audit testing identified unreconciled variances totaling $491,119,535 between the ACF-696 reports and the general ledger. Although management indicated that adjustments were reported in subsequent quarters, documentation supporting a complete and accurate reconciliation was not available at the time of report preparation and submission. As a result, controls did not operate with sufficient precision to ensure reported amounts were accurate, complete, and supported by the Department's accounting records. Accordingly, we continue to conclude that the finding is valid as presented. We appreciate management's planned corrective actions to formalize the reconciliation process and strengthen oversight of ACF-696 reporting.

Reporting Federal Agency: U.S. Department of Health and Human ServicesFederal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2534CACCDD; October 1, 2024 – September 30, 2027 2534CACCDF; October 1, 2024 – September 30, 2027 2534CACCDM; October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.302 – Financial management (b) The recipient's and subrecipient's financial management system must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements Chapter I – Office of Management and Budget Government-Wide Guidance for Federal Financial Assistance Part 170 – Reporting Subaward and Executive Compensation Information Subpart A – General § 170.105 Applicability (a) Applicability in general. This part applies to a Federal agency’s Federal financial assistance as defined in § 170.300. This part applies to all recipients and subrecipients of Federal awards who meet the reporting requirements of paragraph (c) of this section, unless exempt under Federal statute or by paragraph (d) of this section. Appendix A to Part 170—Award Term I. Reporting Subawards and Executive Compensation (a) Reporting of first-tier subawards — (1) Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. (2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act (FFATA) subaward reporting functionality (formerly FSRS and now reported through SAM.gov) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. (c) Reporting of total compensation of subrecipient executives — (1) Applicability. Unless a first-tier subrecipient is exempt as provided in paragraph (d) of this appendix, the recipient must report the executive total compensation of each of the subrecipient's five most highly compensated executives for the subrecipient's preceding completed fiscal year, if: (i) The total Federal funding authorized to date under the subaward equals or exceeds $30,000; (ii) In the subrecipient's preceding fiscal year, the subrecipient received: (A) 80 percent or more of its annual gross revenues from Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act; and, (B) $25,000,000 or more in annual gross revenues from Federal procurement contracts (and subcontracts), and Federal awards (and subawards) subject to the Transparency Act; and (iii) The public does not have access to information about the compensation of the executives through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986 after receiving this subaward. (To determine if the public has access to the compensation information, see the U.S. Security and Exchange Commission total compensation filings at http://www.sec.gov/answers/execomp.htm.) (2) Reporting Requirements. Subrecipients must report to the recipient their executive total compensation described in paragraph (c)(1) of this appendix. The recipient is required to submit this information to the FFATA subaward reporting functionality (formerly FSRS and now reported through SAM.gov) at http://www.fsrs.gov no later than the end of the month following the month in which the subaward was made. As of March 2025, this functionality has been migrated to SAM.gov, which now serves as the system of record for FFATA subaward reporting. Condition: Audit procedures included a review of 60 FFATA subaward submissions for the CCDF Cluster reported in SAM.gov and a comparison of those submissions to underlying agreements and funding allocations applicable to FY 2024–25. Our testing identified that CDSS did not consistently perform or retain a documented evaluation of whether agreements constituted subawards or procurement contracts in accordance with 2 CFR § 200.331 prior to FFATA reporting. FFATA submissions did not align with the timing and structure of funding communicated through Child Care Bulletins, including allocation amendments and contract modifications, and all submissions tested contained errors in key data elements, including subrecipient identification and linkage to the prime award. In addition, CDSS included agreements in FFATA reporting without documented support that the substance of the relationship met the definition of a subaward, while agreements with subaward characteristics were not consistently identified and reported, resulting in reported amounts that did not consistently reflect underlying funding actions. Accordingly, controls over FFATA reporting were not performed with sufficient precision to ensure that agreements were appropriately classified and that reported information was complete and accurate in accordance with federal reporting requirements. Questioned costs: None Context: See “Condition.” Cause: The condition occurred because CDSS has not established an effective, centralized process to identify, evaluate, track, and report first-tier subawards subject to FFATA across its federal programs. CDSS did not maintain a complete reporting workflow that links funding actions, allocation amendments, agreement modifications, subrecipient classifications, and SAM.gov reporting deadlines. As a result, FFATA reporting relied on manual program-level processes that did not consistently ensure reportable subawards were identified, supported, reviewed, and submitted by the required deadline. Effect: Failure to timely and accurately report FFATA subaward information results in noncompliance with federal reporting requirements and reduces the transparency and reliability of publicly available federal spending data. Late, incomplete, or inaccurate reporting limits the ability of federal agencies, oversight bodies, and the public to determine how federal funds were passed through to subrecipients. Because similar FFATA deficiencies were identified across multiple CDSS-administered programs, there is an increased risk that reporting errors may continue or affect other federal programs unless CDSS implements a department-wide corrective action. Repeat finding: Yes – 2024-014 Recommendation: We recommend that CDSS revise its department-wide FFATA reporting procedures to address errors resulting from reliance on manual tracking, decentralized spreadsheets, and program-level processes that do not consistently capture funding actions, allocation amendments, agreement modifications, reporting deadlines, and SAM.gov submission status. Revised procedures should require program-specific review of each federal program’s funding structure and supporting documentation to determine whether agreements, allocations, amendments, or other funding actions are reportable subawards or procurement contracts, and whether new or updated FFATA reporting is required. CDSS should also require documented review before submission to verify that reported subrecipient information, award amounts, Assistance Listing numbers, prime award linkages, and reporting dates agree to underlying award documents, allocation letters, amendments, and agreements. These controls should help ensure FFATA submissions are accurate, timely, supported, and aligned with the unique funding structure of each CDSS-administered federal program. CDSS should consider utilizing a grant management solution to manage the full grant lifecycle more efficiently and ensure compliance with federal reporting requirements. The solution should support centralized tracking of awards, subawards, amendments, reporting deadlines, supporting documentation, review responsibilities, automated reminders, and submission status. This would reduce reliance on manual tracking and decentralized spreadsheets, improve accountability over responsible personnel, and strengthen CDSS’s ability to complete FFATA reporting accurately and timely. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Special Tests and Provisions Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2434CACCDD; October 1, 2023 - September 30, 2026 2434CACCDF; October 1, 2023 - September 30, 2026 2434CACCDM; October 1, 2023 - September 30, 2025 2534CACCDD; October 1, 2024 - September 30, 2027 2534CACCDF; October 1, 2024 - September 30, 2027 2534CACCDM; October 1, 2024 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – Public Welfare Subtitle A – Department of Health and Human Services Subchapter A – General Administration Part 98 – Child Care and Development Fund Subpart E – Program Operations (Child Care Services)—Lead Agency and Provider Requirements § 98.40 Compliance with applicable State and local regulatory requirements (a) Lead Agencies shall: (1) Certify that they have in effect licensing requirements applicable to child care services provided within the area served by the Lead Agency; (2) Describe in the Plan exemption(s) to licensing requirements, if any, for child care services for which assistance is provided, and a demonstration for how such exemption(s) do not endanger the health, safety, or development of children who receive services from such providers. Lead Agencies must provide the required description and demonstration for any exemptions based on: (i) Provider category, type, or setting; (ii) Length of day; (iii) Providers not subject to licensing because the number of children served falls below a Statedefined threshold; and (iv) Any other exemption to licensing requirements; and (3) Provide a detailed description in the Plan of the requirements under paragraph (a)(1) of this section and of how they are effectively enforced. § 98.41 Health and safety requirements (a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to § 98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (i) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, the following provisions apply: (A) As part of their health and safety provisions in this area, Lead Agencies shall assure that children receiving services under the CCDF are age-appropriately immunized. Those health and safety provisions shall incorporate (by reference or otherwise) the latest recommendation for childhood immunizations of the respective State, territorial, or tribal public health agency. (B) Notwithstanding this paragraph (a)(1)(i), Lead Agencies may exempt: (1) Children who are cared for by relatives (defined as grandparents, great grandparents, siblings (if living in a separate residence), aunts, and uncles), provided there are no other unrelated children who are cared for in the same setting. (2) Children who receive care in their own homes, provided there are no other unrelated children who are cared for in the home. (3) Children whose parents object to immunization on religious grounds. (4) Children whose medical condition contraindicates immunization. (C) Lead Agencies shall establish a grace period that allows children experiencing homelessness and children in foster care to receive services under this part while providing their families (including foster families) a reasonable time to take any necessary action to comply with immunization and other health and safety requirements. (1) The length of such grace period shall be established in consultation with the State, Territorial or Tribal health agency. (2) Any payment for such child during the grace period shall not be considered an error or improper payment under subpart K of this part. (3) The Lead Agency may also, at its option, establish grace periods for other children who are not experiencing homelessness or in foster care. (4) Lead Agencies must coordinate with licensing agencies and other relevant State, Territorial, Tribal, and local agencies to provide referrals and support to help families of children receiving services during a grace period comply with immunization and other health and safety requirements; (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man-caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of bio contaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and (xii) May include requirements relating to: (A) Nutrition (including age-appropriate feeding); (B) Access to physical activity; (C) Caring for children with special needs; or (D) Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children's health and safety. (2) Include minimum health and safety training on the topics above, as described in § 98.44. § 98.42 Enforcement of licensing and health and safety requirements (a) Each Lead Agency shall certify in the Plan that procedures are in effect to ensure that child care providers of services for which assistance is made available in accordance with this part, within the area served by the Lead Agency, comply with all applicable State, local, or tribal health and safety requirements, including those described in § 98.41. (b) Each Lead Agency shall certify in the Plan it has monitoring policies and practices applicable to all child care providers and facilities eligible to deliver services for which assistance is provided under this part. The Lead Agency shall: (1) Ensure individuals who are hired as licensing inspectors are qualified to inspect those child care providers and facilities and have received training in related health and safety requirements appropriate to provider setting and age of children served. Training shall include, but is not limited to, those requirements described in § 98.41, and all aspects of the State, Territory, or Tribe's licensure requirements; (2) Require inspections of child care providers and facilities, performed by licensing inspectors (or qualified inspectors designated by the Lead Agency), as specified below: (i) For licensed child care providers and facilities, (A) Not less than one pre-licensure inspection for compliance with health, safety, and fire standards, and (B) Not less than annually, an unannounced inspection for compliance with all child care licensing standards, which shall include an inspection for compliance with health and safety, (including, but not limited to, those requirements described in § 98.41) and fire standards (inspectors may inspect for compliance with all three standards at the same time); and (ii) For license-exempt child care providers and facilities that are eligible to provide services for which assistance is made available in accordance with this part, an annual inspection for compliance with health and safety (including, but not limited to, those requirements described in § 98.41), and fire standards; (iii) Coordinate, to the extent practicable, monitoring efforts with other Federal, State, and local agencies that conduct similar inspections. (iv) The Lead Agency may, at its option: (A) Use differential monitoring or a risk-based approach to design annual inspections, provided that the contents covered during each monitoring visit is representative of the full complement of health and safety requirements; (B) Develop alternate monitoring requirements for care provided in the child's home that are appropriate to the setting; and (3) Ensure the ratio of licensing inspectors to such child care providers and facilities is maintained at a level sufficient to enable the State, Territory, or Tribe to conduct effective inspections on a timely basis in accordance with the applicable Federal, State, Territory, Tribal, and local law; (4) Require child care providers to report to a designated State, Territorial, or Tribal entity any serious injuries or deaths of children occurring in child care. (c) For the purposes of this section and § 98.41, Lead Agencies may exclude grandparents, great grandparents, siblings (if such providers live in a separate residence), aunts, or uncles, from the term “child care providers.” If the Lead Agency chooses to exclude these providers, the Lead Agency shall provide a description and justification in the CCDF Plan, pursuant to § 98.16(l), of requirements, if any, that apply to these providers. Condition: The CDSS has not established health and safety monitoring procedures to ensure licensed-exempt providers serving children who receive subsidies comply with all applicable health and safety requirements. Review of oversight results issued by the grantor agency identified deficiencies in multiple health and safety areas for license-exempt providers. Questioned costs: None Context: See “Condition.” Cause: The condition is due to delays in finalizing and implementing a comprehensive health and safety monitoring process for license-exempt providers. Although CDSS has initiated efforts to develop monitoring procedures for license-exempt contractors, full implementation is dependent on statutory and budgetary actions, which have delayed the Department’s ability to establish, implement, and enforce required health and safety standards, training, and inspection requirements across all applicable provider types. As a result, controls were not fully designed or operating to ensure consistent compliance with CCDF health and safety requirements during the audit period. Effect: Failure to implement and enforce required health and safety standards increases the risk that children receiving CCDF-funded services are in environments that do not meet minimum Federal health and safety requirements. In addition, the lack of consistent monitoring and enforcement reduces the Department’s ability to detect and remediate noncompliance, resulting in program-wide noncompliance and increased risk of Federal sanctions or funding implications. Repeat finding: Yes – 2024-016 Recommendation: We recommend that CDSS strengthen internal controls over health and safety compliance by establishing and fully implementing comprehensive health and safety standards across all applicable provider types, including license-exempt providers. The Department should also ensure that required pre-service and ongoing training requirements are clearly defined, implemented, and tracked for all required health and safety topics. In addition, CDSS should enhance its monitoring and inspection processes to ensure required annual inspections, including unannounced inspections where applicable, are performed timely and consistently documented. These actions will help ensure that providers receiving CCDF funds comply with Federal health and safety requirements, improve the Department’s ability to identify and correct noncompliance, and strengthen overall program integrity and child safety. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Special Tests and Provisions Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2434CACCDD; October 1, 2023 - September 30, 2026 2434CACCDF; October 1, 2023 - September 30, 2026 2434CACCDM; October 1, 2023 - September 30, 2025 2534CACCDD; October 1, 2024 - September 30, 2027 2534CACCDF; October 1, 2024 - September 30, 2027 2534CACCDM; October 1, 2024 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.329 Monitoring and reporting program performance (a) Monitoring by the recipient and subrecipient The recipient and subrecipient are responsible for the oversight of the Federal award. The recipient and subrecipient must monitor their activities under Federal awards to ensure they are compliant with all requirements and meeting performance expectations. Monitoring by the recipient and subrecipient must cover each program, function, or activity. See also § 200.332. Title 45 – Public Welfare Subtitle A – Department of Health and Human Services Subchapter A – General Administration Part 98 – Child Care and Development Fund Subpart B – General Application Procedures § 98.11 – Administration under contracts and agreements Lead Agencies have broad authority to administer and operate the CCDF program through other governmental, nongovernmental, or public or private local agencies; however, the Lead Agency must retain overall responsibility for the administration of the program and ensure that administrative and implementation responsibilities undertaken by agencies other than the Lead Agency are governed by written agreements specifying the mutual roles and responsibilities of the Lead Agency and other agencies in meeting CCDF requirements. The approved FFY 2025–2027 CCDF State Plan identifies CDSS as the Lead Agency and states that activities performed by agencies other than CDSS are governed through written agreements, including contracts and grant award notifications, that include required elements such as tasks to be performed, schedules for completing tasks, budgets, and performance measures. The State Plan further describes CDSS’s monitoring process for contractors, including standard review instruments, corrective action follow-up, fiscal and program reporting, and contractor review requirements. Condition: Audit procedures included testing a sample of 60 CCDF contractors to determine whether CDSS performed on-site monitoring visits in accordance with the contractor review cycle specified in the approved State Plan and related monitoring procedures. Of the 60 contractors tested, 2 contractors did not receive an on-site monitoring visit within the required review period. Specifically, the contractors had not received an on-site visit within four years, although the State Plan and related monitoring procedures require contractor reviews to be performed within a three-year cycle. As a result, CDSS did not consistently perform required monitoring procedures within the timeframe established for oversight of CCDF contractors. Questioned costs: None Context: See “Condition.” Cause: CDSS did not maintain internal controls that operated with sufficient precision to ensure all CCDF contractors were scheduled for and received required on-site monitoring visits within the established review cycle. Specifically, monitoring controls were not designed or performed at a level sufficient to identify overdue contractor reviews, track the status of required visits, and ensure timely completion of on-site monitoring for all applicable contractors. Effect: Failure to perform timely on-site monitoring visits reduces CDSS’s ability to determine whether contractors are operating in accordance with written agreements, State Plan requirements, and applicable CCDF program requirements. Untimely monitoring increases the risk that contractor noncompliance, performance deficiencies, or unsupported program activities are not identified and corrected promptly, which may affect CDSS’s ability to retain effective oversight and overall responsibility for the CCDF program. Repeat finding: No Recommendation: We recommend that CDSS strengthen internal controls over CCDF contractor monitoring by implementing procedures to ensure all contractors are scheduled for and receive required on-site monitoring visits within the review cycle established in the approved State Plan and related monitoring procedures. These procedures should include maintaining a complete monitoring schedule, tracking the date of each contractor’s last review, identifying upcoming and overdue reviews, and requiring documented supervisory review to ensure monitoring visits are completed timely. CDSS should also establish a process to periodically reconcile the monitoring schedule to the population of active CCDF contractors and promptly follow up on overdue reviews. These controls should help ensure CDSS performs contractor oversight consistently, documents compliance with written agreement monitoring requirements, and retains effective responsibility for CCDF administration. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report. Response to views of responsible officials: We acknowledge CDSS's response regarding resource constraints, risk-based prioritization, and its interpretation of the "as resources permit" language in Title 5, California Code of Regulations, Section 18023(b). However, the approved State Plan and related monitoring procedures in effect during the audit period established a three-year review cycle for contractor monitoring. Audit testing identified that 2 of 60 CCDF contractors did not receive an on-site monitoring visit for more than four years. While CDSS employed a risk-based approach to prioritize monitoring activities, the required reviews were not completed within the established review cycle for the contractors identified in our testing. Accordingly, the finding is based on CDSS's failure to consistently perform monitoring reviews within the established review cycle and the lack of controls to ensure overdue reviews were identified, tracked, and completed timely. Therefore, we continue to conclude that the finding is valid as presented.

Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant State Administering Department: California Department of Social Services (CDSS) ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2501CASOSR; October 1, 2024 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.302 – Financial management (b) The recipient's and subrecipient's financial management system must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements Chapter I – Office of Management and Budget Government-Wide Guidance for Federal Financial Assistance Part 170 – Reporting Subaward and Executive Compensation Information Subpart A – General § 170.105 Applicability (a) Applicability in general. This part applies to a Federal agency’s Federal financial assistance as defined in § 170.300. This part applies to all recipients and subrecipients of Federal awards who meet the reporting requirements of paragraph (c) of this section, unless exempt under Federal statute or by paragraph (d) of this section. Appendix A to Part 170—Award Term I. Reporting Subawards and Executive Compensation (a) Reporting of first-tier subawards — (1) Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. (2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act (FFATA) subaward reporting functionality (formerly FSRS and now reported through SAM.gov) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. (c) Reporting of total compensation of subrecipient executives — (1) Applicability. Unless a first-tier subrecipient is exempt as provided in paragraph (d) of this appendix, the recipient must report the executive total compensation of each of the subrecipient's five most highly compensated executives for the subrecipient's preceding completed fiscal year, if: (i) The total Federal funding authorized to date under the subaward equals or exceeds $30,000; (ii) In the subrecipient's preceding fiscal year, the subrecipient received: (A) 80 percent or more of its annual gross revenues from Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act; and, (B) $25,000,000 or more in annual gross revenues from Federal procurement contracts (and subcontracts), and Federal awards (and subawards) subject to the Transparency Act; and (iii) The public does not have access to information about the compensation of the executives through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986 after receiving this subaward. (To determine if the public has access to the compensation information, see the U.S. Security and Exchange Commission total compensation filings at http://www.sec.gov/answers/execomp.htm.) (2) Reporting Requirements. Subrecipients must report to the recipient their executive total compensation described in paragraph (c)(1) of this appendix. The recipient is required to submit this information to the FFATA subaward reporting functionality (formerly FSRS and now reported through SAM.gov) at http://www.fsrs.gov no later than the end of the month following the month in which the subaward was made. As of March 2025, this functionality has been migrated to SAM.gov, which now serves as the system of record for FFATA subaward reporting. Condition: Audit procedures included a review of FFATA subaward submissions for the Social Services Block Grant reported in SAM.gov and a comparison of those submissions to funding actions applicable to FY 2024–25. Our testing identified that no subawards were reported within the required timeframe. Questioned costs: None Context: See “Condition.” Cause: The condition occurred because CDSS has not established an effective, centralized process to identify, evaluate, track, and report first-tier subawards subject to FFATA across its federal programs. CDSS did not maintain a complete reporting workflow that links funding actions, allocation amendments, agreement modifications, subrecipient classifications, and SAM.gov reporting deadlines. As a result, FFATA reporting relied on manual program-level processes that did not consistently ensure reportable subawards were identified, supported, reviewed, and submitted by the required deadline. Effect: Failure to timely and accurately report FFATA subaward information results in noncompliance with federal reporting requirements and reduces the transparency and reliability of publicly available federal spending data. Late, incomplete, or inaccurate reporting limits the ability of federal agencies, oversight bodies, and the public to determine how federal funds were passed through to subrecipients. Because similar FFATA deficiencies were identified across multiple CDSS-administered programs, there is an increased risk that reporting errors may continue or affect other federal programs unless CDSS implements a department-wide corrective action. Repeat finding: No Recommendation: We recommend that CDSS revise its department-wide FFATA reporting procedures to address errors resulting from reliance on manual tracking, decentralized spreadsheets, and program-level processes that do not consistently capture funding actions, allocation amendments, agreement modifications, reporting deadlines, and SAM.gov submission status. Revised procedures should require program-specific review of each federal program’s funding structure and supporting documentation to determine whether agreements, allocations, amendments, or other funding actions are reportable subawards or procurement contracts, and whether new or updated FFATA reporting is required. CDSS should also require documented review before submission to verify that reported subrecipient information, award amounts, Assistance Listing numbers, prime award linkages, and reporting dates agree to underlying award documents, allocation letters, amendments, and agreements. These controls should help ensure FFATA submissions are accurate, timely, supported, and aligned with the unique funding structure of each CDSS-administered federal program. CDSS should consider utilizing a grant management solution to manage the full grant lifecycle more efficiently and ensure compliance with federal reporting requirements. The solution should support centralized tracking of awards, subawards, amendments, reporting deadlines, supporting documentation, review responsibilities, automated reminders, and submission status. This would reduce reliance on manual tracking and decentralized spreadsheets, improve accountability over responsible personnel, and strengthen CDSS’s ability to complete FFATA reporting accurately and timely. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster State Administering Department: Department of Health Care Services (DHCS) ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405CA5MAP; July 1, 2024 – September 30, 2024 2405CA5ADM; October 1, 2024 – December 31, 2024 2505CA5MAP; January 1, 2025 – March 31, 2025 2505CA5ADM; April 1, 2025 – June 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912, state Medicaid agencies must establish and adhere to timeliness and performance standards for determining and redetermining eligibility. These standards are intended to ensure that eligibility decisions are made promptly and accurately, and that benefits are not continued beyond the period of eligibility. Condition: Audit procedures included a review of 60 Medicaid beneficiaries associated with currently eligible participants to evaluate compliance with eligibility requirements, including the timeliness of redeterminations and the propriety of benefits issued. Based on our testing, instances of noncompliance were identified related to both the timeliness of eligibility redeterminations and the appropriateness of benefits paid: - For eleven of the 60 beneficiaries tested, required eligibility redeterminations were not completed within the prescribed timeframes. - For three of the 60 beneficiaries tested, benefits were provided during periods in which the individuals did not meet eligibility requirements. These exceptions indicate that controls over the monitoring and completion of required redeterminations, as well as controls to ensure benefits are issued only to eligible individuals, were not operating effectively. Questioned costs: $18,468 Context: See “Condition.” Cause: The exceptions identified were due to internal controls over the eligibility determination and redetermination processes not operating with sufficient precision to ensure consistent compliance with program requirements. Specifically, controls were not performing at a level of precision necessary to consistently enforce DHCS guidance, ensure timely completion of required verification procedures, and detect and correct errors through supervisory review. As a result, inaccuracies in eligibility determinations were not consistently prevented or identified, contributing to improper enrollment of ineligible beneficiaries. Effect: Failure to properly determine eligibility and terminate benefits in the eligibility system may result in individuals receiving improper benefit payments and noncompliance with grant award terms and conditions. Repeat finding: Yes – 2024-011 Recommendation: DHCS should enhance its procedures for monitoring and resolving MEDS alerts, ensuring timely review and action on system-generated discrepancies. Additionally, staff should receive ongoing training on the importance of accurately updating eligibility requirements in CalSAWS to ensure the prevention of inappropriate continuation of benefits. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Special Tests and Provisions Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster State Administering Department: California Department of Public Health (CDPH) ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405CA5MAP; July 1, 2024 – September 30, 2024 2405CA5ADM; October 1, 2024 – December 31, 2024 2505CA5MAP; January 1, 2025 – March 31, 2025 2505CA5ADM; April 1, 2025 – June 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, per Centers for Medicare and Medicaid Services (CMS) guidance issued in “Admin Info: 25-03- All” letter dated October 23, 2024, Surveys for Skilled Nursing Facilitates (SNF) and Intermediate Care Facilities (ICF) surveys should be conducted in the following timeframes: - Nursing home recertification health surveys are conducted within the maximum time interval of 15.9 months. - Active Intermediate care facility for individuals with intellectual disabilities (ICF/IID) that have been surveyed within the required maximum interval of 15.9 months. Condition: During our audit procedures, we reviewed sixty surveys related to provider recertification under the Medicaid program. We identified that thirty Skilled Nursing Facilities and seventeen Intermediate Care Facilities were not conducted in the required timeframe. Questioned costs: None Context: See “Condition.” Cause: Resource and staffing constraints limited CDPH’s capacity, as the survey agency supporting DHCS’s Medicaid provider certification process, to conduct all required recertification surveys within federally mandated timeframes. Consequently, surveys were prioritized based on risk and need, resulting in some SNF and ICF/IID surveys not being completed within the required 15.9-month interval. Effect: Failure to conduct required recertification surveys timely may result in noncompliance with federal Medicaid provider health and safety requirements and reduces assurance that participating facilities continue to meet standards for Medicaid participation. Repeat finding: Yes – 2024-012 Recommendation: DHCS, in coordination with CDPH, should strengthen oversight controls to ensure timely completion of SNF and ICF/IID surveys. Procedures should include tracking required survey due dates, monitoring surveys approaching or exceeding the 15.9-month interval, documenting prioritization decisions when capacity constraints exist, and performing supervisory review to verify that overdue surveys are identified and remediated timely. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Activities Allowed and Unallowed Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program (CHIP) (Not a Major Program) State Administering Department: Department of Health Care Services (DHCS) ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305CA3002; October 1, 2022- September 30, 2024 2405CA5021; October 1, 2023- September 30, 2025 2505CA5021; October 1, 2024- September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a review of 40 CHIP beneficiaries associated with currently eligible participants. Of the 40 beneficiaries tested, two were assigned an obsolete aid code. While the underlying participant eligibility appeared to meet program criteria, the aid code is a key data element used in determining reimbursement rates. As a result, payments for these beneficiaries were calculated using an incorrect rate, leading to improper payment amounts. Questioned costs: $14,910,485 (known costs $1,850) Context: See “Condition.” Cause: The control designed to detect and correct invalid or obsolete aid codes did not operate at a sufficient level of precision to identify these errors. Specifically, an automated system interface between CalSAWS and MEDS does not consistently update or prevent the use of discontinued aid codes. Effect: Use of obsolete aid codes may result in reimbursement calculations using incorrect rates, leading to improper payment amounts and noncompliance with federal award terms and conditions. Because aid codes drive reimbursement rate determinations, control deficiencies over obsolete or invalid aid codes increase the risk that expenditures are not calculated accurately or supported by current program requirements. Repeat finding: Yes – 2024-010 Recommendation: DHCS should strengthen controls over aid code maintenance and validation to ensure obsolete or invalid aid codes are not used in reimbursement calculations. Procedures should include periodic reviews of aid code tables, reconciliation of active aid codes between CalSAWS and MEDS, monitoring of system interface exceptions, and documented supervisory review to identify and correct obsolete aid codes before payments are calculated. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program (CHIP) (Not a Major Program) State Administering Department: Department of Health Care Services (DHCS) ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305CA3002; October 1, 2022- September 30, 2024 2405CA5021; October 1, 2023- September 30, 2025 2505CA5021; October 1, 2024- September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally: - 42 CFR §435.916(a)(1) requires annual redeterminations every 12 months. - 42 CFR §457.320 and §457.340 require accurate and timely eligibility determinations for CHIP. - 42 CFR §435.912(c)(3) requires processing of nondisability applications within 45 days. Condition: Audit procedures included a review of 40 CHIP beneficiaries associated with current eligible participants. Of the 40 participants reviewed: - For eight of the 40 beneficiaries tested, required eligibility redeterminations were not completed within the prescribed timeframes. - Three beneficiaries received benefits despite not meeting eligibility requirements during the period the benefits were provided. - One beneficiary had an eligibility determination that exceeded the required 45-day processing timeframe. Questioned costs: $2,827 Context: See “Condition.” Cause: The exceptions identified were due to internal controls over the eligibility determination and redetermination processes not operating with sufficient precision to ensure consistent compliance with program requirements. Specifically, controls were not performing at a level of precision necessary to consistently enforce DHCS guidance, ensure timely completion of required verification procedures, and detect and correct errors through supervisory review. As a result, inaccuracies in eligibility determinations were not consistently prevented or identified, contributing to improper enrollment of ineligible beneficiaries. Effect: Failure to properly determine eligibility and terminate benefits in the eligibility system may result in individuals receiving improper benefit payments and noncompliance with grant award terms and conditions. Repeat finding: No Recommendation: DHCS should strengthen controls over eligibility determinations and redeterminations to ensure applications, redeterminations, and case updates are completed within required timeframes and that benefits are discontinued when eligibility requirements are no longer met. Procedures should include monitoring overdue redeterminations, resolving MEDS and CalSAWS alerts timely, documenting supervisory review of exception reports, and providing refresher training on timely eligibility processing and case closure requirements. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Period of Performance Federal Agency: Federal Emergency Management Agency Federal Program Title: Disaster Grants - Public Assistance State Administering Department: Governor’s Office of Emergency Services ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 4856DRCAP00000001; January 7, 2025 – January 9, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR 200.77 defines the period of performance as the time during which the non- Federal entity may incur new obligations to carry out the work authorized under the Federal award and requires that the Federal awarding agency or pass-through entity include the start and end dates of the period of performance in the Federal award. Effective internal controls should ensure that compliance with applicable requirements is achieved throughout the defined period of performance, beginning on the award start date. Condition: For awards with period of performance start dates occurring during the fiscal year, audit procedures included testing transactions recorded in the general ledger during the initial month of the award. We tested a sample of seven transactions totaling $23,576. Our testing identified one transaction, totaling $9,852, for which costs were incurred prior to the beginning of the period of performance. Specifically, the award period began on January 7, 2025; however, the associated costs were incurred between January 3 and January 6, 2025. Questioned costs: None Context: See “Condition.” Cause: Controls over the review of expenditures at the start of the period of performance were not operating with sufficient precision to ensure that only allowable costs incurred on or after the award start date were charged to the appropriate Federal award. Specifically, management did not consistently apply procedures to verify that expenditures were recorded to the correct grant and within the applicable period of performance, resulting in the misclassification of pre-award costs to the grant. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat finding: No Recommendation: The Department should strengthen controls over grant accounting by implementing procedures to ensure that expenditures are both charged to the correct grant and incurred within the applicable period of performance. This should include establishing controls to verify grant coding and transaction dates prior to posting or reimbursement, as well as enhancing supervisory review processes to detect and prevent misclassification of expenditures and the recording of unallowable pre-award costs. Additionally, the Department should provide training to personnel responsible for grant accounting on proper grant coding and period-ofperformance requirements. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reporting Federal Agency: Federal Emergency Management Agency Federal Program Title: Disaster Grants - Public Assistance State Administering Department: Governor’s Office of Emergency Services ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 4407DRCAP00000001; November 12, 2018 – September 30, 2022 4431DRCAP00000001; May 1, 2019 – September 30, 2022 4482DRCAP00000001; January 20, 2020 – September 30, 2025 4558DRCAP00000001; August 24, 2021 – September 30, 2025 4683DRCAP00000001; December 27, 2022 – September 30, 2025 4699DRCAP00000001; April 3, 2023 – September 30, 2025 4750DRCAP00000001; August 19, 2023 – September 30, 2025 4769DRCAP00000001; January 31, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.302 – Financial management (b) The recipient's and subrecipient's financial management system must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements Chapter I – Office of Management and Budget Government-Wide Guidance for Federal Financial Assistance Part 170 – Reporting Subaward and Executive Compensation Information Subpart A – General § 170.105 Applicability (a) Applicability in general. This part applies to a Federal agency’s Federal financial assistance as defined in § 170.300. This part applies to all recipients and subrecipients of Federal awards who meet the reporting requirements of paragraph (c) of this section, unless exempt under Federal statute or by paragraph (d) of this section. Appendix A to Part 170—Award Term I. Reporting Subawards and Executive Compensation (a) Reporting of first-tier subawards — (1) Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. (2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act (FFATA) subaward reporting functionality (formerly FSRS and now reported through SAM.gov) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. (c) Reporting of total compensation of subrecipient executives — (1) Applicability. Unless a first-tier subrecipient is exempt as provided in paragraph (d) of this appendix, the recipient must report the executive total compensation of each of the subrecipient's five most highly compensated executives for the subrecipient's preceding completed fiscal year, if: (i) The total Federal funding authorized to date under the subaward equals or exceeds $30,000; (ii) In the subrecipient's preceding fiscal year, the subrecipient received: (A) 80 percent or more of its annual gross revenues from Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act; and, (B) $25,000,000 or more in annual gross revenues from Federal procurement contracts (and subcontracts), and Federal awards (and subawards) subject to the Transparency Act; and (iii) The public does not have access to information about the compensation of the executives through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986 after receiving this subaward. (To determine if the public has access to the compensation information, see the U.S. Security and Exchange Commission total compensation filings at http://www.sec.gov/answers/execomp.htm.) (2) Reporting Requirements. Subrecipients must report to the recipient their executive total compensation described in paragraph (c)(1) of this appendix. The recipient is required to submit this information to the FFATA subaward reporting functionality (formerly FSRS and now reported through SAM.gov) at http://www.fsrs.gov no later than the end of the month following the month in which the subaward was made. As of March 2025, this functionality has been migrated to SAM.gov, which now serves as the system of record for FFATA subaward reporting. Condition: Audit procedures included testing 60 FFATA reporting submissions related to subrecipients to evaluate compliance with federal reporting requirements and the design and implementation of internal controls over the FFATA reporting process. Our testing identified that FFATA reports for 36 of the 60 subrecipients were not submitted timely in accordance with federal requirements. While the reports were ultimately complete and accurate, controls over the reporting process were not performed with sufficient precision to ensure timely submission. Questioned costs: None Context: See “Condition.” Cause: During the fiscal year, the Department revised its procedures for performing FFATA reporting; however, the updated procedures and related controls were not consistently implemented across all subrecipient reporting activities. As a result, certain reports were processed outside of the revised control framework, contributing to delays in timely submission. Effect: The lack of established procedures and internal controls for FFATA reporting resulted in noncompliance, with 36 out of 60 subrecipients not reported timely as required. Repeat finding: Yes – 2024-020 Recommendation: The Department should strengthen controls over FFATA reporting by ensuring that revised procedures are fully implemented and consistently applied to all subrecipient reporting activities. This should include establishing clear protocols to identify all reports subject to FFATA requirements, monitoring compliance with reporting deadlines, and performing periodic reviews to verify that controls are operating with sufficient precision to ensure timely submission. Additionally, the Department should provide training and communication to relevant personnel on updated procedures and implement supervisory review controls to detect and remediate untimely filings. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Special Tests and Provisions Federal Agency: Federal Emergency Management Agency Federal Program Title: Disaster Grants - Public Assistance State Administering Department: Governor’s Office of Emergency Services ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 4699DRCAP00000001; April 3, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 44 – Emergency Management and Assistance, §206.205 (Payment of Claims), requires that for large projects, the subrecipient must account for actual eligible costs and certify that: - Costs were incurred for eligible work - Work was completed in accordance with the approved scope - The project complied with the FEMA-State Agreement and grant conditions - Payments were made in accordance with applicable requirements For small projects, the subrecipient must certify completion of the approved scope of work through a Small Project Completion Certification. Additionally, 2 CFR §200.303 (Internal Controls) requires the entity to establish and maintain effective internal controls to ensure compliance with Federal statutes, regulations, and grant terms. Condition: During audit procedures, we tested a sample of 14 large FEMA Public Assistance projects. We identified one instance in which a project was incorrectly classified as a small project and was paid without the required large project reimbursement request and supporting validation. Questioned costs: None Context: See “Condition.” Cause: The error resulted from the incorrect application of FEMA’s large project threshold, as the control over project classification did not operate with sufficient precision to ensure the appropriate threshold was applied. Specifically, the project, totaling $1,044,653.84, exceeded the applicable 2023 large project threshold of $1,000,000; however, it was evaluated using the 2025 threshold of $1,062,900 based on the obligation date. Due to the lack of precision in the control, this error was not identified during review, resulting in the improper classification and processing of the project. Effect: A lack of precision of the controls to properly classify and process the project in accordance with FEMA requirements may result in noncompliance with federal grant provisions and inadequate oversight of project costs and reimbursements. Repeat finding: No Recommendation: The Department should strengthen its controls and procedures to ensure projects are classified using the correct FEMA large project thresholds. This should include implementing a review control to verify threshold applicability based on the appropriate timing criteria and ensuring that all required documentation, including reimbursement requests and validations, is completed prior to payment. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Finding 2025-012 – Child Nutrition Cluster - Inadequate Procurement Policies and Procedures Federal Agency: U.S. Department of Agriculture Federal Program: Child Nutrition Cluster Assistance Listing Numbers: 10.553, 10.555, 10.559 Compliance Requirement: Procurement, Suspension, and Debarment Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria Pursuant to 2 CFR §§ 200.318 through 200.326, non-Federal entities are required to establish and maintain documented procurement procedures that comply with Federal procurement standards applicable to Federal awards. Additionally, 2 CFR § 200.303 requires non-Federal entities to establish and maintain effective internal controls over Federal awards that provide reasonable assurance that the entity is managing Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of Federal awards. Written procurement policies should incorporate applicable Federal procurement methods, competition requirements, documentation standards, and suspension and debarment requirements to facilitate compliance with Uniform Guidance. Condition During testing of procurement and suspension and debarment requirements for the Child Nutrition Cluster, UHY noted that the County's procurement policy did not fully incorporate all requirements prescribed by Uniform Guidance, including certain Federal procurement standards and documentation requirements outlined in 2 CFR §§ 200.318 through 200.326. Although procurements tested during the audit were generally conducted in accordance with applicable requirements, the written procurement policy had not been updated to fully reflect all Federal procurement requirements applicable to federally funded procurements. Context During testing of procurement and suspension and debarment requirements for the Child Nutrition Cluster, UHY noted that the County's procurement policy did not fully incorporate all requirements prescribed by Uniform Guidance, including certain Federal procurement standards and documentation requirements outlined in 2 CFR §§ 200.318 through 200.326. Although procurements tested during the audit were generally conducted in accordance with applicable requirements, the written procurement policy had not been updated to fully reflect all Federal procurement requirements applicable to federally funded procurements. Cause Management had not updated the County's procurement policy to incorporate all applicable Federal procurement requirements prescribed by Uniform Guidance. Existing procedures relied upon management's knowledge and application of procurement requirements rather than a procurement policy that fully documented Federal requirements. Effect Because the County's procurement policy does not fully align with Uniform Guidance requirements, there is an increased risk that procurements charged to Federal awards may not be conducted or documented in accordance with applicable Federal requirements. The absence of a procurement policy that fully incorporates Federal procurement standards increases the likelihood that instances of noncompliance could occur and not be prevented or detected on a timely basis. Accordingly, this matter represents a significant deficiency in internal control over compliance. Identification as a Repeat Finding, if Applicable No. Questioned Costs None identified. Recommendation Management should revise and update the County's procurement policy to incorporate all applicable requirements prescribed by 2 CFR §§ 200.318 through 200.326, including Federal procurement methods, competition requirements, documentation standards, and suspension and debarment requirements. Management should also implement procedures to periodically review changes in Federal grant requirements and update policies and procedures accordingly. Responsible Official Superintendent of Schools and Finance Director Views of Responsible Official The County concurs with the recommendation and will review and revise its procurement policy to incorporate all applicable Federal procurement requirements under Uniform Guidance. Management will also implement procedures to periodically monitor changes to Federal grant requirements and update procurement policies and procedures as necessary to ensure continued compliance with Federal requirements.

Reference Number: Prior Year Finding: 2025-007 N/A Federal Agency: U.S. Department of Housing and Urban Development Federal Program: Community Development Block Grants/Entitlement Grants Assistance Listing Number: 14.218 Award Number and Year: B-24-MC-33-0001 (7/1/2024-6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR Part 170, Appendix A, prime recipients must report each first-tier subaward obligating action of $30,000 or more to SAM.gov (formerly FSRS) no later than the end of the month following the month in which the obligation was made. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The City of Manchester, New Hampshire (City) did not report subaward information in accordance with FFATA requirements. CITY OF MANCHESTER, NEW HAMPSHIRE SCHEDULE OF FINDINGS AND QUESTIONED COSTS (CONTINUED) YEAR ENDED JUNE 30, 2025 (19) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: One of one subaward selected for testing was not reported timely. The subaward was reported 26 days late. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 1 0 1 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $576,845 $0 $576,845 $0 $0 Cause: The City’s procedures and controls were not sufficient to ensure that subawards were reported no later than the end of the month following the month of issuance. Effect: Subawards were not submitted timely in accordance with FFATA reporting requirements. Questioned costs: None. Recommendation: We recommend the City strengthen procedures and internal controls to ensure that all required subawards are reported timely and accurately no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: Prior Year Finding: 2025-008 N/A Federal Agency: U.S. Department of Housing and Urban Development Federal Program: Community Development Block Grants/Entitlement Grants Assistance Listing Number: 14.218 Award Number and Year: B-24-MC-33-0001 (7/1/2024-6/30/2025) Compliance Requirement: Special Tests and Provisions – Environmental Reviews Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The environmental review process consists of all the actions that a responsible entity must take to determine compliance with this part. The environmental review process includes all the compliance actions needed for other activities and projects that are not assisted by HUD but are aggregated by the responsible entity in accordance with § 58.32. (24 CFR 58.30) The responsible entity must maintain a written record of the environmental review undertaken under this part for each project. This document will be designated the “Environmental Review Record” (ERR) and shall be available for public review. The ERR must contain all environmental review documents, public notices, written determinations or environmental findings required by this part as evidence of review, decision-making, and actions pertaining to the project. The ERR must describe the project and related activities, evaluate the effects of the project or activities on the human environment, document compliance with applicable statutes and authorities, including those cited in §§ 58.5 and 58.6, and record the written determinations and other review findings required by this part. The ERR must also contain verifiable source documents and relevant base data used or cited in environmental assessments, environmental impact statements, or other project review documents. (24 CFR 58.38) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The City of Manchester, New Hampshire (City) did not maintain documentation evidencing that environmental reviews were conducted for all applicable projects. Context: For one of eight projects selected for testing, the environmental review worksheet documenting that an environmental review had been conducted was not available. As such, the auditor was unable to determine if the environmental review had been performed by the City. CITY OF MANCHESTER, NEW HAMPSHIRE SCHEDULE OF FINDINGS AND QUESTIONED COSTS (CONTINUED) YEAR ENDED JUNE 30, 2025 (21) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The City’s procedures and controls were not sufficient to ensure that environmental review certifications were prepared and retained as part of the environmental review process. Effect: The City was unable to ensure that the required review was performed, documented and approved prior to the expenditure of federal funds. Questioned costs: Unable to determine. Recommendation: We recommend the City strengthen procedures and internal controls to ensure that environmental review certifications are prepared and retained, evidencing that the environmental reviews were completed. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: Prior Year Finding: 2025-009 N/A Federal Agency: U.S. Department of Transportation Federal Program: Airport Improvement Program, Infrastructure Investments and Jobs Act Programs, and COVID-19 Airports Programs Assistance Listing Number: 20.106 Award Number and Year: 3-33-0011-124-2021, 2021 3-33-0011-137-2022, 2022 3-33-0011-138-2022, 2022 3-33-0011-139-2022, 2022 3-33-0011-140-2023, 2023 3-33-0011-142-2023, 2023 3-33-0011-143-2024, 2024 3-33-0011-134-2025, 2025 3-33-0011-144-2025, 2025 3-33-0011-146-2025, 2025 3-33-0011-147-2025, 2025 Compliance Requirement: Equipment and Real Property Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: A physical inventory of the property must be conducted, and the results must be reconciled with the property records at least once every two years. (2 CFR 200.313(d)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The City performed an annual physical inventory of equipment acquired under the Federal program; however, the annual physical inventory was incomplete. Context: During testing, we selected a sample of five assets from the federal financial records which document equipment acquired under the Federal program. One of five assets selected for testing from the federal financial records was not included in the annual inventory list. Cause: The City's procedures and controls were not sufficient to ensure that all equipment acquired under the Federal program was accurately recorded and included in the annual inventory list and reconciled to the results of the physical inventory. CITY OF MANCHESTER, NEW HAMPSHIRE SCHEDULE OF FINDINGS AND QUESTIONED COSTS (CONTINUED) YEAR ENDED JUNE 30, 2025 (23) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: The equipment records may not be complete or accurately reflect the existence, location, or condition of all assets acquired under the Federal program, and the City may not timely identify missing, obsolete, or improperly recorded equipment. Questioned costs: None. Recommendation: We recommend the City strengthen procedures and internal controls to ensure that all equipment acquired under the Federal program is accurately recorded and included in the annual inventory list, and that the annual physical inventory is reconciled to the equipment records. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: Prior Year Finding: 2025-010 2024-005 Federal Agency: U.S. Department of Treasury Federal Program: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: ARP17SL1 (5/23/2021 - 12/31/2026) Compliance Requirement: Procurement Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Audit documentation must be made available upon request to the cognizant or oversight agency for audit or its designee, cognizant agency for indirect cost, a Federal agency, or GAO at the completion of the audit, as part of a quality review, to resolve audit findings, or to carry out oversight responsibilities consistent with the purposes of this part. Access to audit documentation includes the right of Federal agencies to obtain copies of audit documentation as is reasonable and necessary. (2 CFR 200.517(b)) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The City could not provide complete procurement and contract documentation timely for audit review. Context: For two of eight contracts selected for testing, the City did not provide contract files or related procurement documentation, including the executed contract, procurement method, vendor selection support, or other documentation evidencing compliance with applicable procurement requirements. Cause: The City’s policies and procedures were not sufficient to ensure procurement and contract documentation related to Federal awards was centrally retained, complete, and readily available for audit. In addition, the City’s document retention and monitoring controls did not ensure that contract files contained all required supporting documentation prior to or during the audit period. CITY OF MANCHESTER, NEW HAMPSHIRE SCHEDULE OF FINDINGS AND QUESTIONED COSTS (CONTINUED) YEAR ENDED JUNE 30, 2025 (25) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: Since the City was unable to provide complete procurement and contract documentation, auditors could not verify whether the selected procurements complied with applicable Federal procurement requirements or whether the City maintained sufficient documentation to support the allowability and compliance of the related expenditures. The lack of available documentation increases the risk that procurement transactions may not be properly supported, reviewed, or conducted in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Questioned costs: Unable to determine. Recommendation: We recommend that the City strengthen its internal controls over procurement and contract documentation for Federal awards. Such procedures should require that complete contract files, including executed agreements, procurement method documentation, vendor selection support, approvals, and other required supporting documentation, be retained in a centralized location and reviewed for completeness. The City should also establish monitoring procedures to ensure documentation is maintained in accordance with Federal requirements and is available timely for audit or other oversight review. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: Prior Year Finding: 2025-011 N/A Federal Agency: U.S. Department of Treasury Federal Program: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: ARP17SL1 (5/23/2021 - 12/31/2026) Compliance Requirement: Suspension and Debarment Type of Finding: Material Weakness in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Audit documentation must be made available upon request to the cognizant or oversight agency for audit or its designee, cognizant agency for indirect cost, a Federal agency, or GAO at the completion of the audit, as part of a quality review, to resolve audit findings, or to carry out oversight responsibilities consistent with the purposes of this part. Access to audit documentation includes the right of Federal agencies to obtain copies of audit documentation as is reasonable and necessary. (2 CFR 200.517(b)) Recipients and subrecipients are subject to the nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, as well as 2 CFR part 180. The regulations in 2 CFR part 180 restrict making Federal awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from receiving or participating in Federal awards (2 CFR 200.214). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The City could not provide complete documentation to evidence the City ensured contractors were not suspended or debarred prior to entering into the contract. Context: Two of eight contracts selected for testing were not available for review. No contract information was provided for these agreements and therefore no support related to ensuring that a contractor was not suspended or debarred was available. In addition, for an additional three of eight contracts selected for testing, documentation did not contain the necessary suspension and debarment certifications or review checks. CITY OF MANCHESTER, NEW HAMPSHIRE SCHEDULE OF FINDINGS AND QUESTIONED COSTS (CONTINUED) YEAR ENDED JUNE 30, 2025 (27) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The City’s policies, procedures, and internal controls were not sufficient to ensure that contract files included or retained documentation supporting suspension and debarment verification checks. Effect: Without complete contract files and documented suspension and debarment verification, the City could not demonstrate compliance with Federal requirements. This increases the risk that Federal funds could be used in transactions with contractors that are suspended, debarred, or otherwise excluded from participation in Federal awards. Questioned costs: None. Recommendation: We recommend that the City strengthen its written policies, procedures, and internal controls to require suspension and debarment verifications before entering into Federally funded contracts and that verification be readily available for audit. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: Prior Year Finding: 2025-012 N/A Federal Agency: U.S. Department of Treasury Federal Program: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: ARP17SL1(5/23/2021 - 12/31/2026) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Non-federal entities are required to submit Financial and Performance Measure Reports in accordance with the terms and conditions of the Federal award. Recipients of Coronavirus State and Local Fiscal Recovery Funds are required to submit complete and accurate Project and Expenditure Reports in accordance with the terms and conditions of the Federal award and applicable U.S. Department of the Treasury reporting guidance. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The City did not retain sufficient point-in-time documentation to support amounts reported in the quarterly Project and Expenditure Reports. As a result, certain cumulative expenditure amounts reported to the U.S. Department of the Treasury could not be reconciled to the underlying Expenditure and Obligation data maintained by the City at the time the reports were prepared and submitted. Context: Two of four quarterly reports were selected for testing. For two of the two quarterly reports selected, seven project line items could not be tied to underlying Expenditure and Obligation data supporting the cumulative expenditure amounts reported. Because the City did not maintain a point-in-time reporting support package or other documentation showing how the reported amounts were derived, management was unable to provide sufficient audit evidence to support the accuracy and completeness of those reported line items. Cause: The City’s policies and procedures were not designed or operating effectively to ensure that quarterly reporting amounts were supported by retained documentation that agreed to the City’s underlying accounting records. In addition, the City did not maintain a formal review and reconciliation process requiring personnel to preserve the source reports, reconciliations, and approvals used to support cumulative expenditure line items prior to report submission. CITY OF MANCHESTER, NEW HAMPSHIRE SCHEDULE OF FINDINGS AND QUESTIONED COSTS (CONTINUED) YEAR ENDED JUNE 30, 2025 (29) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: The City was unable to demonstrate compliance with the Reporting requirement for the selected quarterly reports. Without retained support that ties reported cumulative expenditures to the underlying records, there is an increased risk that amounts reported to the U.S. Department of the Treasury may be inaccurate, incomplete, or not supported by sufficient audit evidence. Questioned costs: None. Recommendation: We recommend that the City strengthen its internal controls over Federal Financial reporting by developing and implementing written procedures requiring all cumulative expenditure line items reported in the Project and Expenditure Reports to be reconciled to underlying accounting records prior to submission. The procedures should also require retention of a point-in-time support package for each report, including the source reports, reconciliations, explanations for adjustments, evidence of supervisory review, and documentation of report certification. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: Prior Year Finding: 2025-013 N/A Federal Agency: U.S. Department of Treasury Federal Program: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: ARP17SL1(5/23/2021 - 12/31/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pass-through entities should verify that subrecipients expected to be audited as required by 2CFR Part 200, Subpart F, met this requirement (2CFR section 200.322(f). The pass-through entity should also ensure that the subrecipient takes timely and appropriate correction action on deficiencies detected through audits. These reviews should be documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The City did not retain evidence that subrecipient single audit reports were reviewed as required. Context: Two of five subrecipients selected for testing were required to submit Single Audit Reports to the Federal Audit Clearinghouse. The City could not provide evidence that these reports were obtained and reviewed as part of the subrecipient monitoring process. Cause: The City’s policies and procedures were not sufficient to ensure that subrecipient single audit report reviews were documented and retained. The City did not have a formalized process to track which subrecipients were subject to single audit requirements, document the review of submitted reports, and maintain evidence that any required follow-up on subrecipient single audit finding or matters impacting the federal awards were made. CITY OF MANCHESTER, NEW HAMPSHIRE SCHEDULE OF FINDINGS AND QUESTIONED COSTS (CONTINUED) YEAR ENDED JUNE 30, 2025 (31) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: The City was not in compliance with Subrecipient Monitoring related requirements and did not have sufficient documentation to demonstrate that it evaluated relevant subrecipient audit results when assessing subrecipient risk and determining the appropriate level of monitoring. Without evidence of the reviews, there is an increased risk that subrecipient audit findings, questioned costs, or other matters affecting the Federal program may not be identified, evaluated, or addressed timely. Questioned costs: None. Recommendation: We recommend that the City strengthen internal controls and procedures to ensure that all subrecipient monitoring checks are performed and documented. Such procedures should include identifying subrecipients subject to Single Audit requirements, obtaining and reviewing applicable Single Audit Reports, documenting the results of the review, retaining evidence of the review, and tracking any required follow-up or corrective action related to findings impacting the Federal award. Views of Responsible Officials: There is no disagreement with the finding

Compliance Requirement L. Reporting Finding Type Significant Deficiency in Internal Control Over Compliance Federal Agency U.S. Department of Treasury Federal Program Title Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number 21.027 Criteria or Specific Requirement: L. Reporting - 2 CFR section 200.303 of the Uniform Guidance requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The program requires submission of quarterly reports to the pass-through grantor by the 20th day of the month following the end of the quarter. Condition: During the audit, it was noted that the Organization did submit the quarterly reports in timely fashion. However, the Organization was unable to provide formal support for the internal review of the required reports under the major program before they were submitted to the pass-through grantor. Cause: The Organization lacks established procedures which provide formal evidence that the accuracy and completeness of required reports were verified before submission. Effect or Potential Effect: Without formal review controls in place, the Organization is more susceptible to reporting errors and/or noncompliance with federal requirements. Questioned costs: None Identification as a Repeat Finding: N/A - this was not reported as a finding in the prior audit report. Context: Of the four (4) quarterly reports tested, none contained formal support that an internal review took place prior to submission to the pass-through grantor. Recommendation: We recommend that the Organization implement a formal process for verifying the accuracy and completeness of required reports before submission. Views of Responsible Officials: The Organization disagrees with this audit finding.

Reference Number: 2025 – 001 Federal Agency: U.S. Department of Agriculture Federal Program Name: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555 Pass-through Agency: Pennsylvania Department of Education Pass-through Entity Number: N/A Federal Award Identification Number and Year: 241PA305N1199, 251PA305N1199 Award Period: 07/1/2024 to 6/30/2025 Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or Specific Requirement: Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The District was unable to provide evidence of independent review and approval for three of three reporting samples tested. Questioned Costs: None Context: The District did not properly review and approve three of three SNP Claim for Reimbursement Summary reports. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The District did not have internal controls established to ensure proper review and approval of the SNP Claim for Reimbursement Summary report. Effect: There is a risk that meals submitted for reimbursement were overstated or understated. Repeat Finding: No Recommendation: We recommend that the District implement procedures to ensure that SNP Claim for Reimbursement Summary reports are independently reviewed and approved prior to submission to Program Electronic Application and Reimbursement System (PEARS). This review should be performed by an individual who is not involved in the preparation of the reports and evidence of the review should be documented.

Finding 2025-004 – Various Federal Programs: Cash Management – Excess Federal Cash, Untimely Reconciliations (Material Weakness): Information on the federal program – Strengthening Historically Black Colleges and Universities (HBCUs), (Title III), FAL No. 84.031B, June 30, 2025; Historically Black Colleges and Universities (HBCU) (FUTURE ACT), FAL No. 84.031E, June 30, 2025; Minority Science and Engineering Improvement Program (MSEIP), FAL No. 84.120A, June 30, 2025; Science Consortium of Minority Schools, FAL No. 84.120A, June 30, 2025; Empowerment of Undergraduate STEM Majors through Scholarships and Strengthening STEM Identity, FAL No. 47.076, June 30, 2025; Tennessee Louis Stokes (TSLAMP), FAL No. 47.076, June 30, 2025. Criteria – 2 CFR §200.303 requires non-Federal entities to establish and maintain effective internal control over federal awards. 2 CFR §200.305(b) requires that payments be limited to the minimum amounts needed and timed to be in accordance with the actual, immediate cash requirements of the non-Federal entity. 2 CFR §200.308 requires that expenditures remain within approved budget limits unless prior approvals are obtained. Condition – At June 30, 2025, the College maintained excess federal cash balances across multiple federal programs, indicating that cash drawdowns and/or payable balances were not aligned with immediate cash needs for allowable program expenditures. These balances represented federal funds drawn or recorded as payable to federal agencies that were not supported by actual and immediate allowable program expenditures at year-end. The following table summarizes excess federal cash balances identified by program as of June 30, 2025: "Minority Science and Engineering Improvement Program" 120,031 "Science Consortium of Minority Schools" 169,907 "NSF - Empowerment of Undergraduate STEM Majors" 94,801 "NSF - Tennessee Louis Stokes TSLAMP" 54,834 "Title 111" 455,679 "FUTURE" 188,215 "Total Identified Excess Cash" "$ 1,083,467" Condition – (Continued) The College did not adequately reconcile federal cash activity to underlying grant expenditures on a timely basis and did not ensure that drawdowns were limited to amounts necessary to meet immediate cash needs. In addition, the College lacked effective monitoring controls to identify and resolve excess cash positions across federal programs in a timely manner. Federal bank reconciliations were untimely and error-prone. Corrections occurred only after auditor inquiry. Federal accounts also earned excess interest. Cause – The College lacked sufficient policies, procedures, and supervisory review controls to ensure that federal cash drawdowns were based on actual expenditures, that federal cash and grant reconciliations were prepared timely and accurately. Additionally, monitoring controls over cash balances, interest tracking and remittance were not effectively designed or implemented across federal programs. Effect – The lack of effective controls over federal cash management resulted in excess cash being maintained beyond immediate program needs. These conditions increase the risk of noncompliance with federal requirements, including potential return of excess cash or disallowed costs, and increase the risk of material misstatement of federal expenditures and cash balances. Questioned Costs – $1,083,467 Repeat Finding – No Auditor’s Perspective – From a compliance perspective, maintaining excess federal cash balances indicates that the College’s internal control over compliance did not operate effectively during the audit period. The condition demonstrates that drawdowns were not consistently based on actual incurred costs and that monitoring over federal cash was not functioning as designed. Given the pervasiveness of these conditions across multiple programs, this represents a systemic control deficiency. In accordance with 2 CFR §200.303 and auditing standards, this condition constitutes a material weakness in internal control over compliance. Auditor’s Recommendation – We recommend that the College strengthen controls over federal cash management and budget monitoring by implementing procedures to ensure that drawdowns are based on actual allowable expenditures and limited to immediate cash needs. Management should establish and enforce timely grant and federal bank reconciliation processes, monitor interest earnings and federal cash balances, and implement supervisory review controls to ensure compliance with federal requirements across all programs. Views of Responsible Officials – The College requests drawdowns for Title III and FUTURE programs on a reimbursable basis, including review and approval procedures. Of the total amount identified for the Title III program, a $181,433 receivable related to FY2025. The balance related to prior year(s) activity. The College will review its Federal program cost allocation procedures to ensure all eligible costs are properly identified and supported. The College has engaged two accounting firms to assist with staff training and bring all reconciliations current. In addition, standard month-end and year-end closing procedures will be implemented to address timely, accurate Federal program reconciliations and audit readiness going forward. The College experienced significant staff turnover within the business office. In addition, the College is undergoing conversion to a new Enterprise Resource Planning (ERP) system which affected its ability to complete some functions within a timely manner.

Program: HOME Investment Partnerships Program Federal Financial Assistance Listing Number: 14.239 Federal Grantor: U.S. Department of Housing and Urban Development Award Number and Year: M16-MC060227; M17-MC060227; M20-MC060227; M21-MC060227; M23-MC060227; M24-MC060227 Compliance Requirement: Special Tests and Provisions – Wage Rate Requirements Type of Finding: Material Weakness in Internal Control over Compliance and Material Non-Compliance Criteria: All laborers and mechanics employed by contractors or subcontractors to work on construction contracts in excess of $2,000 financed by federal assistance funds must be paid wages not less than those established for the locality of the project (prevailing wage rates) by the Department of Labor (DOL) 40 USC 3141–3144, 3146, and 3147. Nonfederal entities shall include in their construction contracts subject to the Wage Rate Requirements a provision that the contractor or subcontractor comply with those requirements and the DOL regulations (29 CFR Part 5, Labor Standards Provisions Applicable to Contacts Governing Federally Financed and Assisted Construction). This includes a requirement for the contractor or subcontractor to submit to the nonfederal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls) (29 CFR sections 5.5 and 5.6; the A-102 Common Rule (section 36(i)(5)); OMB Circular A-110 (2 CFR Part 215, Appendix A, Contract Provisions); 2 CFR Part 176, Subpart C; and 2 CFR section 200.326. 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. This includes internal controls over maintaining records of the receipt and review of certified payrolls. Condition: During our audit procedures, we noted that the City was unable to provide a schedule of weeks of performance for construction projects active during fiscal year 2025. As a result, we were unable to determine the applicable periods subject to Davis-Bacon requirements. Additionally, the City was unable to provide certified payroll reports for the project selected for testing. As such, we were unable to verify that contractors complied with applicable prevailing wage rate requirements. Cause: The City has not established and implemented adequate procedures to track construction project activity and maintain required documentation, including certified payroll reports, to support compliance with Davis-Bacon wage rate requirements. Effect: The lack of documentation and monitoring procedures increases the risk that contractors may not comply with prevailing wage requirements and that noncompliance would not be identified or corrected in a timely manner. Additionally, the absence of sufficient audit evidence resulted in a scope limitation over compliance with wage rate requirements. Questioned Costs: None identified. However, due to the lack of supporting documentation, we were unable to determine whether questioned costs may exist. Context/Sampling: Our procedures included selecting one construction project subject to Davis-Bacon requirements for testing. We requested supporting documentation, including a schedule of weeks of performance and certified payroll reports. However, the City was unable to provide the requested documentation. Repeat Finding from Prior Year: No. Recommendation: The City should implement formal written policies and procedures to ensure compliance with Davis-Bacon wage rate requirements. This should include maintaining a complete schedule of construction project activity, obtaining and retaining certified payroll reports, and performing documented reviews to verify compliance with prevailing wage requirements. Views of Responsible Officials and Planned Corrective Action: Management agrees. See separately issued Corrective Action Plan.

Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds / HOME Investment Partnership Program Federal Financial Assistance Listing Number.: 21.027 / 14.239 Federal Grantor: U.S. Department of the Treasury / U.S. Department of Housing and Urban Development Award Number and Year: Affects all grant awards included under assistance listing 14.239 and 21.027 on the Schedule of Expenditures of Federal Awards. Compliance Requirement: Other – Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) §200.510(b) - Schedule of Expenditures of Federal awards Type of Finding: Material Weakness in Internal Control over Compliance Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) §200.510(b) states that the auditee (the City) must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee’s financial statements, which must include the total federal awards expended as determined in accordance with §200.502. §200.331 of the Uniform Guidance states the City is responsible for making case-by-case determinations to determine whether the entity receiving the Federal funds is a subrecipient. In addition, §200.303 of the Uniform Guidance states that the City must establish and maintain effective internal control over the federal awards, including controls over the accuracy of program information and expenditure amounts. Condition: During our audit procedures performed over the SEFA we noted the following: • The City did not properly identify the amount expended for the COVID-19 Coronavirus State and Local Fiscal Recovery Funds, AL No. 21.027. The expenditures reported by the City were understated by $176,324. • The City did not properly identify the amount of Federal funding passed through to subrecipients for the COVID-19 Coronavirus State and Local Fiscal Recovery Funds, AL No. 21.027. The amount passed through to subrecipients reported by the City was understated by $418,183. • The City did not properly identify the amount of Federal funding passed through to subrecipients for the Home Investment Partnerships Program, AL No. 14.239. The amount passed through to subrecipients reported by the City was overstated by $2,591,181. Cause: As a result, the City lacked adequate internal controls to ensure the SEFA is completely and accurately stated. Specifically, the City’s processes for recording and tracking expenditures of Federal awards are not designed so that expenditures are identified when incurred. In addition, the City’s processes for identifying and reporting subrecipients are not designed to ensure appropriate reporting on the SEFA. Effect: Adjustments to the SEFA were required. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: No sampling was used. Program expenditures and amounts passed through to subrecipients were reconciled to the supporting records. Repeat Finding from Prior Year: No. Recommendation: The City, including all its reporting departments, should follow existing policies, procedures and internal controls to ensure all expenditures and amounts passed through to subrecipients are accurately tracked and reported on the SEFA. Personnel knowledgeable of federal expenditures should review amounts coded to federal programs for completeness and accuracy. The SEFA should be prepared and reviewed in a timely manner and reconciled to underlying records as well as the basic financial statements. Views of Responsible Officials and Planned Corrective Action: See separate corrective action plan.

Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Federal Financial Assistance Listing Number: 21.027 Federal Grantor: U.S. Department of the Treasury Award Number and Year: 2021 Compliance Requirement: Procurement and Suspension and Debarment Type of Finding: Material Weakness in Internal Control over Compliance and Material Non-Compliance Criteria: 2 CFR section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Title 2 CFR Section 200.214 of the Uniform Guidance states that the City must comply with 2 CFR part 180, which implements Executive Orders 12549 and 12689. The regulations in 2 CFR part 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. Per 2 CFR Section 180.300, when a non-Federal entity enters into a covered transaction with an entity at a lower tier, the non-Federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA) and available at https://www.sam.gov/SAM/, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. 2 CFR 200.327 Contract provisions. The recipient's or subrecipient's contracts must contain the applicable provisions described in Appendix II to Part 200—Contract Provisions for Non-Federal Entity Contracts Under Federal Awards. Condition: During our testing of the City’s provisions for procurement requirements, we noted the following: • For seven (7) out of seven (7) contracts selected for testing, the City did not include the applicable provisions described in 2 CFR 200 Appendix II. • For seven (7) out of seven (7) contracts tested, we noted that there was no evidence that the City verified that the contracted entities were not suspended or debarred or otherwise excluded from participating in federal programs prior to entering the contract. Cause: The City did not follow their policy to verify the information described in the conditions prior to entering the transactions. The City’s policy does not include the requirement to include each of the applicable provisions identified in 2 CFR 200 Appendix II in its contracts or purchase orders. Effect: Failure to implement and maintain a proper control process could result in payments to vendors that are suspended or debarred or improper awarding of contracts under the procurement guidance. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of seven (7) out of fifteen (15) procurement contracts were tested. This represented a total of $23,361,562 in contracted services under the grant. Repeat Finding from Prior Year: No. Recommendation: We recommend the City strengthen its policies and procedures to ensure that the verification of the debarment and suspension is documented and retained and that contracts include all applicable provisions of 2 CFR 200 Appendix II. Views of Responsible Officials and Planned Corrective Action: Management agrees. See separately issued Corrective Action Plan.

Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Federal Financial Assistance Listing Number: 21.027 Federal Grantor: U.S. Department of the Treasury Award Number and Year: 2021 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance and Material Non-Compliance Criteria: In accordance with Title 2 U.S. Code of Federal Regulations (CFR) 200.332, pass-through entities must comply with the following: • 2 CFR Part 200.332(a), Requirements for Pass-Through Entities, states that all passthrough entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information as well as all the requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations, and the terms and conditions of the award. • 2 CFR 200.332(b) – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors listed in 2 CFR 200.332(b)(1) through (4). • 2 CFR 200.332(d)- Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include the information at 2 CFR 200.332(d)(1) through (4). • 2 CFR 200.332(f) – Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 200.501. • 2 CFR section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: We noted for three (3) of three (3) subrecipients selected for testwork, the City did not perform any of the required subrecipient monitoring procedures as required under 2 CFR 200.332 (a. through i.). As a result, we were unable to perform audit procedures over Subrecipient Monitoring compliance requirements. Cause: The City did not have adequate policies and procedures in place to monitor subrecipient in accordance with 2 CFR 200.332. Effect: The City did not have procedures in place requiring compliance with the Subrecipient Monitoring requirements in 2 CFR 200.332 and as such did not comply with subrecipient monitoring requirements related to the program. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of three (3) of three (3) subrecipients were sampled. Repeat Finding from Prior Year: No. Recommendation: The City should implement policies and procedures to ensure that subrecipients are properly identified at the time of award and accurately reported on the SEFA. Additionally, the City should establish and perform ongoing subrecipient monitoring procedures in accordance with Federal requirements, including risk assessments and documentation of monitoring activities. Views of Responsible Officials and Planned Corrective Action: Management agrees. See separately issued Corrective Action Plan.

FINDING 2025-004 – Material Weakness in Internal Controls over Compliance Federal Agency: U.S. Department of Health and Human Services Federal Program: Maternal Infant and Early Childhood Home Visiting (MIECHV) Assistance Listing Number: 93.870 Compliance Requirements: Activities Allowed or Unallowed / Allowable Costs / Procurement and Suspension and Debarment / Reporting Type of Finding: Material Weakness in Internal Control Over Compliance Criteria The Uniform Guidance requires non-federal entities receiving federal awards to establish and maintain effective internal control over federal awards that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Under 2 CFR § 200.303, the auditee is required to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the auditee is managing the award in compliance with applicable requirements. In addition, 2 CFR § 200.516 requires the auditor to report significant deficiencies and/or material weaknesses in internal control over major programs as audit findings in the schedule of findings and questioned costs. Condition During our audit of the federal program identified above, we noted that internal controls over compliance were not designed and/or operating effectively to allow the auditor to rely on those controls for purposes of performing the Single Audit. Specifically, management was unable to provide sufficient evidence that key controls over activities allowed or unallowed, allowable costs, procurement and suspension and debarment, and reporting existed or were consistently performed, reviewed, and documented. Examples noted included the following: • Approval and review controls were not consistently documented. • Supporting documentation was not consistently retained to demonstrate compliance with program requirements. • Control activities were performed informally and were not supported by evidence of review. • Duties related to preparation, approval, and review of compliance information were not adequately segregated. • Management’s monitoring of compliance activities was not sufficiently documented. As a result, we were unable to rely on internal controls over compliance and performed additional substantive procedures to obtain sufficient appropriate audit evidence regarding the entity’s compliance with the applicable federal program requirements. Cause The condition appears to have resulted from insufficient formalization and documentation of internal control procedures over federal program compliance. While certain review or approval procedures may have been performed, the entity did not maintain adequate documentation to demonstrate that those controls were performed timely, consistently, and by appropriate personnel. In addition, the entity experienced significant turn over in external bookkeeping firms and management during the fiscal year. Additionally, they undertook an accounting software transition that resulted in significant delays in timely recording of accounting transactions and monitoring of controls. Effect or Potential Effect When internal controls over compliance are not adequately designed, implemented, or documented, there is an increased risk that noncompliance with federal statutes, regulations, or award terms and conditions could occur and not be prevented, detected, or corrected in a timely manner. Although our substantive audit procedures did not identify material noncompliance with the applicable compliance requirements, the lack of effective and documented internal controls limited the auditor’s ability to rely on those controls and increased the risk of errors or noncompliance related to the federal program. Questioned Costs None noted Context The federal program identified above was audited as a major program for the year ended June 30, 2025. During our audit procedures, we selected samples related to payroll disbursements, direct grant expenditures, and reporting for grant reimbursements and evaluated whether internal controls over compliance were designed and operating effectively. Based on the procedures performed, we determined that the entity did not maintain sufficient evidence of control performance to support reliance on internal controls over compliance for the applicable compliance requirement. Repeat Finding This is not a repeat finding. Sampling Method Not applicable Recommendation We recommend that management strengthen its internal controls over federal program compliance by implementing formal written procedures that identify the specific controls to be performed, the personnel responsible for performing and reviewing those controls, and the documentation required to evidence control performance. At a minimum, management should: • Develop written policies and procedures for each applicable compliance requirement. • Identify key controls over compliance and assign responsibility for performance and review. • Maintain documentation evidencing review, approval, and monitoring activities. • Provide training to program and finance personnel regarding federal compliance requirements and Single Audit documentation expectations. • Periodically monitor compliance activities to ensure controls are operating as designed. • Design controls that limit the risk of management override.

Statement of Condition During the year ended June 30, 2025, the Project did not make all of the required monthly deposits to the replacement reserve. The Project is required to make monthly deposits of $1,915, or $22,980 annually. During the year ended June 30, 2025, the Project deposited $20,064 to the replacement reserve. Therefore, the replacement reserve was underfunded by $2,916 for the year ended June 30, 2025. Criteria The Housing Assistance Payments (HAP) contract between Sunrise Residential, Inc. and the U.S. Department of Housing and Urban Development (HUD) requires that a monthly deposit of $1,915 be made to the replacement reserve account to ensure funds are available for the replacement of capital items. In addition, 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Adequate funding of the replacement reserve is necessary to comply with the terms of the HAP contract and to ensure the long-term physical and financial viability of the property. Cause The underfunding of the replacement reserve account resulted from a breakdown in the automatic monthly transfer process between the operating cash account and the replacement reserve account. When the required monthly replacement reserve deposit amount was subsequently revised per the terms of the (HAP) contract, the automatic transfer instructions were not updated to reflect the correct deposit amount. As a result, the automatic transfer continued to move funds based on an outdated deposit amount rather than the amount currently required under the HAP contract. This discrepancy went undetected because there was no compensating control in place to periodically reconcile the automatic transfer amount to the deposit requirement stipulated in the HAP contract, allowing the underfunding to continue and accumulate over multiple reporting periods before being identified. Effect As a result of the underfunded replacement reserve, the property may not have sufficient funds available to cover the cost of major capital replacements as they become necessary, which could jeopardize the physical condition of the property and its ability to continue providing safe and decent housing. Continued underfunding increases the risk of deferred maintenance, unbudgeted special assessments, or the need for additional financing, and represents noncompliance with the terms of the HAP contract, which could result in findings by HUD, required corrective action, or in severe cases, administrative sanctions. Questioned Costs None noted. Perspective This audit finding is systematic. Statistical Sample A statistical sample is not applicable to this finding. Repeat Finding This audit finding is a repeat finding. Recommendation We recommend that management immediately revise the automatic monthly transfer instructions between the operating cash account and the replacement reserve account to reflect the current monthly deposit amount required under the HAP contract. Management should also calculate the cumulative shortfall between required and actual deposits and make a catch-up deposit, or establish a repayment plan approved by HUD or the Contract Administrator, to restore the replacement reserve to the required funding level. In addition, management should implement a periodic reconciliation control, performed no less than quarterly, in which the automatic transfer amount is compared to the current deposit requirement stipulated in the HAP contract, so that any future changes to the required deposit amount are identified and reflected in the transfer instructions on a timely basis. Finally, management should designate a responsible individual to review and approve any changes to HAP contract terms, including replacement reserve deposit requirements, and to confirm that corresponding updates are made to the related banking and transfer instructions. Auditor Noncompliance Code N – Reserve for replacements deposits View of Responsible Officials Management concurs with the findings and will review internal control policies to ensure monthly replacement reserve deposits are made in accordance with the terms of the HAP contract.

2025-002 —Commingling of Federal Award Funds in the General Ledger Type of Finding: Material weakness in internal control over compliance Federal Program and Specific Federal Award Information All federal grant awards are affected by this finding. Criteria Under 2 CFR 200.302(b)(1), a non-federal entity is required to identify in its accounts all federal awards received and expended and the federal programs under which they were received. Under 2 CFR 200.303, the auditee must establish, document, and maintain effective internal control over federal awards that provides reasonable assurance that the federal awards are managed in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition During our audit we noted that federal award receipts and expenditures for all federal programs were not separately identified in the general ledger. As a result, federal award transactions were commingled in the accounting records and could not be readily traced, accumulated, or reconciled by individual federal award without additional manual analysis outside the general ledger. The condition resulted a material weakness in internal control over compliance, because controls were not designed and/or operating effectively to ensure federal award activity was identified and tracked in the accounting records at the level required by Uniform Guidance. Cause The Organization did not have adequate internal controls, policies, and procedures in place to ensure that all federal awards were separately identified, tracked, and reported in the general ledger in accordance with Uniform Guidance requirements. Specifically: • The Organization had not designed its chart of accounts to separately identify federal award receipts and expenditures by program, award number, award year, funding source, and Assistance Listing number. • Policies and procedures did not require federal award transactions to be coded at the grant or award level when recorded in the general ledger. • Personnel in the finance department are relatively new to the Organization and federal award guidelines related to the structure of the general ledger was not an area for which new personnel have received training. Effect Because federal award funds were commingled in the general ledger, the Organization did not maintain accounting records that readily identified federal awards received and expended by program and award. This increases the risk that: • Federal expenditures may be charged to the incorrect program, award, period, or funding source; • Unallowable or unsupported costs may be charged to federal awards and not detected timely, including increasing the potential to duplicate expenses charged to federal awards; • The schedule of expenditures of federal awards may be incomplete, inaccurate, or not properly reconciled to the accounting records; and • Financial and programmatic reports submitted to the federal agency or pass-through entity may be inaccurate. Questioned Costs No questioned costs were identified as a result of this finding. However, the commingling of federal award activity in the general ledger creates a risk that questioned costs could exist but not be detected without additional analysis. Recommendation We recommend that the Organization strengthen internal controls over federal award accounting and compliance by implementing procedures to ensure federal award activity is separately identified in the accounting records. Such procedures should include, at a minimum: 1. Chart of accounts / project coding — Establish separate general ledger accounts, fund codes, project codes, grant codes, or other accounting identifiers for each federal program and award, including Assistance Listing number, award number, award year, federal agency, and pass-through entity, as applicable. 2. Transaction-level coding — Require all federal receipts and expenditures to be coded to the appropriate federal program and award at the time transactions are recorded in the general ledger. 3. Invoicing for federal grant programs should be generated directly from the general ledger after all expenses for the period are coded and entered. 4. Written policies and procedures — Develop and implement written grant accounting policies that define roles, responsibilities, required coding fields, review procedures, and reconciliation requirements. 5. Training — Provide training to accounting and program personnel responsible for identifying federal awards, recording, approving, and monitoring federal award transactions. Views of Responsible Officials / Management Response Management agrees with the finding. Corrective actions are currently being implemented to strengthen internal controls over federal award accounting and compliance and to ensure federal award activity is separately identified and tracked in the general ledger. (See separately issued corrective action plan.)

Federal Program: ALN 93.575 Child Care and Development Block Grant (CCDBG) Category: Compliance Compliance requirements: Allowable Costs / Cost Principles Record retention Condition: BGCPR did not maintain sufficient documentation to demonstrate compliance with minimum personnel qualification requirements. Criteria: Pursuant to 2 CFR §200.430(a)(2), costs of compensation are allowed only to the extent that the total compensation for individual employees follows an appointment made in accordance with the recipient's or subrecipient's laws, rules, or written policies Additionally, 2 CFR §200.303(a) requires recipients and subrecipients to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance of compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Further, 2 CFR §200.403(g) requires costs charged to Federal awards to be adequately documented. Moreover, pursuant to 2 CFR §200.334, recipients and subrecipients must retain all Federal award records, including financial records, supporting documentation, and statistical records, for a minimum of three years from the date of submission of the final financial report. If litigation, claims, or audit findings are initiated before the expiration of the retention period, the records must be retained until all such matters are resolved and final action has been taken. Context: During testing of four payroll-related transactions selected for Allowable Activities and Allowable Costs compliance testing, we noted that one sampled employee did not meet the minimum educational and experience qualifications established for the position. Cause: For one payroll-related item, the personnel file did not contain documentation demonstrating that the employee met the minimum educational and experience qualifications established for the position. The employee did not possess the required bachelor's degree at the time of promotion. Although management subsequently provided an undated narrative explaining the basis for the hiring decision, no supporting documentation evidencing an approved exception at the time of promotion was maintained in the personnel file. Questioned cost: Amount is below the threshold to be considered a questioned cost. Effect or potential effect: As a result, BGCPR could not demonstrate that the employee's appointment was made in accordance with its established hiring requirements. Consequently, compensation costs charged to the Federal award may not be fully supported as allowable. Recommendation: Ensure personnel files contain documentation demonstrating that employees meet the minimum qualifications for their positions and retain evidence of any approved exceptions or waivers supporting hiring or promotion decisions. Views of officials responsible: BGCPR will provide additional training and guidance to Human Resources personnel to ensure consistent adherence to the internal procedures established. Anticipated completion date: September 30, 2026

Federal Program: ALN 93.575 Child Care and Development Block Grant (CCDBG) Category: Compliance Compliance requirements: Allowable costs Record retention Condition: The BGCPR did not maintain sufficient documentation to demonstrate compliance with employee background check requirements. Criteria: Pursuant to 2 CFR §200.430(a)(2), compensation costs are allowable when appointments are made in accordance with the recipient's written policies and procedures. Further, 2 CFR §200.303(a) requires recipients to establish and maintain effective internal controls to ensure compliance with applicable requirements. Additionally, 2 CFR §200.403(g) requires costs charged to Federal awards to be adequately documented. Moreover, pursuant to 2 CFR §200.334, recipients and subrecipients must retain all Federal award records, including financial records, supporting documentation, and statistical records, for a minimum of three years from the date of submission of the final financial report. If litigation, claims, or audit findings are initiated before the expiration of the retention period, the records must be retained until all such matters are resolved and final action has been taken. Per the BGCPR Human Resources Policies and Procedures Manual, specifically the Required Certifications and Background Check Policy, all employees and leaders must maintain current required certifications and documentation, including Criminal Record Certificate, Health Certificate, Law 300 Certificate, Educational Credentials, and Fingerprint Verification, and must successfully complete applicable background checks before perform their duties. Failure to comply with these requirements may result in restrictions from performing job responsibilities and may affect continued employment. Context: We found that two (2) of the four (4) sample employees lacked documentation, evidencing compliance with BGCPR's required background check procedures. Cause: For two (2) payroll-related items, the personnel files did not contain evidence demonstrating that required background checks had been completed in accordance with the BGCPR's hiring policies. For one employee, the background check was performed after the employee's recruitment date. For the second employee, the required background check documentation was not available in the personnel file at the time of the audit. Although management subsequently provided the documentation after the exception was identified, the evidence indicated that the background check report was printed in July 2026. Accordingly, the personnel files did not contain sufficient documentation to support compliance with the BGCPR's background check requirements during the audited period. Questioned cost: Amount is below the threshold to be considered a questioned cost. Effect or potential effect: As a result, BGCPR could not demonstrate that the employees were hired in accordance with established hiring requirements or that compensation costs charged to the Federal award were supported by adequate documentation. Recommendation: Ensure personnel records are complete, accurate, and maintained in accordance with established policies and procedures Views of officials responsible: BGCPR will provide additional training and guidance to Human Resources personnel to ensure consistent adherence to the internal procedures established. Anticipated completion date: September 30, 2026

Criteria: GLIDE’s award terms for Federal Award No. CE1HS52473 required submission of an annual Federal Financial Report (FFR/SF-425) within 90 calendar days after the end of the budget period. This requirement is consistent with 45 CFR 75.302(a)(2), 75.303, and 75.341 (current 2 CFR 200.302(b)(2), 200.303, and 200.328), which require financial management systems and internal controls sufficient to permit accurate, current, and complete reporting and timely submission of required federal financial reports in accordance with award terms. Condition: For the budget period ended September 29, 2024, the annual FFR was due December 28, 2024. Management submitted the report on January 30, 2025, which was 33 days after the due date Questioned Costs: There were no questioned costs identified. Context: The exception related to the annual FFR tested for this direct HHS award and indicates that report due dates were not effectively tracked and monitored for timely submission. Cause: Controls over tracking award-specific reporting deadlines, preparing the annual FFR, and ensuring timely management review and submission were not operating effectively. Effect: Late submission of required financial reports constitutes noncompliance with award terms and increases the risk of delayed grantor monitoring, delayed payment processing, or other follow-up by the awarding agency. Recommendation: Establish a reporting calendar by award and budget period, assign responsibility for preparation and review of each FFR, require documented supervisory review before submission, and retain evidence of submission and any approved extensions. Repeat finding: This is not a repeat finding.

2025-004 Improve Compliance and Controls Over Reporting Federal Program Information Federal Agency: U.S. Department of the Treasury Award Name: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Pass-Through Entity: Not applicable Award Year: 2021 Compliance Requirement: Reporting Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement 2 CFR 200.303(a) requires the auditee to establish and maintain effective internal control over Federal awards to ensure compliance with Federal statutes, regulations, and terms and conditions. For SLFRF funds, the Treasury Compliance and Reporting Guidance requires recipients to submit accurate and complete Project and Expenditure Reports (P&E Reports), including both current period and cumulative expenditures. Condition and Context During our testing of SLFRF expenditures reported in the 2025 Project and Expenditure (P&E) Report, we noted that the Town’s underlying accounting records and supporting detail did not agree to the amounts reported to Treasury. Specifically, current period and cumulative expenditures per the general ledger and supporting schedules differed from the amounts reported in the P&E Report. No formal reconciliation was performed or documented between the Town’s accounting records and the submitted federal report prior to submission. Cause The discrepancy was caused by the Town’s lack of a formal control requiring reconciliation and detailed review of SLFRF report data to underlying accounting records before submission. In addition, reporting was prepared using manually compiled schedules outside of the general ledger, increasing the risk of error. Effect or Potential Effect Reporting discrepancies noted above increase the risk of noncompliance with federal reporting requirements. Questioned Costs No questioned costs are reported as this requirement is administrative in nature and costs were ultimately deemed allowable. Identification as a Repeat Finding This is not a repeat of a prior finding. Recommendation The Town should implement a formal reconciliation process requiring agreement of current period and cumulative expenditures to the general ledger prior to submission of reports and retain such documentation. Views of Responsible Official and Planned Corrective Action Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

Federal Agency: US Deparment of the Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Assistance Listing Number: 21.027 Federal Award Identification Number and Year: COVID-19 ARPA (American Rescue Plan Act) Pass-Through Agency: N/A Pass-Through Number(s): N/A Compliance Requirement: Procurement – Suspension and Debarment Award Period: March 3, 2021 - December 31, 2024, liquidated by December 31, 2026 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Uniform Guidance (2 CFR §§200.214 and 200.318) prohibits non‑Federal entities from awarding contracts supported by Federal awards to parties that are suspended or debarred. In addition, 2 CFR §200.303 requires non‑Federal entities to establish and maintain effective internal control over Federal awards, including documented policies and procedures to ensure consistent compliance with Federal requirements. Verification of vendor eligibility is typically performed through review of the System for Award Management (SAM.gov) or equivalent documentation prior to contract execution. Condition: During our audit, we noted a deficiency related to suspension and debarment verification and documentation. Specifically, for the procurement transactions tested, Worcester County, Maryland did not document verification that the vendor was not suspended or debarred prior to contract execution. In addition, the County does not have a formally documented suspension and debarment policy. While management indicated that suspension and debarment checks may be performed in practice, the absence of written policies and procedures resulted in inconsistent application and documentation of this required compliance procedure. Questioned costs: N/A Context: Uniform Guidance requires non‑federal entities to ensure that vendors and contractors receiving federal funds are not suspended or debarred from participating in federally funded programs. Effective compliance with this requirement is supported by documented policies and procedures that require verification (e.g., review of the System for Award Management (SAM.gov)) prior to entering into contracts. Cause: The County had not formally documented policies and procedures related to suspension and debarment verification and relied on informal practices and staff knowledge. As a result, suspension and debarment checks were not consistently documented or retained prior to contract execution. Effect: Failure to consistently document suspension and debarment verification increases the risk that the County may enter into contracts with vendors that are ineligible to participate in federally funded programs. While no instances of contracting with suspended or debarred vendors were identified and no questioned costs were noted, these conditions represent noncompliance with Federal procurement documentation requirements and reduce the County’s ability to demonstrate consistent adherence to Uniform Guidance. Repeat Finding: No. Recommendation: We recommend that the County develop and formally document a suspension and debarment policy that requires verification and documentation of vendor eligibility (e.g., SAM.gov review) for all contracts supported by Federal awards prior to execution of the contract. Management should also consider implementing standardized checklists or review controls to promote consistent compliance. Views of Responsible Officials and Planned Corrective Actions: Management concurs. Worcester County plans to update the County purchasing, financial and grant policies to ensure debarment and suspension compliance by implementing procedures aligned with the U.S. Office of Management and Budget Uniform Guidance (primarily 2 CFR Part 200) and the governmentwide debarment rules in 2 CFR Part 180, as adopted by the awarding agency. The corrective action includes implementing a written procurement policy which states that the county will not contract with or issue subawards to parties that are suspended or debarred when federal funds are involved. The Grant/Budget Office will maintain open communication with Procurement regarding federally funded grant projects that will be advertised for bid. After bids are received and before the evaluation committee reviews or recommends an award, the Grant/Budget Office will search the System for Award Management (SAM.gov) exclusion database for each vendor that submitted a bid. A PDF or screenshot of the SAM search for each vendor will be retained in a grant and procurement file. All other federal grants under procurement threshold will need county departments to reach out to the Grant/Budget office before choosing vendors. Departments will need to list their potential vendors for the federal grant and email the Grant/Budget office for debarment verification before moving forward with expending federal grant funding. A PDF or screenshot of the SAM search for each vendor will be sent to the department and a copy kept by Grants/Budget office as well.

Finding 2025-005: Inadequate Controls Over Federal Reimbursement Draw Requests - Significant Deficiency Federal Program: Substance Abuse and Mental Health Services Projects of Regional and National Significance Assistance Listing Number: 93.243 Federal Agency: U.S. Department of Health and Human Services Federal Award Identification Numbers: 5H79TI084239-03, 5H79TI084239-04, 5H79TI084739-02, 5H79TI084739-03, 5H79TI082707-05 Award Year: 2024 and 2025 Criteria: Per 2 CFR § 200.305(b), payment methods must minimize the time elapsing between the transfer of federal funds and the disbursement of those funds by the recipient. For reimbursement payment methods, draw requests should be based solely on allowable, allocable, and paid expenditures. Effective internal controls, as required by 2 CFR § 200.303, include supervisory review of supporting documentation to verify the accuracy, completeness, and allowability of expenditures prior to submitting reimbursement requests. Condition: For 10 of 10 reimbursement draw requests tested, Mending Hearts’ did not maintain controls to ensure draw requests were supported by a review of actual expenditures paid prior to submission. Specifically, reimbursement requests were not tied directly to actual expenditures incurred and paid by Mending Hearts. In addition, there was no documented review of supporting invoices, payment documentation, schedules, or other reports to verify that expenditures had been paid with Mending Hearts’ funds before reimbursement was requested. Cause: Management has not established or implemented formal procedures requiring reimbursement requests to be reconciled to paid expenditures and independently reviewed prior to submission. Effect: Without adequate review procedures, Mending Hearts is at increased risk of requesting reimbursement for expenditures that have not yet been paid, are unsupported, or are otherwise unallowable. This increases the risk of noncompliance with federal cash management requirements and may result in questioned costs, repayment of federal funds, or other administrative action. Questioned Costs: None noted. Context: This condition was identified through testing of 10 reimbursement draw requests selected from the population of federal reimbursement requests submitted during the audit period. Exceptions were noted in all 10 items tested. The transactions tested were selected using a nonstatistical sampling approach and were not intended to be statistically representative of the population. Recommendation: We recommend that management implement formal cash management procedures requiring all reimbursement draw requests to be supported by detailed expenditure schedules and documentation demonstrating that expenditures have been paid with Organization funds. Prior to submitting reimbursement requests, an independent review should be performed and documented to verify that all requested amounts are accurate, supported, allowable, and based on actual paid expenditures. Views of Responsible Officials: Management acknowledges this finding and will address remediation in management's corrective action plan.

FA 2025-001 Strengthen Controls over Expenditures Compliance Requirements: Activities Allowed or Unallowed Allowable Costs/Cost Principles Internal Control Impact: Material Weakness Compliance Impact: Material Noncompliance Federal Awarding Agency: U.S. Department of Education Pass-Through Entity: Georgia Department of Education AL Number and Title: 84.010 – Title I Grants to Local Educational Agencies Federal Award Numbers: S010A240010 (Year: 2025), S010A230010 (Year: 2024) Questioned Costs: $127,026 Repeat of Prior Year Findings: FA 2024-001, FA 2023-001, FA 2022-001 Description: The policies and procedures of the School District were insufficient to provide adequate internal controls over expenditures as it related to the Title I Grants to Local Educational Agencies program. Background Information: The Title I Grants to Local Educational Agencies (Title I) program is authorized under the Elementary and Secondary Education Act of 1965 to help local educational agencies (LEAs) improve teaching and learning in highpoverty schools in particular for children failing or most at-risk of failing, to meet challenging state academic standards. LEAs may operate targeted assistance programs in which children who are failing or most at-risk of failing may be served or schoolwide programs in which all children in eligible schools may be served. Title I funding is granted to the Georgia Department of Education (GaDOE) by the U.S. Department of Education (ED), and GaDOE is responsible for distributing funds to LEAs and overseeing the expenditure of funds by LEAs. Title I funds totaling $621,294 were expended and reported on the Talbot County Board of Education’s Schedule of Expenditures of Federal Awards (SEFA) for fiscal year 2025. Criteria: As a recipient of federal awards, the School District is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Additionally, provisions included in the Uniform Guidance, Section 200.403 – Factors Affecting Allowability of Costs state that “costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient… (g) Be adequately documented…” Furthermore, provisions included in the Uniform Guidance, Section 200.430 – Compensation-Personal Services prescribe standards for documentation of personnel expenses and state, in part, that “(a) …Costs for compensation are allowable to the extent that they satisfy… specific requirements…, and that the total compensation for individual employees: (1) is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity’s laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i)…, [as follows:] (i) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity…” Condition: A sample of ten nonpersonal expenditures was randomly selected for testing using a nonstatistical sampling approach. These expenditures were reviewed to determine if appropriate internal controls were implemented and applicable compliance requirements were met. The following deficiencies were noted: • For three expenditures, evidence of review and approval was not reflected within the voucher package totaling $3,597. • For one expenditure, the amount recorded on the general ledger did not agree to supporting documentation resulting in a difference of $112. In addition, a sample of eleven employees was randomly selected for testing using a nonstatistical sampling approach. These employees were reviewed to determine if appropriate internal controls were implemented and applicable compliance requirements were met. The following deficiencies were noted: • For two employees, supporting documentation could not be provided to support payments totaling $126,674. • For one employee, the amount paid did not agree to the supporting documentation provided and resulted in an overpayment of $240. Questioned Costs: Upon testing a sample of $16,775 in nonpersonal services expenditures, known questioned costs of $112 were identified for expenditures not supported by adequate documentation. Using the total nonpersonal services expenditures population of $101,353, we project the likely questioned costs to be approximately $678. Upon testing a sample of $136,554 in personal services expenditures, known questioned costs of $126,914 were identified for expenditures not supported by adequate documentation. Using the total personal services expenditures population of $356,564, we project the likely questioned costs to be approximately $331,393. Cause: In discussing the deficiencies with the School District, they believe that these items are primarily due to improper documentation retention and oversight of approval processes. Effect: The School District was not in compliance with the Uniform Guidance and GaDOE guidance. Failure to ensure that expenditures and employee compensation payments associated with the Title I program are made for the appropriate amount and supported by appropriate documentation could result in the expenditure of funds for unallowable purposes. This may also expose the School District to unnecessary financial strains and shortages within the Title I program fund as GaDOE may require the School District to return funds associated with improperly documented expenditures. Recommendation: The School District should evaluate their internal control processes regarding the retention of documentation to support expenditures and employee compensation payments. Where vulnerable, the School District should develop and/or modify its policies and procedures to ensure that expenditures are appropriately documented and to ensure that Title I program employees are paid appropriately. Furthermore, management should develop and implement a monitoring process to ensure that these procedures are functioning properly. Views of Responsible Officials: We concur with this finding.

FA 2025-002 Strengthen Controls over Expenditures Compliance Requirements: Activities Allowed or Unallowed Allowable Costs/Cost Principles Internal Control Impact: Material Weakness Compliance Impact: Material Noncompliance Federal Awarding Agency: U.S. Department of Education Pass-Through Entity: Georgia Department of Education AL Number and Title: COVID-19 – 84.425U – American Rescue Plan Elementary and Secondary School Emergency Relief Fund Federal Award Number: S425U210012 (Year: 2024) Questioned Costs: $20,040 Repeat of Prior Year Findings: FA 2024-002, FA 2023-002, FA 2022-002 Description: A review of expenditures charged to the Elementary and Secondary School Emergency Relief Fund Program revealed that the School District’s internal control procedures were not operating to ensure that expenditures were appropriately documented to support allowability. Background Information: On March 27, 2020, the Coronavirus Aid, Relief, and Economic Security (CARES) Act was signed into law. The CARES Act was designed to mitigate the economic effects of the COVID-19 pandemic in a variety of ways, including providing additional funding for local educational agencies (LEAs) navigating the impact of the COVID- 19 outbreak. Provisions included in Title VIII of the CARES Act created the Education Stabilization Fund to provide financial resources to educational entities to prevent, prepare for, and respond to the coronavirus. The CARES Act allocated $30.75 billion, the Coronavirus Response and Relief Supplemental Appropriations Act allocated an additional $81.9 billion, and the American Rescue Plan Act added $165.1 billion in funding to the Education Stabilization Fund. Multiple Education Stabilization Fund subprograms were created and allotted funding through the various COVID-19-related legislation. Of these programs, the Elementary and Secondary School Emergency Relief (ESSER) Fund was created to address the impact that COVID-19 has had, and continues to have, on elementary and secondary schools across the nation. ESSER funding was granted to the Georgia Department of Education (GaDOE) by the U.S. Department of Education (ED). GaDOE is responsible for distributing funds to LEAs and overseeing the expenditure of funds by LEAs. ESSER funds totaling $1,052,459 were expended and reported on the Talbot County School District’s Schedule of Expenditures of Federal Awards (SEFA) for fiscal year 2025. Criteria: As a recipient of federal awards, the School District is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Provisions included in the Uniform Guidance, Section 200.403 – Factors Affecting Allowability of Costs state that “costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient… (g) Be adequately documented…” Furthermore, provisions included in the Uniform Guidance, Section 200.430 – Compensation–Personal Services prescribe standards for documentation of personnel expenses and state, in part, that “(a) … Costs for compensation are allowable to the extent that they satisfy… specific requirements… and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the recipient or subrecipient consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a recipient’s or subrecipient’s laws, rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (g)…, [as follows:] (g) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient…” Condition: All journal entries and general ledger adjustments impacting program expenditures were selected for testing. The following deficiencies were noted: • For one of the four items tested, appropriate evidence of review and approval was not maintained. • Sufficient supporting documentation was not provided for one journal entry posted to reverse expenditure activity. • For one journal entry used to record expenditures totaling $7,046 in the ESSER fund, sufficient supporting documentation could not be provided to determine the allowability of $889 of the expenditures moved to the program. In addition, a sample of eight employees was randomly selected for testing using a nonstatistical sampling approach. These employees were reviewed to determine if appropriate internal controls were implemented and applicable compliance requirements met. The following deficiencies were noted: • Evidence of properly designed and implemented controls over personal services expenditures could not be provided. • For seven employees, supporting documentation was not maintained to support salaries totaling $19,151. Questioned Costs: Upon testing a sample of $31,426 in personal services expenditures, known questioned costs of $19,151 were identified for expenditures not supported by adequate documentation. Using the total personal services expenditures population of $121,406, we project the likely questioned costs to be approximately $73,985. In addition, known questioned costs of $889 were identified for expenditures not supported by adequate journal entry documentation and were not tested as part of a sample; therefore, there are no related projected questioned costs. Cause: In discussing these deficiencies with the School District, they believe these issues are due to improper documentation retention and the need for updated policies and procedures. Effect: The School District was not in compliance with the Uniform Guidance and GaDOE guidance. Failure to ensure that documentation exists to support the allowability of payments from the ESSER program could result in the expenditure of funds for unallowable purposes. This may also expose the School District to unnecessary financial strains and shortages within the ESSER program fund as GaDOE may require the School District to return funds associated with improperly documented expenditures. Recommendation: The School District should evaluate their current internal control processes related to ESSER program expenditures. Where vulnerable, the School District should develop and/or modify its policies and procedures to ensure that all expenditures reflect evidence of review and approval and are supported by appropriate documentation. Furthermore, management should develop and implement a monitoring process to ensure that these procedures are functioning properly.

FA 2025-003 Strengthen Controls over Cash Management Compliance Requirement: Cash Management Internal Control Impact: Material Weakness Compliance Impact: Material Noncompliance Federal Awarding Agency: U.S. Department of Education Pass-Through Entity: Georgia Department of Education AL Number and Title: COVID-19 – 84.425U – American Rescue Plan Elementary and Secondary School Emergency Relief Fund Federal Award Numbers: S425U210012 (Year: 2024) Questioned Costs: $52,211 Description: The School District made cash drawdowns in excess of the immediate cash needs of the Elementary and Secondary School Emergency Relief Fund program. Background Information: The School District may request Elementary and Secondary School Emergency Relief program funds from the Georgia Department of Education (GaDOE) once per month. GaDOE requires the School District to submit DE- 0147 – Requests for Reimbursement of Monthly Cash Disbursements through the Grants Accounting Online Reporting System to receive program funds. When a DE-0147 request is submitted and approved, the Elementary and Secondary School Emergency Relief program funds are typically disbursed to the School District through an electronic payment process the next week. Criteria: As a recipient of federal awards, the School District is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Additionally, provisions included in the Uniform Guidance Section 200.305(b) state, “For recipients and subrecipients other than States, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement by the recipient or subrecipient…” In addition, the Uniform Guidance Section 200.302(b)(6) requires that the entity develop written cash management procedures. Condition: A review of all cash drawdowns and disbursements related to the Elementary and Secondary School Emergency Relief program was performed to determine if any excessive cash balances were maintained during the fiscal year under review. Excessive cash balances at fiscal year-end totaled $52,211. Questioned Costs: Questioned costs of $52,211 were identified for cash drawdowns in excess of reimbursable expenditures. Cause: Excess cash drawdowns resulted from failure to follow established procedures and claiming expenditures on completion reports that were not based on actual general ledger expenditures. Effect: The School District was not in compliance with the Uniform Guidance and GaDOE guidance. In addition, the School District could potentially accrue an interest liability that would be owed back to the federal government. Furthermore, when the School District cannot meet the requirement to minimize the time elapsing between the transfer of funds and disbursement of those funds, provisions included in the Uniform Guidance allow GaDOE to change the method by which the School District is transferred funds and delay the School District’s receipt of these funds. This may include requirement by GaDOE to submit invoices prior to being reimbursed for program expenditures. Recommendation: The School District should follow established procedures to accurately forecast the cash needs of the Elementary and Secondary School Emergency Relief program and minimize the time elapsing between the transfer of funds from GaDOE and the disbursement of such funds by the School District. In addition, these procedures should be documented in writing in accordance with the Uniform Guidance. Furthermore, management should develop and implement a monitoring process to ensure that these procedures are followed. Views of Responsible Officials: We concur with this finding.

FA 2025-004 Strengthen Controls over Financial Reporting Compliance Requirement: Reporting Internal Control Impact: Material Weakness Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of Education Pass-Through Entity: Georgia Department of Education AL Number and Title: COVID-19 – 84.425U – American Rescue Plan Elementary and Secondary School Emergency Relief Fund Federal Award Numbers: S425U210012 (Year: 2024) Questioned Costs: None identified Description: The School District did not file accurate completion reports for the Elementary and Secondary School Emergency Relief Fund program. Background Information: The Georgia Department of Education (GaDOE) requires the School District to submit a completion report by October 30 after the 15-month period of performance associated with the Elementary and Secondary School Emergency Relief Fund program ends. These completion reports are filed through the Grants Application section of the MyGaDOE webportal and reflect budgeted and actual expenditure information for the Elementary and Secondary School Emergency Relief Fund program for the reporting period. If the total expenditures reflected on the completion report are more than the Elementary and Secondary School Emergency Relief Fund program funds received by the School District for the grant period, a DE-0147 – Request for Reimbursement of Monthly Cash Disbursements will be automatically generated and the additional funds due to the School District will be disbursed appropriately. Conversely, if the total funds received for the grant period exceed the total expenditures reflected on the completion report, the Grants Application will prompt the School District to enter a check number for the required refund of excess funds drawn down. Therefore, it is imperative that completion reports are filed by the School District in an accurate and timely manner. Criteria: As a recipient of federal awards, the School District is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Provisions included in the Uniform Guidance, Section 200.302(a) state in part that “all recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions…” In addition, provisions included in the Uniform Guidance, Section 200.302(b)(2) state that the financial management system must provide for “accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements…” Condition: A review of the School District’s accounting records and the completion reports related to the Elementary and Secondary School Emergency Relief Fund program for the period of July 1, 2024 through September 30, 2024 revealed that expenditures were over reported by $56,119. Cause: Excess cash drawdowns resulted from failure to follow established procedures and claiming expenditures on completion reports that were not based on actual general ledger expenditures. Effect: The School District was not in compliance with the Uniform Guidance and GaDOE guidance. Failure to accurately report federal award expenditures through the completion report process could lead to the filing of DE-0147 reimbursement requests with GaDOE that do not support actual expenditures. Therefore, the School District obtained more federal funding than they were eligible to receive. Recommendation: The School District should follow established procedures to ensure that completion reports submitted to GaDOE are supported by the accounting records and DE-0147 reimbursement requests are prepared based upon actual expenditures incurred. In addition, management should develop and implement a monitoring process to ensure that control procedures are being followed. Views of Responsible Officials: We concur with this finding.

2025-003 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Questioned Costs: None Context: During our testing of 17 students, we identified 1 student whose enrollment status change was not reported, 2 students with incorrect status changes reported for program-level reporting, 2 students with an incorrect effective date reported, and 9 students whose status changes were not reported in a timely manner. We also identified that for all 17 of the selected students, enrollment status was not certified every 60 days. Additionally. the University did not document any evidence of review over enrollment reporting. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: The University was not in compliance with the requirements to properly report student enrollment data correctly. Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat findings: 2024-004 Recommendation: We recommend the University review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely and accurately. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-004 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: 34 CFR 668.21(a) states that the institution must return all title IV, HEA program funds that were credited to the student's account at the institution or disbursed directly to the student for the payment period. The institution must return those funds no later than 30 days after the date that the institution becomes aware that the student will not or has not begun attendance. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly evaluate students in need of Return of Title IV (R2T4) calculations. Questioned Costs: None Context: During our testing of 5 R2T4 calculations, we identified 2 students with no R2T4 calculation performed. These students attended more than 60% of the term and did not require returned funds. Additionally, we identified 3 R2T4 calculations that did not have documentation of review. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: The University could return incorrect amounts based off of their calculations and incorrect calculations could effect student repayment amounts based off of amount earned. Repeat findings: 2024-005 Recommendation: We recommend that the University review policies and procedures related to R2T4 calculations to ensure calculations are performed accurately. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-005 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution's written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written Information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Additionally, we were unable to observe evidence that the WISP was formally reviewed and approved. Questioned Costs: None Context: The WISP was missing the element discussing the secure disposal of customer information. Additionally, there was not an observable formal review or authorization. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: There is a risk the University’s information and systems could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. Repeat findings: 2024-006 Recommendation: We recommend that the University review the GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-006 Eligibility Federal Agency: U.S. Department of Education Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Per 34 CFR 690.62 states the Pell grant for an academic year is based upon the payment and disbursement schedule published by the Secretary for each award year. 34 CFR 690.80(b)(1)) states if the student’s enrollment status changes from one academic term to another within the same award year, the institution shall recalculate the Federal Pell Grant award for the new payment period taking into account any changes in the cost of attendance. Condition: The University used a third-party servicer to perform key controls, but did not have documented review of the work performed by their third-party servicer. Additionally, the University incorrectly disbursed Pell funds for 10 students. Questioned Costs: $12,949 Context: During our eligibility testing of 60 students, we identified that the University did not document evidence of review for controls over award packaging performed by their third party servicer. Additionally, out of 43 students receiving Pell, 10 were under awarded. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: 2024-007 Recommendation: We recommend the University review its current procedures for awarding Title IV funds and implement any changes necessary to ensure federal funds are awarded and disbursed in accordance with federal regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-007 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University was unable to provide documentation of review for controls surrounding credit balance disbursements. Questioned Costs: None Context: The University did not have documented review of controls to ensure credit balance funds that were not successfully disbursed to the student were returned to the Department of Education after 240 days. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: No Recommendation: We recommend the University design controls to ensure an adequate review process is in place to ensure compliance over stale checks that need to be returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-008 Cash Management Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not have documentation that Direct Loan Reconciliations or Pell Reconciliations prepared by third-party servicer were reviewed. Additionally, we were unable to observe evidence that the University reviewed cash drawdowns prepared by the third party processor. Questioned Costs: None Context: During our testing, we reviewed 4 months of direct loan reconciliations that the University's third party servicer prepares; however, Urshan was unable to provide documentation of review for these reconciliations. Additionally, during our testing of 5 draws, we identified that all 5 draws did not have documented evidence of review. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: 2024-009 Recommendation: We recommend that the University should implement formal review procedures to document that the Cash Management reconciliation and drawdown reviews are being performed to correct errors in a timely manner and to minimize the likelihood of errors going undetected. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-009 Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University used a third-party servicer to perform key controls, but did not have documented review of the work performed by their third-party servicer. Additionally, 1 disbursement was incorrectly reported to COD. Questioned Costs: None Context: During our testing of 60 COD disbursements, we noted 1 disbursement that was incorrectly reported. We also noted that the University did not have documentation of review for COD disbursements. Cause: This discrepancy resulted from the student being initially packaged by Campus Ivy using the 01 ISIR transaction, which reflected an SAI of -1500. Subsequent ISIR transactions that significantly impacted eligibility were not identified prior to packaging. These discrepancies were later identified during the University’s internal HCM2 reconciliation process in collaboration with FA Solutions, resulting in a mismatch between awarded aid and COD records. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: No Recommendation: We recommend the University design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.