Findings Citing § 200.303

Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 64.033, Department of Veteran Affairs, VA Supportive Services for Veteran Families Program Federal Award Identification Number and Year: 20-MI-221-SS, 20-MI-221-LT, 20-MI-221 Pass-through Entity – N/A Finding Type – Material weakness in internal control over compliance Repeat Finding – Yes Criteria – Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Criteria - Grant and cooperative agreement recipients and contractors are required to register FSRS and report subaward data through FSRS. Compliance testing of the Transparency Act reporting requirements must include the following key data elements about the first-tier subrecipients and subawards under grants and cooperative agreements. Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – During our testing for reporting compliance, it was noted that the Organization did not submit the Federal Funding Accountability and Transparency Act report within the reporting timeline for prime grant recipients. Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause/Effect – The Organization’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2024. Subawards were not reported to FSRS in accordance with FFATA requirements. The Organization was required to report the subaward details above. The Organization was not required to report executive compensation. Recommendation – We recommend the Organization establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. View of Responsible Officials and Corrective Action Plan – The Agency agrees with this finding. As part of the subaward review process, the Chief Financial Officer will ensure that first tier subawards are checked to see if FFATA reporting is needed based on the award amount. If FFATA reporting is required, the Chief Financial Officer will assign this task to the Assistant Director for Financial Compliance to ensure that reporting is completed to the FFATA Reporting System FSRS.

Assistance Listing Number, Federal Agency, and Program Name: Assistance Listing Number 93.600, Department of Health and Human Services, Head Start Federal Award Identification Number and Year: 05CH011937-04-02 Pass-through Entity – N/A Finding Type – Material weakness in internal control over compliance Repeat Finding – Yes Criteria – Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Criteria - Grant and cooperative agreement recipients and contractors are required to register FSRS and report subaward data through FSRS. Compliance testing of the Transparency Act reporting requirements must include the following key data elements about the first-tier subrecipients and subawards under grants and cooperative agreements. Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – During our testing for reporting compliance, it was noted that the Organization did not submit the Federal Funding Accountability and Transparency Act report within the reporting timeline for prime grant recipients... Identification of How Questioned Costs Were Computed – N/A Questioned Costs – None Cause/Effect – The Organization’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2024. Subawards were not reported to FSRS in accordance with FFATA requirements. The Organization was required to report the subaward details above. The Organization was not required to report executive compensation. Recommendation – We recommend the Organization establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. View of Responsible Officials and Corrective Action Plan – The Agency agrees with this finding. As part of the subaward review process, the Chief Financial Officer will ensure that first tier subawards are checked to see if FFATA reporting is needed based on the award amount. If FFATA reporting is required, the Chief Financial Officer will assign this task to the Assistant Director for Financial Compliance to ensure that reporting is completed to the FFATA Reporting System FSRS.

2024-001: Procurement – Material Weakness Federal Program Information: Funding Agency: U.S Department of Transportation FALN: 20.942 Thriving Communities Program Award Year: 2023-2025 Criteria: Under 2 CFR Section 200.303(a), non‐federal entities must establish and maintain effective internal controls to provide reasonable assurance that the entity is managing the federal awards in compliance with statues, regulations, and the terms and conditions of the award. Additionally, under 2 CFR Section 200.320, the Foundation must have and use documented procurement procedures for acquisition of goods and services under a federal award or a sub‐award. Condition: 2 CFR Section 200.320, the Foundation is required to have and use documented procurement procedures for acquisition of goods and services under a federal award. The Foundation does not have approved policies and procedures over procurement. The Foundation was unable to identify any controls to ensure that transactions weren’t had between ineligible parties. Effect: Not having a procurement policy may result in funds to be returned back to grantor and/or impact future funding. Cause: Supporting procurement documentation for the acquisition of goods and services were not properly established largely due to overall limited number of personnel for certain functions and lack of board oversight. Questioned Costs: None Recommendation: We recommend the Foundation strengthen its policies and procedures to ensure procurement is adequately documented for that goods and services purchased in accordance with Uniform Guidance and other federal guidelines.

2024‐002: Suspension and Debarment‐ Material Weakness Federal Program Information: Funding Agency: U.S Department of Transportation FALN: 20.942 Thriving Communities Program Award Year: 2023-2025 Criteria: Under 2 CFR Section 200.303(a), non‐federal entities must establish and maintain effective internal controls to provide reasonable assurance that the entity is managing the federal awards in compliance with statues, regulations, and the terms and conditions of the award. Under 2 CFR part 180, the Foundation is required to verify suspension or debarment from the excluded parties list system regarding compliance. Condition: Under 2 CFR part 180, the Foundation is required to verify suspension or debarment from the excluded parties list system regarding compliance. Though the Foundation did not have a policy for suspension and debarment, the Foundation complied with the requirements. Effect: Not having a suspension and debarment policy may result in funds to be returned back to grantor and/or impact future funding. Cause: Supporting suspension and debarment documentation for the acquisition of goods and services were not properly established in part due to several changes in personnel within the accounting area and overall limited number of personnel for certain functions and lack of board oversight. Questioned Costs: None Recommendation: We recommend the Foundation strengthen its policies and procedures to ensure suspension and debarment is adequately documented that goods and services purchased in accordance with Uniform Guidance and other federal guidelines. In addition, the Foundation should verify that all vendors under covered transactions are not listed on the excluded parties list system by performing a search on sam.gov and maintaining the results of such search in the vendor’s file.

Criteria According to 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition During the testing of eligibility, the auditor identified one instance where proper eligibility information was not maintained within the client files. Specifically, the individual was marked as married on their initial application but was marked as single on their renewal and there was no support within the file to determine which was correct. Cause The primary cause of the error identified was lack of administrative oversight and a lack of effective control activities such as effective review procedures and monitoring. Effect The Organization granted a notice of eligibility without the required supporting documentation and/or proper approval. Questioned Costs Not applicable Context Prior to a notice of eligibility (NOE) being granted, it must be verified that the individual has a valid proof of HIV diagnosis, be considered low-income based on household size, and be a resident of the state in which they are applying in. Eligibility documentation should be retained in the client file. Out of the sample of 40 client files tested, we noted one individual who did not have all requirements within their file. This individual did not have adequate support for the household size of one to calculate low-income status. BASIC NWFL, Inc. was able to obtain the support that the individual was indeed married and the form was completed incorrectly. After the income was recalculated with the spouse’s income, it was determined that the individual still met the low-income threshold. Recommendation We recommend the client implement controls to ensure all eligibility documentation is obtained and properly reviewed before granting eligibility. This includes providing regular staff training and conducting periodic internal audits to ensure compliance. Views of Responsible Officials See corrective action plan.

FINDING 2024-004 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Suspension and Debarment Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Numbers and Years (or Other Identifying Numbers): Regular FY 2024, Revenue Loss FY 2024 Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-005. Condition and Context Prior to entering into subawards and covered transactions with the COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF), recipients are required to verify that contractors and subrecipients are not suspended, debarred, or otherwise excluded. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (e.g., grant agreement) that are expected to equal or exceed $25,000 and all subawards. The verification is to be done by checking the SAM exclusions list, collection of a certification from that person or entity, or adding a clause or condition to the covered transaction with that person or entity. Upon inquiry of the County to determine its policies and procedures related to suspension and debarment requirements for the SLFRF funds, the County stated procedures were not in place to ensure vendors were not suspended or debarred prior to entering into covered transactions. The County had not performed procedures to ensure the vendors were not suspended or debarred or otherwise excluded or disqualified from participation in federal assistance programs or activities during the audit period on all of the 11 vendors determined to have covered transactions totaling $816,950 that were paid with SLFRF funds. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 31 CFR 19.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you do business is not excluded or disqualified. You do this by: (a) Checking the EPLS; or (b) Collecting a certification from that person if allowed by this rule; or (c) Adding a clause or condition to the covered transaction with that person." Cause Management of the County did not develop a system of internal controls to ensure that policies and procedures were in place and followed related to suspension and debarment as they were unaware of the requirements. Effect Without proper implementation of an effectively designed system of internal controls, the County was unable to verify whether contractors and subrecipients were not suspended, debarred, or excluded. Any program funds the County used to pay contractors that have been suspended or debarred would be unallowable, and the funding agency could potentially recover them. Furthermore, noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the County. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County develop written policies and procedures to ensure its compliance with requirements related to suspension and debarment. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Program name: State and Local Fiscal Recover Funds Assistance Listing: 21.027 Federal award Identification number: 43210256 Federal award year: All Federal awarding agency: U.S. Department of Treasury Criteria: In accordance with 2 CFR 200.303, non-Federal entities must establish and maintain effective internal control over Federal awards. These controls should be in compliance with Federal statutes, regulations, and the terms and conditions of the award, and should align with standards such as the “Standards for Internal Control in the Federal Government” (Green Book) or the COSO framework.. This includes controls over: 1) Payroll: Ensuring labor charges are accurate, allowable, and properly approved (2 CFR 200.430). 2) Reporting: Ensuring financial reports are accurate, complete, and reviewed prior to submission (2CFR 200.328). Condition: The Company has limited written processes of certain transaction classes. There was a pervasive lack of documentation of approval over transactions, including payroll, vendor payments, cash management, and reporting. Cause: The Company did not maintain or consistently apply documentation protocols for internal control reviews. Formal documentation practices were not in place during the audit period. Effect or Potential Effect: Lack of documentation as evidence that controls over compliance were being performed. Documentation should be maintained as evidence that sufficient control activities are in place and would effectively prevent or detect and correct noncompliance. Controls must be followed for every transaction and documentation of the control being performed must be maintained. Repeat finding: This is not a repeat finding. Questioned costs: There are no questioned costs associated with this finding. Perspective: The deficiency was pervasive across multiple compliance areas and was not isolated to a specific transaction or department. The scope indicates a systemic control weakness during the audit period. Recommendation: We recommend that the Company ensure updated policies and procedures are implemented and consistently applied. This includes: 1) Documented review and approval of all transactions related to payroll, cash management, and reporting. 2) Maintenance of written evidence supporting such reviews. 3) Regular training and internal monitoring to ensure control procedures are consistently followed. Management’s response and corrective action plan (unaudited): See corrective action plan.

FINDING 2024-003 Subrecipient Monitoring (Significant Deficiency) Federal Program Information: Education Stabilization Fund (ALN 84.425U) Criteria: 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Organization has a policy in place to reimburse subrecipients for allowable expenses once all invoice and payment support is provided by the subrecipient and reviewed and approved by the Organization. While the Organization obtained support from the subrecipient, there was no evidence that the supporting documentation was reviewed and approved by the Organization before reimbursing the subrecipient. Cause: Insufficient internal control and administrative oversight. Effect or Potential Effect: Failure to maintain adequate internal controls to ensure that all subrecipients are sufficiently monitored may result in the wrongful use of federal funds and non-compliance with the provisions of applicable requirements of the federal awards. Questioned Costs: None Context: The Organization made payments to 39 subrecipients. During our audit we tested 4 subrecipients and noted that the Organization did not have evidence of review of source documentation from the subrecipient for any of the subrecipients selected for testing. Prior Year Finding: Reported as 2023-003 in the prior year. Recommendation: We recommend the Organization enhance its procedures and internal controls over subrecipient monitoring to ensure subrecipient invoices are properly reviewed and the review is documented. Views of Responsible Officials: Management agrees with the finding and the auditors’ recommendation. See Corrective Action Plan at the end of the report.

2024-001 – INTERNAL CONTROLS OVER COMPLIANCE Other Matter/Significant Deficiency U.S. Department of Housing and Urban Development ALN #: 14.871 – Housing Choice Voucher Program ALN #: 14.850 – Public Housing Operating Fund CRITERIA A recipient of federal funding must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. (2 CFR 200.303(a)) CONDITION During our review of internal controls over compliance, which included reviewing monitoring reports from federal agencies, we identified the following matters: • The Authority did not have a policy in place governing the use of HUD’s Enterprise Income Verification (EIV) system. • The Authority was not following its administrative plan for the Housing Choice Voucher program related to minimum rents. The Authority has not established a minimum rent policy for Public Housing. • The Authority did not have a written methodology for how it conducts annual quality control reviews of HCV participant files. • The Authority did not follow its administrative plan regarding terminating participant from the Housing Choice Voucher Program. The Authority did not have a policy addressing participants being terminated from the Public Housing Program. • The VHA was not in compliance with updated Violence Against Women Act (VAWA) requirements. • The Authority’s day-to-day practices for the administration of the Public Housing program differ from the Admissions and Continued Occupancy Policy. • The Authority did not have a Section 3 policy. • The Authority did not follow its Administrative Plan related to preferences for the Project Based Voucher (PBV) waiting list. CAUSE The Authority did not perform a review and update its compliance policies for changes in HUD regulations. EFFECT The lack of updated or written policies increases the risk of noncompliance with federal requirements, as staff may not have clear guidance. QUESTIONED COSTS None identified. CONTEXT The Authority administers both the Housing Choice Voucher and Public Housing Programs. Uniform Guidance requires the Authority to have written policies related to compliance with federal statutes, regulations, and terms of federal awards. REPEAT FINDING Not a repeat finding. RECOMMENDATION We recommend the Authority review all compliance-related policies and procedures and update or develop written documentation to align with current Uniform Guidance requirements. AUDITEE’S RESPONSE AND PLANNED CORRECTIVE ACTION See Corrective Action Plan.

Finding No.: 2024 001 Federal Agency: U.S. Department of Housing and Urban Development Program Name: Economic Development Initiative, Community Project Funding, and Miscellaneous Grants Assistance Listing No.: 14.251 Federal Award Year: Funding periods between January 1, 2024 and December 31, 2024 Compliance Requirement: Reporting Finding Type: Significant Deficiency Criteria Article VI of the executed Grant Agreement states the following: "The Grantee must submit a performance report in DRGR on a semi annual basis and must include a complete Federal financial report as an attachment to each performance report in DRGR. Performance report shall consist of a narrative of work accomplished during the reporting period. During the Period of Performance, the Grantee must submit these reports in DRGR no later than 30 calendar days after the end of the six month reporting period." Title 2 U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements, Section 200.303(a) states that non federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During reporting testing, the auditors identified that two semi annual required reports for the 14.251 program during the year under audit were not filed within the 30 day calendar period identified in the grant agreement. Effect West End Neighborhood House, Inc. (the Organization) was not in compliance with reporting. Cause Due to lack of internal controls surrounding ensuring that reports were filed timely, both program reports filed during the period were filed outside of the 30 day calendar window. Questioned Costs There are no questioned costs related to the finding. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding This is not identified as a repeat finding. Recommendation We recommend that the Organization enhance its policies and procedures to ensure responsible program personnel timely files all performance reporting. View of Responsible Official Management experienced a miscommunication with its contractor regarding responsibility for preparing and submitting the required program performance report. When management reviewed the HUD reporting website, it appeared the reports were completed. Upon further review, it was identified that the contractor had not completed the filing and that the submit button had not been pushed. Management promptly prepared and submitted the reports. These reports were submitted in August and September 2025. To prevent future delays, management is updating its compliance procedures to include verification of the timely filing of all required reports.

Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the Federal award that provides assurance that the entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, 2 CFR Appendix IV to Part 200 Section B.2(b) requires that both the direct costs and the indirect costs must exclude capital expenditures and unallowable costs. Per Compliance Supplement, these indirect costs must conform to the allowability of cost provisions in 2 CFR Part 200, Subpart E or award agreement. Condition: During our testing of indirect costs, we noted that the Corporation charges the Federally approved rate of 28.7% on specific grant awards based on direct salaries and wages. However, the Corporation did not maintain ongoing supporting documentation of eligible indirect costs. Cause: The Corporation did not have formal process and policies to demonstrate adherence to the allowability requirements of indirect costs in accordance with 2 CFR Appendix IV to Part 200 Section B.2(b). Effect or Potential Effect: Additional efforts after year end were required to determine whether indirect costs charged to Federal awards conform to the allowability of cost provisions in 2 CFR Part 200, Subpart E or award agreement. Allowable costs incurred by the Corporation exceeded the amount of approved grant funding, therefore no questioned costs are reported. Questioned costs: None Context: Additional efforts after year end were required by management in order to provide sufficient and appropriate evidence that the reported indirect costs conformed to the allowability of cost provisions in 2 CFR Part 200, Subpart E or award agreement. Repeat finding: This is a repeat finding from prior year. This was reported as finding 2023-009 in the 2023 report. Recommendation: We recommend the Corporation develop and incorporate internal controls and policies to demonstrate adherence to the allowability requirements of indirect costs in accordance with 2 CFR Appendix IV to Part 200 Section B.2(b). View of Responsible Officials: Due to staff turnover the Corporation did not have adequate personnel or infrastructure in place to monitor costs in order to calculate and determine an updated indirect cost rate. Also, the current indirect cost rate allocations is based on historical assumptions.

Federal Program(s): Enhanced Mobility of Seniors and Individuals with Disabilities (ALN 20.513) Agencies: U.S. Department of Transportation – Federal Transit Administration Criteria - 2 CFR §200.510: Auditee must prepare an accurate SEFA including ALN, program name, award number, award year, pass-through number, and total expenditures. 2 CFR §200.332: Pass-through entities must identify the ALN in all subaward documents. 2 CFR §200.303: Auditees must establish and maintain effective internal controls over federal awards. Condition - During our audit of ENVIDA’s federal programs, we identified an internal control deficiency affecting the accuracy of the Schedule of Expenditures of Federal Awards (SEFA). Context - The issue stems from the Envida's need to formalize documented procedures and adequate review over the SEFA preparation process, as well as the need to implement controls for verifying federal award information received from pass-through entities. Specifically, ENVIDA’s SEFA included initial misstatements, including erroneous reporting of $61,576 in required matched funds as federal expenditures (which they were not), the inclusion of $79,225 in OnDemand expenditures that were not federally funded (incorrect information from passthrough entity), and a $45,403 posting error that misclassified expenditures between grant years. These errors resulted in a material overstatement of the SEFA federal expenditures as originally prepared. Management corrected these errors during the audit process. Cause - Due to lack of funding information provided in the contracts with a major passthrough entity, Envida is unable to verify accuracy of federal funding information contemporaneously. For 2024, incomplete or inaccurate information from pass-through entities, coupled with the absence of formalized internal controls to verify and document federal award details, led to initial errors in SEFA reporting. Contracts with the pass-through entity, Pikes Peak Area Council of Governments (PPACG), did not include the required Assistance Listing Numbers (ALNs), which contributed to the confusion and misreporting. These deficiencies are inconsistent with the requirements of 2 CFR §200.510(b), §200.303, and §200.332(a)(1), which collectively mandate accurate SEFA reporting, proper identification of federal awards, and internal controls over federal funding. Effect - SEFA initially overstated by 15.5% due to match and OnDemand errors. FY24 award overstated by 17.5%; FY25 award understated by 14.6% Potential audit coverage gaps and risk misassessment under 2 CFR §200.518. Recommendation - We recommend that ENVIDA establish and document clear procedures for the preparation of the Schedule of Expenditures of Federal Awards (SEFA) as well as for the proper classification of accounts receivable. In addition, ENVIDA should implement a supervisory review process to help ensure accuracy and compliance with federal requirements. To further strengthen controls, all subaward agreements should require written confirmation of the Assistance Listing Numbers (ALNs). Finally, ENVIDA should verify federal award information directly against official federal award notices prior to preparing the SEFA. Views of Responsible Official and Planned Corrective Action - Management has agreed with the finding and plans to revise the SEFA to reflect accurate federal expenditures. They will work with pass-through entities to ensure future subaward documentation includes all required federal award identifiers and will implement internal controls to prevent recurrence.

2024-001- Significant Deficiency: Activities Allowed or Unallowable Costs/Cost Principles Criteria: According to federal regulations, expenditures charged to federal grants must follow the allowable cost principles found in 2 CFR Part 200, subpart E. Additionally, 2 CFR.200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During our testing of federal expenditures, we noted that certain expenses were not allowable activities under the Uniform Guidance. Cause: Internal controls surrounding the review of supporting documentation of expenditures charged to grants are not properly implemented to detect and correct errors. Effect: The Organization received reimbursement for unallowable expenditures. Questioned Costs: ALN 84.215J - $18,603 Recommendation: We recommend that management of the Organization review internal controls over compliance and ensure they are properly designed and implemented to ensure that expenditures are allowable under federal regulations. Views of Responsible Officials: Management agrees with this finding and their response is included in the corrective action plan.

2024-001 Suspension and Debarment Prior Year Finding Number: 2023-003 Year of Finding Origination: 2023 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Material Weakness and Modified Opinion Federal Agency: U.S. Department of Treasury Program: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Award Number and Year: SLFRP2192; 2021 Pass-Through Agency: N/A - Direct Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Federal requirements prohibit non-federal entities from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Title 2 U.S. Code of Federal Regulations § 180.300 describes a required verification process. Prior to entering into the transaction, one of the following must be performed: (1) checking SAM.gov exclusions, (2) collecting a certification, or (3) adding a clause or condition to the covered transaction. Condition: For five of seven covered transactions selected for testing, the County did not perform the verification for suspended or debarred vendors prior to entering into the covered transactions. Questioned Costs: None. Context: Covered transactions totaled $4,211,707 consisting of 37 payments to vendors. The sample size of seven payments to vendors totaled $2,456,687. The sample size was based on the guidance from Chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Effect: Failure to verify vendors are not suspended, debarred, or otherwise excluded prior to entering into a covered transaction may result in the County entering into a transaction with a vendor that is not authorized to provide goods and services to the grant. Cause: The County informed us there was a lack of staff available to check the covered transactions for suspension and debarment. Recommendation: We recommend the County maintain documentation to demonstrate that vendors were not debarred, suspended, or otherwise excluded from conducting business with the County; this documentation should be completed prior to entering a covered transaction. View of Responsible Official: Acknowledge

Program Information: U.S. Department of the Interior BIA Consolidated Tribal Government/ COVID-19 - ARPA ATTG & HIP Assistance Listing #: 15.021 Award Number: A20AV00601, A17AV00362, A20AV00601 Award Period: 1/1/2020-12/31/2023 Criteria: 2 CFR § 200.303 - Internal controls states, the recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The cost principles in 2 CFR Part 200, subpart E (Cost Principles), prescribe the cost accounting requirements associated with the administration of Federal awards by: a. States, local governments, and Indian tribes. Except where otherwise authorized by statute, cost must meet the following general criteria in order to be allowable under Federal awards: 7. Be adequately documented. Condition/Context: During testing of non-payroll transactions, the following was noted: • For 4 of 23 non-payroll transactions (3 of 4 Individually Important Item (III) transactions tested and 1 of 19 samples tested), supporting documentation was insufficient to determine whether the gift cards purchased were spent properly for allowable costs. • For 1 of 23 non-payroll transactions, the expenditure tested represented an unallowable cost. [ X ] Compliance Finding [ ] Significant Deficiency [ X ] Material Weakness Cause: The Department did not have adequate internal controls in place to ensure that gift card purchases and other expense were sufficiently supported and restricted to allowable program purposes. Effect: As a result, there is an increased risk that Federal funds were used for unallowable purposes. Questioned Costs: Known – $48,929 Repeat Finding: No. Recommendation: We recommend the Department strengthen controls over the purchase and distribution of gift cards and require documentation demonstrating the business purpose and allowable use of all gift card expenditures. Additionally, the Department should review and approve all non-payroll expenditures for allowability prior to charging them to the Program. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and has prepared corrective action as detailed in its Corrective Action Plan.

Program Information: U.S. Department of the Treasury COVID-19 - American Rescue Plan Act Assistance Listing #: 21.027 Award Number: SLFRP1559, SLFRP5012 Award Period: 5/19/2021-12/31/2026 Criteria: 2 CFR § 200.303 - Internal controls states, the recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Tribe’s procurement policy requires that purchases above certain thresholds be supported by evidence of competitive bids or quotes to ensure fair and open competition. For revenue loss eligible use category expenditures under CSLFRF, the May 2024 OMB Compliance Supplement and Treasury Final Rule FAQ 13.15 clarify that federal procurement requirements in 2 CFR 200.318–200.327 do not apply. Condition/Context: During testing of procurement transactions charged to the program under the revenue loss eligible use category, 3 of 6 Individually Important Item procurement samples selected for review did not contain documentation of competitive bids or quotes as required by the Tribe’s procurement policy. These transactions were not subject to federal procurement requirements. [ ] Compliance Finding [ X ] Significant Deficiency [ ] Material Weakness Cause: The deficiency appears to be the result of staff not consistently following the Tribe’s established procurement procedures and a lack of management oversight to ensure compliance with local procurement requirements. Effect: Failure to obtain and document competitive bids or quotes increases the risk that the Tribe may not obtain goods and services at the best value and may not provide for full and open competition, as required by its own policy. Questioned Costs: N/A - as the compliance attribute does not apply for revenue loss transactions. Repeat Finding: No. Recommendation: We recommend that management reinforce and monitor compliance with the Tribe’s procurement procedures, including obtaining and retaining documentation of competitive bids or quotes for all purchases above the micro-purchase threshold, and provide training to staff responsible for procurement. Management should also implement periodic reviews of procurement files to ensure compliance with the Tribe’s procurement requirements. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and has prepared corrective action as detailed in its Corrective Action Plan.

Federal Agency: U.S. Department of Homeland Security Federal Program Title: Federal Emergency Management Agency Disaster Grants Assistance Listing Number: 97.036 Federal Award Number and Year: 4496DR 2024 Pass-Through Agency: State of Massachusetts Pass-Through Number: CTFEMA4496STPAT00971 Award Period: Year Ended December 31, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or Specific Requirement: In accordance with 2 CFR §200.403(g), to be allowable under federal awards, costs must be adequately documented. Additionally, 2 CFR §200.303 requires nonfederal entities to establish and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition: During testing of expenditures under the FEMA grant, the System was unable to provide documentation showing approval of an invoice dated May 2020. This invoice was selected as part of the single audit sample. The lack of approval documentation represents a deficiency in internal controls over compliance with federal requirements. Questioned Costs: None. Context: The invoice in question was incurred in May 2020, prior to the implementation of the Acumatica AP approval workflow. In June 2020, the facility transitioned to Acumatica, which provides electronic tracking of invoice approvals. Cause: At the time of the expenditure, the facility did not have a centralized or electronic approval process in place. Approval documentation was maintained manually and was not retained or accessible during the audit. Effect: The absence of approval documentation for the invoice creates a risk that expenditures may not be properly reviewed or authorized, potentially leading to noncompliance with federal requirements. Although the cost was ultimately deemed allowable, the control deficiency could impact future compliance if not addressed. Recommendation: We recommend that the System ensure all expenditures under federal awards are supported by documented approvals. For legacy transactions, efforts should be made to retain or reconstruct approval documentation where feasible. Continued use and monitoring of the Acumatica system should be maintained to ensure compliance going forward. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding. The invoice in question was incurred during an emergency response period prior to the implementation of the Acumatica system. While approval was likely obtained at the time, documentation was not retained. With the implementation of the Acumatica AP approval process in June 2020, the System has taken appropriate steps to address the finding and enhance internal controls over invoice approvals.

Internal Control over Special Tests and Provisions Federal Agency: U.S. Department of Housing and Urban Development Assistance Listing Number: 14.267 Federal Program Name: Continuum of Care Pass-through Entity: King County Regional Homelessness Authority Pass-through Award Numbers: DA-202212-01215 Criteria: Under 2 CFR 200.303(a), the non-federal entity must establish and maintain effective internal control over compliance with the special tests and provisions requirements of federal awards. When funds are used to pay for rent, the Continuum of Care program includes a requirement that recipients must determine that the rent paid is reasonable in relation to rents being charged in the area for comparable space. Condition: Documentation of the rent reasonable determination could not be located for one of seven program participants selected for testing. Cause and Context: The Organization had been dealing with staff turnover in late 2023 when this program participant initially applied for assistance and had not retained documentation of its determination of rent reasonableness. Effect: Inadequate internal controls over requirements for special tests and provisions may result in the Organization incurring disallowed costs. Questioned Costs: Documentation of the rent reasonableness determination had not been performed for costs totaling $3,935 during the year ended December 31, 2024. Recommendation: We recommend that management verifies documentation of rent reasonableness verifications for all participants before rent payments are authorized. Views of Responsible Officials: There is no disagreement with the finding.

CONDITION: During my review of the Borough of Ellwood City’s internal controls over federal awards, I noted that the Borough does not have formal written policies and procedures surrounding the management of their federal award funds. Although not all-inclusive, an example of some of the required polices would include written procedures for procurement, conflict of interest, and allowable costs. This is a repeat finding (2023-001) from the prior year.CRITERIA: Section 2 CFR 200.303 of the Uniform Guidance requires non-federal entities such as the Borough of Ellwood City to maintain effective internal controls over federal awards. In addition, the Uniform Guidance also recommends these internal controls follow guidance in Standards for Internal Control in the Federal Government (the Green Book), issued by the Comptroller General of the United States.EFFECT: The Borough of Ellwood City is not in compliance with Section 2 CFR 200.303 of the Uniform Guidance which requires non-federal entities to maintain effective internal controls over federal awards.QUESTIONED COST: NoneCAUSE: It was not readily determinable as to why the Borough of Ellwood City had not formally adopted written policies and procedures surrounding the management of their federal award funds.RECOMMENDATION: I recommend that the Borough of Ellwood City adopt the required written policies and procedures surrounding the management of federal award funds as prescribed by Section 2 CFR 200.303 of the Uniform Guidance. The focus of these policies and procedures should be to ensure that the Borough officials who are responsible for carrying out the objectives of the federal financial award understand 1) the federal statutes, regulations, and terms and conditions of the award, 2) how to evaluate and properly monitor compliance, and 3) the steps to take if noncompliance is identified.VIEWS OF RESPONSIBLE OFFICIALS: The Borough of Ellwood City concurs with the above noted finding and addresses this issue in the ‘Corrective Action Plan’ included within this report.

2024-005- Internal Control over Grant Monitoring and Reporting Finding Type: Material Weakness in Internal Control and Material Noncompliance in accordance with Uniform Guidance. Federal Program and Agency: Airport Improvement Program – ALN #20.106; U.S. Department of Transportation – Federal Aviation Administration (FAA) Repeat Finding: No Criteria: Per 2 CFR § 200.303 and 2 CFR § 200.510(b), the recipient is required to establish and maintain effective internal control over federal awards and to ensure complete and accurate reporting of all federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA). Adequate oversight and reconciliation processes must be in place to ensure all allowable expenditures are properly recorded and submitted for reimbursement. Condition: During the financial audit for fiscal year ending December 31, 2024, it was identified that approximately $2.7 million in expenditures related to a federally funded airport construction project were not communicated to the finance department in a timely manner. Consequently, the expenses were not reported in the correct accounting period and were excluded from the County’s grant monitoring process. These expenditures were incurred under ALN #20.106 and were not submitted for reimbursement timely. Questioned Costs: None. While invoices were not submitted timely, the costs incurred appear allowable, supported, and related to the approved project scope. The County has since submitted the majority of expenditures for reimbursement. Context: The prior period adjustment was identified during 2024 audit testing. Due to the lack of communication and oversight by the former Airport Manager and Grant Manager, these amounts were not reported in the proper period or submitted for reimbursement timely. The issue was not limited to a single transaction. A prior period adjustment was recognized in the 2024 financial statements to properly reflect these federal expenditures. Cause: The County did not have adequate internal controls in place to ensure timely receipt and tracking of grant-related invoices. The project oversight was insufficient, and the individuals responsible for managing the grant and construction activities failed to communicate expenditures to the finance department timely. Effect: The County materially understated federal expenditures in prior reporting period(s) and did not submit timely reimbursement request for eligible costs. This resulted in a material adjustment to the County’s financial statements and required correction in the current audit period. Recommendations: The County should implement formal internal control procedures to ensure all involved personnel are held accountable for timely communication of incurred costs. All federal grant activities should be monitored on a regular basis by the County and related departments to ensure expenditures are properly recorded and reported. View of Responsible Officials: The County concurs with the finding. The omission of the expenditures was the result of a lack of communication between the former Airport Manager, Grant Manager and finance department. Since discovery, the County has taken steps to ensure improved coordination and documentation of all grant-related expenditures. Project oversight and internal controls will be strengthened through regular reconciliation between project managers and the finance department to ensure timely reporting, submission for reimbursement, and inclusion on the SEFA. The County is in the process of submitting the allowable expenditures for reimbursement and updating internal procedures to prevent future occurrences.

Federal Agency U.S. Department of Housing and Urban Development Finding Reference Number 2024 001 Major Federal Program Section 811 Supportive Housing for Persons with Disabilities (14.181) Type of Finding Significant Deficiency, Noncompliance Compliance Requirement Special Tests and Provisions Replacement Reserves Account Criteria Line 10(a) of the HUD Regulatory Agreement states the following, "Borrower shall deposit a monthly amount of $__________. The amount of the monthly deposit may be increased or decreased from time to time at the written direction of HUD without a recorded amendment to this agreement" Title 2 U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements, Section 200.303(a) states that non federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During Special Tests and Provisions Replacement Reserves, the auditors identified deposits made to two HUD Replacement Reserve accounts that did not agree to amounts within the current HUD agreements. For one account, the deposit required was $275, and the Arc's deposit was $262. For the second account, the Arc deposited $394 instead of $410 as required, such that the deposits were being made timely, however for an incorrect amount. Effect The Arc was not in compliance with the Special Tests and Provisions Replacement Reserves requirement. Cause Due to lack of internal controls surrounding the review of changes to the replacement reserve requirements, the new required deposit amount was not input in the Arc's software, resulting in deposits of incorrect amounts. Questioned Costs There are no questioned costs related to this finding. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding This is a repeat finding of 2023 001. Recommendation We recommend that the Arc enhance its policies and procedures to ensure responsible program personnel timely reviews HUD communications and then validates replacement reserve account deposit amounts are adjusted accordingly for any required changes. Views of Responsible Officials We agree with the finding and have established additional internal controls to ensure future compliance as outlined in our corrective action plan.

2024 – 001 Federal Agency U.S. Department of the Treasury U.S. Department of Housing and Urban Development Federal Program Title Coronavirus State and Local Fiscal Recovery Funds Community Development Block Grants/Entitlement Grants Assistance Listing Number 21.027 14.218 Award Period January 1, 2024, through December 31, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR part 200.303 require that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Internal Control-Integrated Framework, published by the Committee of Sponsoring Organizations of the Treadway Commission, provides a framework for organizations to design, implement, and evaluate control that will facilitate compliance with the requirements of Federal laws, regulations, and program compliance requirements. 2 CFR Subpart D 200.302 (1) and 200.303 (a) stipulates that the auditee must identify, in its accounts, all Federal awards received and expended and the Federal programs under which they were received. Federal programs and award identification shall include, as applicable, the CFDA title and number, Federal award identification number and year, name of Federal agency, and name of the pass-through entity; establish and maintain effective internal control over Federal award that provides reasonable assurance that the auditee is managing Federal awards in compliance with Federal statutes, regulation, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Controller General of the United State and the "Internal Control Integrated Framework", issued by the Committee on Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Authority’s schedule of expenditures of federal awards (SEFA) did not include the expenditures related to the Coronavirus State and Local Fiscal Recovery Funds and the expenditures related to the Community Development Block Grants on the SEFA as required by Uniform Guidance for federal program 14.218. . Questioned costs: None Context: During the review of revenue for these federal grants, it was discovered and determined that they were not reported on the SEFA. Cause: The Agency was not aware of the requirements to include these expenditures on the SEFA. Effect: The Authority was not in compliance with 2 CFR Subpart D 200.302 (1), 200.303 (a). The Agencies’ programs’ expenditures may be disallowed if the expenditures are not reported correctly on the SEFA. Repeat Finding: No Recommendation: We recommend that the Agency review current procedures for creating the SEFA to ensure that it is accurately reporting loan balances and expenditures during the year under audit for all federal programs to ensure compliance with the Uniform Guidance. Views of responsible officials: There is no disagreement with the audit finding.

Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. Condition: The Minnesota Department of Human Services (DHS) maintains the computer system, MAXIS, which is used by the County to support the eligibility determination process. In the case files reviewed for eligibility, not all documentation was available or updated to support participant eligibility. In 6 of 40 the case files reviewed in 2024, documentation contained inconsistent information for citizenship verification in MAXIS. Context: The State of Minnesota contracts with the County Health and Human Services Department to perform the “intake function” (meeting with the social services clients to determine income and categorical eligibility), while the Minnesota Department of Human Services maintains the computer system, MAXIS, which supports the eligibility determination process and actually pays the benefits to the participants. Effect: The improper input of information into MAXIS and lack of verification or follow-up of eligibility determining factors increases the risk that a program participant will receive benefits when they are not eligible. Cause: Program personnel entering case information into MAXIS did not review or ensure all required information was input or updated correctly. Recommendation: We recommend the County implement additional procedures, including reviews, to provide reasonable assurance that all necessary documentation to support eligibility determination exists and is properly input into MAXIS. County’s Response: A Corrective Action Plan has been established with an anticipated completion date of December 31, 2025.

Finding number 2024-002, material weakness in internal controls over compliance – cash management Federal Agency: U.S. Department of Justice Federal Program: Justice Reinvestment Initiative, ALN 16.827 Criteria: 2 CFR 200.303 states that the non-Federal entity is responsible for maintaining effective internal controls over cash management to comply with the terms and conditions of the Federal award. Under CFR 200.305(b), the timing of cash draws for cost reimbursement awards should be as close as administratively feasible to the actual disbursements of the expenditures. Condition: During the year ended December 31, 2024, the Organization’s federal draw down requests were not properly reconciled to actual cash needs. This also resulted in an instance where $121,533 was required to be returned to the awarding agency in June 2024. Cause: Inadequate procedures to monitor cash needs based on actual expenditures. Effect: The Organization temporarily held federal funds without immediate need and is not requesting funds based on actual expenditures incurred. Questioned Costs: None Recommendation: Management should improve the monitoring of actual expenditures to better align cash needs and draw down requests with actual expenditures incurred. Views of Responsible Officials: Management concurs with this finding. See Corrective Action Plan.

US Department of Agriculture Federal Financial Assistance Listing #10.558 Child and Adult Food Care Program (CACFP) Applicable Federal Award Number and Year – 28-1183-000 7/1/2023 – 6/30/2024 and 7/1/2024 – 6/30/2025 Cash Management Material Weakness in Internal Control Over Compliance Criteria: CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations and terms and conditions of the federal award. Condition: The Organization was unable to provide adequate documentation to support the number of meals claimed for reimbursement. Cause: The Organization did not properly reconcile its reimbursement claims to its meal counts included in its attendance records. Effect: Meals claimed for reimbursement by the Organization were not properly supported by its internal records. Questioned Costs: None reported Context: Reimbursement to institutions is based upon the actual and verifiable daily counts of meals served by meal type (breakfast, lunch, snack and supper) and eligibility status (paid, reduced, free) multiplied by the applicable meal rate of reimbursement. A sample of four monthly reimbursement requests made by the Organization subject to the reporting requirement was selected for testing. Of the four monthly reimbursement requests selected, each of them contained variances between the reported number of meals served not agreeing to the Organization’s meal counts included in attendance records for the selected month. Of the items tested, meal counts were overstated by 396 meals for the meal types (breakfast, lunch and snack) on one monthly reimbursement request and understated by a total of 365 meals for the meal types (breakfast, lunch and snack) on three of the monthly reimbursement requests. Repeat Finding from Prior Years: Yes Recommendation: We recommend that management continue to evaluate its processes and controls to ensure that reimbursement requests for meals are properly reconciled to supporting documentation. Views of Responsible Officials: Management is aware of the deficiency in internal control over compliance. Management is in the process of reviewing its existing controls over the tracking and submitting of its meal counts included in its attendance records for reimbursement.

Finding: Eligibility Federal Assistance Listing Number 10.557 WIC – Special Supplemental Nutrition Program for Women, Infants, and Children Department of Agriculture Pass-through Entity: State of Colorado Department of Public Health and Environment FAIN: 253CO701W1003 Award Date: 10/1/2024 Criteria: According to 2 CFR Part 200.303 – The non-Federal entity must (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards, (c) Evaluate and monitor the non-Federal entity's compliance with statutes, regulations and the terms and conditions of Federal awards. As the funds are passed through the Colorado Department of Public Health and Environment, the Authority is required to utilize the State WIC eligibility system (COMPASS). Condition: The Authority is responsible for determining client eligibility and entering data into the COMPASS system. Although the Medicaid ID number is required for individuals with adjunct eligibility, it is not a mandatory field in COMPASS. Therefore, eligibility can be processed without entering this number. Testing revealed that the Authority did not consistently follow established controls requiring documentation of the state case ID for individuals deemed eligible based on participation in other state programs. Cause: Since the Medicaid ID number is not a required field in COMPASS, eligibility determinations can be processed without it. The system lacks reporting capabilities to identify missing entries in this field. Additionally, due to a high caseload, the Authority does not have the capacity to conduct 100% case reviews for all clients served. Effect: Although the individuals were correctly determined to be eligible for the WIC program, the Authority did not enter all required information into the COMPASS system. Questioned Costs: None. Context: We tested 25 clients for the WIC program for the year ended December 31, 2024 and noted four instances in which documentation of Medicaid ID number was not included within the COMPASS system. The total clients served by the Authority during the year was 25,906. A non-statistical sampling methodology was used to select the sample. Identification as a Repeat Findings: Not applicable. Recommendation: We recommend that the Authority expand existing case reviews to include five participant records per month per staff member. The results should be incorporated into annual performance evaluations. Additionally, we recommend enhanced training for all staff involved in eligibility determinations. Views of Responsible Officials and Planned Corrective Actions: Agree. See separate report for planned corrective actions.

2024-001 Cash Management – WIC Reimbursement to Member Counties Prior Year Finding Number: N/A Year of Finding Origination: 2024 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Significant Deficiency and Other Matter Federal Agency: U.S. Department of Agriculture Program: 10.557 WIC Special Supplemental Nutrition Program for Women, Infants, and Children Award Number and Year: 202792; 2024 Pass-Through Agency: Minnesota Department of Health Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 U.S. Code of Federal Regulations § 200.305(b) states payment methods must minimize the time elapsing between the transfer of funds from the federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. Condition: One of four subrecipient payments tested for compliance with federal cash management requirements was not paid timely to minimize the time elapsing between receipt of federal funds and disbursement to subrecipients. Questioned Costs: None. Context: Payment was made 126 days after receipt of the reimbursement request. The total amount reimbursed by the Minnesota Department of Health and paid to subrecipients is $1,087,575, consisting of 12 reimbursements. The sample of four reimbursements totaled $393,605. The payment made 126 days after receipt was for $89,935. The sample size was based on guidance from chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Effect: Partnership4Health is not in compliance with cash management requirements. Cause: Partnership4Health did not have backup procedures in place during an employee transition. Recommendation: We recommend Partnership4Health establish procedures to ensure cash management requirements are met. View of Responsible Official: Concur

Reference Number: 2024-003 Prior Year Finding: No Federal Agency: U.S Department of Housing and Urban Development Federal Program: Community Development Block Grants Assistance Listing Number: 14.218 Award Number: B-19-UC-42-0001, B-20-UC-42-0001, B-21-UC-42-0001, B-22-UC-42-0001, B-23-UC-42-0001, B-24-UW-42-0001 Compliance Requirement: Program Income Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Condition The County did not timely and accurately report program income received which caused the County’s reporting to HUD to be inaccurate. Criteria or specific requirement Compliance: CFR 570.504(a) states that the receipt and expenditure of program income as defined in §570.500(a) shall be recorded as part of the financial transactions of the grant program. Additionally, CFR 570.504(b)(2)(ii)) requires that program income be disbursed for eligible activities before additional funds are drawn from the U.S. Treasury account. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions the Federal award. These internal controls should comply with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Context Program income reported on Line 05 of the PR 26 report was $787,553, an additional $131,863 was collected in fiscal year 2024 but not reported. Cause Amounts received by the County were not identified timely. Effect The amount reported by the County to HUD related to program income was inaccurate. Questioned Costs Management indicated that $131,863 of collections in fiscal year 2024 was omitted from the PR 26 report. Recommendation We recommend that management identify its collections related to program income in a timely manner, modify its draw request appropriately, and report the accurate amounts to HUD. Views of responsible officials and planned corrective actions The county will continue to report the correct amount of program income to HUD. Receipts will be entered more timely.

Reference Number: 2024-004 Prior Year Finding: No Federal Agency: U.S Department of Housing and Urban Development Federal Program: Community Development Block Grants Assistance Listing Number: 14.218 Award Number: B-19-UC-42-0001, B-20-UC-42-0001, B-21-UC-42-0001, B-22-UC-42-0001, B-23-UC-42-0001, B-24-UW-42-0001 Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Condition The County could not report the prime awards within the required timeframes for its first-tier subawards of $30,000 or more. Criteria or specific requirement Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA) And Title 2 U.S. Code of Federal Regulations (CFR) Part 170 Appendix A, prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. As of March 8th 2025, FSRS.gov was retired, and all subaward reporting data and functionality are now on SAM.gov. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions the Federal award. These internal controls should comply with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Context The seven subawards selected for testing were not reported in FSRS or SAM.gov by the end of the month following the month in which the amounts were awarded. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause The County’s controls were not operating effectively to ensure the reporting was performed in accordance with federal requirements. Effect Subawards were not reported to FSRS or SAM.gov in accordance with FFATA requirements. Questioned Costs None noted. Recommendation We recommend that the County develop internal controls and procedures to ensure that FFATA reporting requirements are met and ensure that all required subawards are reported accurately and timely to FSRS or SAM.gov. Views of responsible officials and planned corrective actions All of the County’s 2024 grants have been entered into FFATA and our 2025 grants and going forward will be entered when awarded.

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S Department of Justice Federal Program: Congressionally Recommended Awards Assistance Listing Number: 16.753 Award Number: 15PBJA-23-GG-00920-BRND Compliance Requirement: Cash Management Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Condition The County received reimbursement for the total grant award amount prior to incurring expenditures. Criteria or specific requirement Compliance: Per 2 CFR section 200.305(b) For recipients and subrecipients other than States, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions the Federal award. These internal controls should comply with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Context The County received $2.5 million on July 1, 2024, for the grant, as of that date the general ledger reported no expenditures. The County incurred expenditures of $274,235 in October, $62,247 in November, and $2,160,518 in December. Cause The County’s controls were not operating effectively to ensure reimbursement request were performed in accordance with federal requirements. Effect The County had to return funding of $1,367,790 in November, which was subsequently drawn in December when expenditures were incurred. Questioned Costs None noted. Recommendation We recommend that the County develop internal controls and procedures to ensure drawdowns are performed in a manner to minimize the time between drawing and disbursing federal funds Views of responsible officials and planned corrective actions Fiscal Clerk has been trained on proper drawdown of grant funds and accurate recording of expenditures.

Criteria: 2 CFR 200.303 includes requirements related to internal controls for federal award programs, including that the Organization must, among other things, “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)”. Condition and Context: During 2024, the Organization reconciled the applicable match at the end of the grant period and submitted to the City of Indianapolis. There was no documentation on review of the schedule of the match nor was there a periodic assessment of the match until the reporting date. This is a repeat finding of 2023-003. Cause and Effect: We noted a lack of internal controls surrounding the tracking and review of the match. Errors could have occurred in the annual grant matching report which could have resulted in material non-compliance. Recommendation: We recommend the Organization implement procedures to track the match on a monthly basis with adequate review and approval. Views of Responsible Officials and Planned Corrective Actions: The Organization agrees with the recommendation and has implemented the recommendation noted.

Finding 2024-001 Evidence of Approval for Grant Expenditure Federal Program Name: Economic Adjustment Assistance Assistance Listing Number: 11.307 Type of Finding: Internal Control Deficiency Criteria 2 CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 200.303 specifies that a nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition The Council’s internal control policies do not include a requirement for documented approval of all grant expenditures, and accordingly certain expenditures that were tested during the audit did not show evidence of approval. Questioned Costs None Cause The Council’s internal controls allow for verbal approval or no approval in instances where access is limited to certain authorized individuals. Effect The Council’s internal controls leave them vulnerable to potential improper expenditures and without approvals of each transaction detection of improper expenditures may be limited. Recommendation It is recommended that the Council ensure all grant-funded expenditures have documented approval.

Federal agency: U.S. Department of Health and Human Services Federal Award Project Title: Better Family Life’s Relationship, Education, Advancement, and Development for Youth for Life Project Assistance Listing Number: 93.086 Assistance Listing Program Title: Healthy Marriage Promotion and Responsible Fatherhood Grants Award Period: September 30, 2023 – September 29, 2024 Award Period: September 30, 2024 – September 29, 2025 Federal agency: U.S. Department of Health and Human Services Federal Award Project Title: Better Family Life’s Teen Pregnancy Prevention Education Assistance Listing Number: 93.297 Assistance Listing Program Title: Adolescent Health Programs Award Period: July 1, 2023 – June 30, 2024 Award Period: July 1, 2024 – June 30, 2025 Type of Finding: Significant Deficiency in Compliance and Internal Control over Compliance Criteria: Related to cash management, when entities are funded on a reimbursement basis, program costs must be incurred before the drawdown is requested according to CFR section 200.305. Nonprofits should document the basis, or calculation, used for each drawdown request to show that the amount requested matches the expenses incurred for the period. Additionally, CFR section 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control over the Federal awards that provides reasonable assurance that the Federal expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. Drawdown requests should be reviewed and approved by appropriate personnel prior to submission by reviewing supporting documents to ensure amounts have been incurred.Condition: During audit testing of compliance and internal control over compliance, it was discovered funds were drawn down several times based on estimated bi-monthly expenses. Additionally, drawdown requests were not properly reviewed and approved by appropriate personnel. Cause: Due to staff turnover and timing constraints, the Organization utilized reasonable estimates rather than exact amounts for drawdown requests. Additionally, review and approval procedures related to drawdown requests were not being consistently performed. Effect: The estimated drawdown of funds could be different than actual expenditures incurred for the period, leading to costs being reimbursed prior to costs being incurred. As of December 31, 2024, all funds drawn were for expenses incurred prior to December 31, 2024. Additionally, the inconsistent application of internal controls could result in reimbursement of costs that were not incurred prior to drawdown. Questioned costs: No questioned costs were identified. Context: During audit testing of the Organization’s compliance and internal controls over compliance related to cash management, it was discovered the Organization at times utilized reasonable estimates rather than exact amounts for drawdown requests. Additionally, there was no review and approval of drawdown requests by appropriate personnel after February 2024, due to staff turnover. The audit team did not identify any questioned costs and concluded that the control failure was not indicative of fraud or illegal activities. Due to the compliance finding and lack of control, the audit team concluded the finding to be a significant deficiency in compliance and internal control over compliance. Recommendation: We recommend the Organization implement procedures to monitor drawdowns of funds so that funds are only requested when approved and documented reimbursable expenses have been incurred. Additionally, we recommend that management establish and enforce documented review and approval procedures of all drawdown requests. View of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal Award Project Title: Better Family Life’s Relationship, Education, Advancement, and Development for Youth for Life Project Assistance Listing Number: 93.086 Assistance Listing Program Title: Healthy Marriage Promotion and Responsible Fatherhood Grants Award Period: September 30, 2023 – September 29, 2024 Award Period: September 30, 2024 – September 29, 2025 Federal agency: U.S. Department of Health and Human Services Federal Award Project Title: Better Family Life’s Teen Pregnancy Prevention Education Assistance Listing Number: 93.297 Assistance Listing Program Title: Adolescent Health Programs Award Period: July 1, 2023 – June 30, 2024 Award Period: July 1, 2024 – June 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: CFR section 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control over the Federal awards that provides reasonable assurance that the Federal expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. Required reports should be reviewed and approved by appropriate personnel for completeness and accuracy, including comparing source documentation and any reconciliations between source data to final reporting. Additionally, appropriate personnel should review and approve the application of the indirect cost rate prior to each drawdown request. Condition: During audit testing of internal controls over compliance, it was discovered review and approval procedures were not being consistently performed related to Federal reporting and drawdown requests for payment of indirect costs (allowable costs).Cause: Due to staff turnover and timing constraints, review and approval procedures related to Federal reporting and drawdown requests for indirect costs (allowable costs) were not being consistently performed. Effect: The control failure could result in inaccurate Federal reporting and questioned costs related to payment of indirect costs. Questioned costs: No questioned costs were identified.Context: During audit testing of the Organization’s internal controls over reporting and indirect cost rate (allowable costs), it was discovered there was inconsistent review and approval of Federal reporting and inconsistent review and approval of drawdown requests for indirect costs. The audit team did not identify any questioned costs and concluded that the control failure was not indicative of fraud or illegal activities. Due to the lack of control, the audit team concluded the control failure was a significant deficiency in internal control over compliance. Recommendation: We recommend that management establish and enforce review and approval procedures related to all Federal reporting and indirect cost rate drawdown requests. View of responsible officials: There is no disagreement with the audit finding.

Subrecipient Monitoring U.S. Department of Health and Human Services Special Programs For The Aging, Title III, Part C, Nutrition Services – ALN #93.045 Criterion: Per CFR 200.331 the grantee must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Per CFR 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The County passed through funding to nine subrecipients totaling $3,434,144. During 2024, management did not properly monitor the subrecipients. Specifically, for the nine of the nine subrecipients management was unable to provide any documented evidence of a monitoring being performed although the contract periods are ongoing for all nine subrecipients. Cause and Effect: Management lacks a process to ensure that the monitoring of subrecipients is occurring during the contract period, and evaluation of each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Therefore, subrecipients were not properly monitored in accordance with 2 CFR 200.331 nor in accordance with the County’s Subrecipient Monitoring Policy. Questioned Cost: None Recommendation: We recommend that management enhance the design of its control activities to ensure that subrecipient files are adequately maintained, and perform risk assessment evaluations on all subrecipients to ensure they are effectively monitored during the contract period noted in the contractual agreements and the County’s Subrecipient Monitoring Policy. View of Responsible Officials: The Department of Senior Services agrees with this finding. Senior Services follows the monitoring standards established by the pass-through entity. However, the Department has implemented process improvements to ensure that all Program Year 2024_2025 compliance processes were met. The current period monitoring plan, risk assessments and monitoring have been completed. The Department will maintain an annual monitoring plan to ensure that all subrecipients are monitored in compliance with 2 CFR200 requirements.

Subrecipient Monitoring U.S. Department of Health and Human Services Substance Abuse Prevention – ALN #93.243 Criterion: Per CFR 200.331 the grantee must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Per CFR 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The County passed through funding to three subrecipients totaling $4,324,361. During 2024, management did not properly monitor the subrecipients. Specifically, for one of the three subrecipients management was unable to provide any documented evidence of a monitoring being performed although the contract periods are ongoing for the subrecipient; and all three subrecipient files did not contain risk assessment evaluations. Cause and Effect: Management lacks a process to ensure that the evaluation of each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Therefore, subrecipients were not properly monitored in accordance with 2 CFR 200.331 nor in accordance with the County’s Subrecipient Monitoring Policy. Questioned Cost: None Recommendation: We recommend that management enhance the design of its control activities to ensure that subrecipient files are adequately maintained, and risk assessment evaluations are performed on all subrecipients to ensure they are effectively monitored during the contract period. View of Responsible Officials: The Fulton County Department of Behavioral Health and Developmental Disabilities (DBHDD) concurs with the finding. DBHDD currently performs continuous monitoring activities with program subrecipients by conducting weekly meetings, reviewing monthly reports, invoices, and conducts quarterly performance reviews. DBHDD will strengthen its subrecipient monitoring internal controls by properly documenting these reviews in order to be incompliance with 2 CFR 200.331 and the County’s Subrecipient Monitoring Policy.

Allowable Costs U.S. Department of Justice National Sexual Assault Kit Initiative – ALN #16.833 Criterion: Per 2 CFR 200.303, a non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and terms and conditions of the Federal Award. Costs must be necessary and reasonable for the performance of the Federal Award and allowable thereto under the principles in 2 CFR part 200, subpart E. In addition, when employees work on projects funded by federal grants, the non-federal entity must certify the time and effort the employee dedicated to the grant funded project. This ensures proper tracking and accountability of grant funds. Condition: Based upon our testwork, we noted that 24 out of our sample of 60 payroll expenditures charged to the program were not adequately supported. The total population was $375,901. The 24 payroll samples tested in which adequate support was not provided totaled $80,654. Cause and Effect: Management lacks a process to ensure that payroll costs are properly allocated to federal programs. Therefore, payroll costs were not properly allocated to the federal program in accordance with 2 CFR part 200, subpart E. Questioned Cost: The questioned costs associated with our payroll sample amounted to $80,654. Recommendation: We recommend that management enhance the design of its control activities to ensure that payroll costs are properly allocated to the appropriate Federal programs. View of Responsible Officials: The Fulton County District Attorney concurs with the finding. In July 2024, the Fulton County District Attorney’s Office (FCDAO) was made aware during their Department of Justice monitoring review of the need to strengthen its time and effort supporting documentation for all employees paid with Federal funds in order to be in compliance with the 2 CFR 200 compliance requirement. Effective August 2024, the processes have been revised, documented, and are now included in the FCDAO standard operating procedure for time and effort management.

Finding 2024–001: Reporting – Recordkeeping Federal Department: U.S. Department of Agriculture Federal Award Identification Numbers and Year: 24N1199 Pass-through Agency: Illinois State Board of Education (ISBE) Child Nutrition Cluster: Summer Food Service Program for Children (SFSPC), Federal Assistance Listing Number 10.559 Criteria Federal regulations (7 CFR 225.15(d)) state (1) each sponsor shall hold Program training sessions for its administrative and site personnel and must not allow a site to operate until personnel have attended at least one of these training sessions. (2) Sponsors must conduct pre-operational visits for new sites, sites that experienced operational problems the previous year, and existing sites that are new to non-congregate meal service, to determine that the sites have the capacity to provide meal service for the anticipated number of children in attendance and the capability to conduct the proposed meal service. (3) Sponsors must visit each of their sites, as specified in paragraphs (d)(3)(i) through (iv) of this section, at least once during the first two weeks of program operations and must promptly take such actions as are necessary to correct any deficiencies. (i) Training of site personnel must, at a minimum, include: the purpose of the Program; site eligibility; recordkeeping; site operations, including both congregate and non-congregate meal services; meal pattern requirements; and the duties of a monitor. (ii) Each sponsor must ensure that its administrative personnel attend State agency training provided to sponsors, and sponsors must provide training throughout the summer to ensure that administrative personnel are thoroughly knowledgeable in all required areas of Program administration and operation and are provided with sufficient information to enable them to carry out their Program responsibilities. (iii) Each site must have present at each meal service at least one person who has received this training. (4) Sponsors must conduct a full review of food service operations at each site at least once during the first four weeks of Program operations, and thereafter must maintain a reasonable level of site monitoring. Sponsors must complete a monitoring form developed by the State agency during the conduct of these reviews. Sponsors may conduct a full review of food service operations at the same time they are conducting a site visit required under paragraph (d)(3) of this section. The United States Department of Agriculture, Food and Nutrition Service, The Summer Food Service Program (SFSP), 2024 Introduction to the Summer Food Service Program Administration Guide, Unit 4: Operating the Meal Service for the Summer Food Service Program, states “It is critical that site personnel and monitors understand the importance of accurate point of service meal counts. Only complete meals served to eligible children can be claimed for reimbursement. Meal counts are required for each day and each meal service in which meals and snacks are served. Therefore, meals and snacks must be counted at the actual point of service, as they are served, to ensure that an accurate count of meals served is obtained and reported). Counting meals at the point of service also allows site personnel to ensure that only complete meals are served.” Also, Unit 3: Administering Summer Food Service Program states “sponsors must be able to document that they have met their monitoring requirements. Monitors must submit a report for pre-operational site visits, initial site visits, and full meal service reviews throughout the summer.” Chicago Park District’s (the District) Summer Food Program 2018 Monitor’s Orientation Handbook requires monitors checking site operations to make sure that the site maintains adequate records and that the program is operating in accordance with the requirement. To comply with this requirement, the District utilizes a monitoring checklist that is attached to each site file. The checklist requires documentation of ISBE approved application, ISBE participation detail, the District application, field trip data, authorized signature form, authorized signature form, training sign-in sheets, certificate of training, park enrollment roster and site responsibilities. Per the District’s Summer Food Program Management manual, the District replaced a series of paper forms with two online forms: Summer Food Weekly Summary and Summer Food Program Daily Timesheets. However, two paper documents will continue to exist, the daily receipts and the state mandated Daily Meal Count Form. 2 CFR Part 200, Subpart D – Post Federal Awards Requirements, Section 200.303 Internal Controls states “The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient and subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations and the terms and conditions of Federal awards. Condition During the current audit period, the District did not adequately document its compliance with the special tests and provisions requirements of the SFSPC. This included maintaining adequate controls over required monitoring and meal count forms to ensure forms were properly completed and approved by authorized personnel. Cause Per our discussions with management, the SFSP was administered across 198 sites on a daily basis during the summer months. Specifically, in 2024, the program and the corrective actions planned were interrupted and significantly impacted due to a shortage of staff as positions were not filled successfully. Effect Failure to maintain supporting documentation of the required monitoring and meal count forms and ensure that the forms have been properly completed and approved by authorized personnel is a violation of the program’s requirements and impairs the District’s ability to adequately monitor the federally funded program. This could also result in questioned and disallowed costs, which the District may need to reimburse to its grantor agency. Questioned Costs None. Context During our testing of monitoring at 25 sites (total sites operated under the program during 2024 was 198 sites), we noted the following:  For two sites (8%), the monitoring site review form was not properly completed. The form was either missing the monitor departure time or the monitor departed early (five minutes after the start of the approved mealtime).  For four sites (16%), we were unable to properly identify who signed the site visit or the monitoring site review forms because of illegible signatures, without some assistance from the District’s personnel. For the 25 sites sampled, we tested a total of 10 days (July 8 through July 12 and July 22 through July 26) from a population of 39 days (calculated based on the number of days meals were claimed for reimbursements during the program) to verify that the delivery ticket, daily meal count form, and the Summer Food Weekly Summary form were properly completed and reviewed by authorized personnel. We noted the following:  For six sites (24%), we were unable to properly identify who signed the delivery ticket and/or daily meal count forms due to illegible signature, without some assistance from the District’s personnel. Identification of Repeated Findings Repeated (Prior Finding Numbers 2023-001 and 2022-001). Recommendation We recommend the District continue to implement internal controls to improve compliance with federal regulations over the SFSP. In addition, we recommend the District ensure adequate staff resources and training are in place to ensure accurate reporting of all meals served, as well as all required forms are properly completed. Also, we suggest the District update its policy manual to define “reasonable monitoring” of the SFSP program, including any deviations from its current practice of completing at least two monitoring site reviews forms. Lastly, we suggest the District update its required forms (daily meal count, site visit/monitoring site review) to have authorized personnel include a printed signature, which will assist in easily identifying and verifying that the person is authorized to sign the form(s). Views of Responsible Officials and Planned Corrective Action The District agrees with the finding and recommendation. The District’s corrective action plan is on page 17.

Finding 2024-001 – Reporting (Compliance, Internal Controls Over Compliance) Material Weakness ALN 10.767 Intermediary Relending Program Criteria: Under Intermediary Relending Program (IRP) regulations (7 CFR §4274.338(b)(4)(ii)(A)), recipients must submit quarterly and semiannual financial reports to USDA Rural Development. Additionally, 7 CFR §4274.338(b)(4)(iii), requires submission of an annual proposed budget. Under Uniform Guidance, 2 CFR §200.303, entities are required to establish and maintain effective internal controls over federal awards to ensure compliance, including management review procedures to verify reports are accurate, complete, and timely. Condition: Testing of the reporting requirements disclosed that the quarterly and semiannual IRP reports were not submitted to USDA Rural Development. Questioned Costs: None Cause: BASEC was unaware of the IRP reporting requirements and has not established a formal review and approval process for preparing and submitting the required reports. Effect: The absence of timely submission of required reports results in noncompliance with federal program requirements. Recommendation: We recommend that BASEC establish and document a formal review and approval process for quarterly and semiannual IRP reports, in accordance with 2 CFR §200.303. The process should include supervisory review, documented approval (e.g., sign-offs or electronic authorization), retention of supporting documentation, and a tracking system to ensure timely submission. Views of Responsible Officials: See the corrective action plan that accompanies the schedule of findings and questioned costs.

Assistance Listing Numbers: 10.001, 10.200, 10.215, 10.307, 10.310, 10.311, 10.443 and 10.912 Name of Federal Program or Cluster: Research and Development Cluster Name of Federal Agency: Department of Agriculture Federal Award Identification Numbers: 58-5090-2-037 2022-38624-38368 2021-38640-34714 A0242501X443G026 2022-38640-37486 2023-51300-40959 2021-68012-35917 2019-68012-29852 2020-68012-31934 2021-49400-35592 NR225F48XXXXG006 Direct Award Periods: August 1, 2022 through July 31, 2027, September 1, 2023 through February 28, 2025, September 29, 2022 through September 30, 2027, September 27 2024 through September 26, 2027 and September 27, 2022 through June 30, 2026 Name of Pass-through Entities and Award Periods: Michigan State University-September 1, 2022 through August 31, 2025; Regents of the University of Minnesota-March 1, 2022 through February 28, 2025, April 1, 2023 through March 31, 2025, and September 1, 2020 through August 31, 2025; Board of Regents of the University of Wisconsin System-January 1, 2022 through December 31, 2026 and September 1, 2018 through August 31, 2024. Criteria or Specific Requirement: In accordance with 2 CFR § 200.303, non-federal entities must establish and maintain effective internal control over federal awards to provide reasonable assurance that the entity is managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. Additionally, changes in key personnel typically require prior written approval from the federal awarding agency or pass-through entity, as described in 2 CFR § 200.308(c)(2). Condition: During the audit, we noted that the Organization does not have documented internal controls or formal procedures in place to monitor and manage compliance with the key personnel requirements under its federal awards. Specifically,  There is no control in place to identify or track which personnel are designated as “key personnel” in award documents.  No procedures exist to ensure that required prior approvals are obtained from the federal awarding agency before any changes in key personnel are made.  No review or oversight process is in place to ensure that key personnel are actively participating at the level of effort committed in the approved award. Cause: The Organization has not developed or implemented policies and procedures to ensure compliance with special terms and conditions related to key personnel requirements under federal awards. Effect or Potential Effect: The lack of internal controls over key personnel requirements increases the risk that required prior approvals may not be obtained when changes occur, or that personnel effort commitments are not being met. This could result in noncompliance with the terms and conditions of the award, potential disallowance of costs, or reputational risk with federal awarding agencies. Repeat Finding: This finding is a repeat of Finding 2023-007. Recommendation: The Organization should implement internal controls and written procedures to:  Identify and track key personnel for each award, based on the approved budget or notice of award.  Establish a process to ensure that prior written approval is obtained before any changes to key personnel are made.  Monitor and document key personnel effort to ensure it aligns with award requirements and commitments.  Provide training to relevant staff on the importance of key personnel compliance and the procedures for requesting changes. Views of Responsible Officials: Management agrees with the finding and will implement internal controls and document its policies and procedures related to key personnel.

Type of Finding: Significant deficiency Federal Agencies, Programs, and Assistance Listing Numbers: o U.S. Department of Agriculture:  State of Hawaii, Office of Education, Hawaii Child Nutrition Program: Summer Food Service Program for Children (Assistance Listing No. 10.559) Criteria – In accordance with Title 2, Subtitle A, Chapter II, Section 200.303 (2 CFR § 200.303), non-federal entities must establish and maintain effective internal controls over federal awards that provide reasonable assurance that the entity is managing the award in compliance with federal statutes, regulations, and terms and conditions of the award. Segregation of duties and management oversight are essential components of effective internal control. Condition – During our audit, we noted that the meal reimbursement claims submitted for June and July 2024 reconciled to supporting documentation. However, there was no evidence of management's review and approval of the submitted meal reimbursement claims. Cause – The Organization's meal reimbursement process did not require management review or approval of claims prior to submission. Effect – Insufficient management review increases the risk of unsubstantiated claim reimbursements which could result in noncompliance with program requirements. Questioned Costs – None Identification as a Repeat Finding, if applicable – Not a repeat finding. Recommendation – In addition to existing processes and controls over meal reimbursement claim submissions, we recommend management document their review and approval of meal reimbursement claims with a reviewer sign off. Views of Responsible Official(s) and Planned Corrective Action – See Corrective Action Plan on page 41.

2024-002 - Lack of Independent Review and Approval Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Control over Compliance (Allowable Costs/Cost Principles, Cash Management and Reporting) Program. Environmental and Scientific Partnerships and Programs; U.S. Department of State; ALN Number 19.017; Award Number SAQMIP23CA0021 Criteria. Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal controls over federal awards that provides reasonable assurance that the recipient is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. Condition. During our testing of Allowable Costs/Cost Principles, of the 12 items tested, we noted all 12 instances where time sheets were missing evidence of review and approval. In addition, there were no evidence of review and approval of the hourly rate or salary for all the employees tested. During Cash Management testing, of the three items tested, all three drawdown requests were missing evidence of review and approval. Finally, during our testing of Reporting, all four of the reports selected for testing lacked evidence of review and approval. Cause. This condition is the result of management not adhering to the Organization's internal control policies and procedures. Effect. The Organization did not comply with the federal requirements as noted per 2 CFR 200.303. Questioned Costs. None Recommendation. We recommend the Organization adheres to their internal control process of an independent review and approval of transactions, cash management and reporting related to federal grant programs. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.

Program Name – STOP Violence Grant- Victim Services CFDA Number – 16.588 Pass-through Entity – Michigan Department of Health and Human Services Finding Type – Significant Deficiency and Noncompliance Criteria – Per 2 CFR § 200.303 (Internal Controls), recipients of federal funds must establish and maintain effective internal controls over compliance. Additionally, the program requires recipients to maintain adequate documentation to support that services are provided to eligible participants. This includes maintaining enrollment forms or other supporting records that verify participant eligibility as required by the applicable federal regulations. Condition and Description – For 4 out of 20 samples tested, during our testing of participant eligibility under the STOP Violence against Women Formula Grants, the Organization was unable to provide enrollment forms or supporting documentation. These forms are necessary to verify that participants met the program’s eligibility criteria. Questioned Costs – Unknown. Id entification of a Repeat Finding- This is not a repeat finding from the immediate previous audit. Cause/Effect – The absence of enrollment documentation appears to result from a lack of internal controls over participant intake and recordkeeping processes. Specifically, procedures were not in place to ensure all required eligibility documentation was collected and retained in participant files. As a result, the Organization was unable to demonstrate that services were provided only to eligible individuals. Recommendation – We recommend that the Organization implement and enforce procedures to ensure all required enrollment and eligibility documentation is consistently collected and retained for each program participant. Staff should be trained on eligibility requirements and federal documentation. View of Responsible Officials and Planned Corrective Action – Procedures exist to ensure all clients are enrolled and eligible for services under the STOP grant. The external audit did not take into account the legal screening process and the intake forms used to determine eligibility and complete client enrollment, outside of the Apricot system. Enforcement of enrollment procedures within Apricot, and oversight from department Directors, has been made a priority.

Criteria: 2 CFR section 200.303 states in part: “The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . .” Additionally, 31 CFR section 205.33 states in part: (a) “…the timing and amount of funds transfers must be as close as is administratively feasible.. .” Condition: An effective internal control system was not in place to ensure compliance with requirements related to the grant agreement and the Cash Management compliance requirements. Cause: The Corporation's management has not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: There was no formal review/approval of claim reimbursements outside of who prepares them. The failure to establish an effective internal control system places the Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of effective reviews could have also allowed noncompliance with the compliance requirements and allowed misuse, mismanagement, and improper period recognition of federal funds and assets. Claim reimbursements were not drawn in a timely or consistent manner. For example, claims were drawn anywhere from six- twelve months after costs were incurred or not at all. A lack of timely claim submission could result in failure to fully expend the grant within the period of performance and proper revenue recognition. Recommendation: We recommend that the Corporation establish policies and procedures to ensure that reimbursement claims prepared are reviewed and approved. The reimbursement claim should be compared to supporting documentation to ensure accuracy of the claim reimbursement form. Reimbursement claims should also be prepared and submitted timely to help ensure proper period recognition and adequate reimbursement. Views of Responsible Officials and Corrective Actions: During 2025, Hamilton County Area Neighborhood Development, Inc. (HAND) hired a controller to assist with the preparation of the parent company and subsidiaries financials while instituting improved internal control policies. As such, HAND with the assistance of its controller will establish effective internal control systems to ensure compliance with the requirements for grant agreements and cash management compliance requirements.

Finding: Item 2024-001 – Internal Controls over Federal Programs Material Weakness Federal Program – COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number – 21.027 Pass-through Grantor's Numbers – CMF 2021125, 2159FR0292, 2159FR0310, 2159FR0317, 2159FR0334, 2159FR0318 Federal Award Year – December 31, 2024 Federal Agency – U.S. Department of Treasury Pass-Through Entity – Tulsa County/City of Tulsa Criteria: 2 CFR 200.303 requires that organizations receiving federal awards must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing federal awards in compliance with federal statutes, regulations and terms and conditions of the federal award. Condition/context: Formal controls were not established or documented surrounding the following compliance requirements specified for this grant under 2 CFR Part 200, Appendix XI: Suspension and Debarment – no established internal control policies to verify that vendors selected for use were not suspended or debarred from use for expenditures of federal awards. Cause: The Foundation and its affiliates have not established internal control policies to ensure compliance with principles established under the Uniform Guidance. Effect: Lack of internal controls could result in instances of noncompliance with federal grant requirements, which could lead to loss of future funding or requests for repayment of federal awards previously distributed by federal agencies. Questioned cost: Not applicable. Repeat finding: Yes, 2023-003. Recommendation: The Foundation and its affiliates should establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework" issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). View of responsible officials: Management's response is reported in "Corrective Action Plan" at the end of this report.

Finding 2024-002 Journal Entry Approval - Significant Deficiency in Internal Control over Compliance Identification of the Federal Program Department of Health and Human Services ALN 93.600 Head Start Cluster Year – 2024/2025 | FAIN: 90CI010156/90BF000005 Criteria or Specific Requirement The Uniform Guidance in 2 CFR Section 200.303, Internal Controls requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition During our testing of disbursements, we noted the following exceptions: • 3 out of 3 journal entries that were selected did not have adequate supporting documentation. Cause Internal control process for retention of the source documentation was not followed. Effect or potential effect Unallowable costs may have been recorded as grant expenses. Questioned Costs None noted. Context For the testwork for allowable activities over the Head Start Cluster we requested source documentation detailing appropriate review and approval of journal entries. The Organization was unable to provide this documentation. Identification as a Repeat Finding Not a repeat finding. Recommendation We recommend that the Organization comply with the requirements of CFR section 200.303 and establish a documentation retention policy and maintain records of the review and approval process in accordance with the Uniform Guidance. Views of responsible officials Management agrees with the finding. Steps will be taken to correct the retention of source documentation process and enhance internal controls to prevent similar occurrences in the future.

2024-001 U.S. Department of Education, Education Stabilization Fund, Passed Through the State of Nevada Department of Education – Internal Controls System Over Allowable Costs and Allowed Activities Criteria: As defined in 2 CFR 200.303, auditee is required to maintain a system of internal control over compliance designed to provide reasonable assurance that federal award transactions executed are in compliance with the terms and conditions of the federal award. Funds utilized under the Education Stabilization Fund program are required to be expended on costs consistent with those outlined in 2 CRF 200 Subpart E – Cost Principles, and within the core service categories outlined in the grant agreement. Condition: For one pay period selected for testing, three of the thirteen employees charged to the grant did not have an approved Payroll Action Form which assigns the appropriate percentage of payroll and related expenses to be allocated to the grant. Context: Management failed to design and implement consistent internal controls to address the risk of improper payroll amounts being allocated to the grant. Cause: Internal controls over payroll allocations was not performed consistently to ensure all payroll allocations and related expenses were properly reviewed. Effect: Failure to design and implement controls over the approved payroll allocations could result in the grant being overcharged. Recommendations: We recommend management design and implement a system of internal controls whereby all employee time and expenses include the appropriate review and approval when included as part of the Organization’s Request for Reimbursement. Views of Responsible Officials and Planned Corrective Action: CORE, Powered by The Rogers Foundation has discontinued the use of the Payroll Action Forms for tracking labor allocations. As of August 2025, all grant-funded positions have been converted to hourly status, with time and effort now documented directly by employees through Paylocity, the Organization’s timekeeping system. Employees clock in and out and designate the appropriate labor allocations for each portion of their workday. Human Resources pulls the Paylocity timecard reports for all grant-funded positions for each pay period. These timecards undergo a documented, multi-level review and approval process: first by the Program Manager, then by the Grant Manager. Approved timecards are uploaded to a secure shared drive, where the Grant Accountant uses them to prepare Requests for Reimbursement (RFRs). Before submission, the Grant Manager performs a final review of all expenses and supporting documentation and provides written sign-off on the total amount. CORE, Powered by The Rogers Foundation has designed and implemented this documented, multi-level internal control system to ensure all payroll charges are properly authorized, supported, and retained prior to included in RFRs, thereby preventing recurrence of the issue identified in the audit.

Criteria: Per 2 CFR §200.303(a), the non-Federal entity must establish and maintain effective internal controls over Federal awards to provide reasonable assurance that the awards are managed in compliance with Federal statutes, regulations, and the terms and conditions of the award. Condition: During our testing of expenses and invoices submitted for reimbursement under the Community Project Funding and Miscellaneous Grants, we identified invoices that were submitted for reimbursement which did not align with the Organization’s internal grant allocations as recorded in the profit and loss by class. Context and Cause of Condition: The Organization provided incorrect supporting documentation to support certain draw requests. This occurred in part because the Organization is new to managing Federal awards and lacked established procedures for ensuring that documentation submitted matched what was recorded in the accounting system. While errors were noted in the documents provided, the Organization had sufficient allowable expenses and invoices to fully support the draw requests made during the year within all material respects. Questioned Costs: None Potential Effect: These conditions increase the risk of error or fraud in grant reporting and could result in noncompliance with Federal requirements, potential questioned costs, or cash management issues. Recommendation: We recommend that management: • Establish procedures to ensure the correct invoices and expenses are submitted with draw requests. • Ensure all expenses are properly coded in the profit and loss by class to the correct funding source and recorded on the accrual basis of accounting. • Base draw requests on amounts recorded in the accounting system to ensure accuracy, consistency, and compliance with Federal requirements. Views of Responsible Officials: The Organization concurs with the finding and recommendation. See Corrective Action Plan.

Finding 2024-003: Notification of Disbursements to or on Behalf of StudentsIdentification of the federal program: Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans), 84.063 Federal Pell Grant Program, 84.007 Federal Supplemental Education Opportunity Grant Program. Award Periods: July 1, 2023 through June 30, 2024; July 1, 2024 through June 30, 2025. Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:“The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”34 CFR 668.165(a)(1) – Before an institution disburses title IV, HEA program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans. Condition:When Direct Loans are being credited to a student’s account, an institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan; and (3) the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan. Atrium Health CMHA was unable to provide the notification letters sent to the student as they are not maintained. Further, there were three instances where student disbursements were not made timely and one instance where a disbursement resulted in a credit that was not returned timely. Cause:The current IT system does not allow for the letters sent to be saved.Effect or potential effect: The disbursement notification letters may not have be sent in accordance with the regulations.Questioned costs:None.Context:Total expenditures for the Student Financial Assistance Cluster were $2,876,252 for the year ended December 31, 2024. We selected a sample of 40 disbursements and identified 33 that did not have notification of disbursement and one disbursement that resulted in a credit that was not refunded within the time frame.Identification as a repeat finding, if applicable:This finding is a repeat finding of 2023-004 from the prior year. Recommendation:Atrium Health CMHA should implement internal controls to retain all disbursement notification letters sent to students.Views of responsible officials:Atrium Health CMHA management, as part of the 2025 process and procedures consulting engagement, will develop a plan to ensure that the IT systems are changed such that notification letters can be retained or a control exists whereby hard-copies of notification letters are maintained.

Finding 2024-004: Gramm-Leach-Bliley Act (GLBA) – Student Information Security Controls. Identification of the Federal Program:Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans), 84.063 Federal Pell Grant Program, 84.007 Federal Supplemental Education Opportunity Grant ProgramAward Periods: July 1, 2023 through June 30, 2024; July 1, 2024 through June 30, 2025. Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:“The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314).Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. Condition:Atrium Health CMHA did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of certain elements of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program did not address certain required elements per 16 CFR 314.4 to ensure compliance with federal regulations.Cause:Atrium Health CMHA did not retain sufficient documentation of their review procedures over certain elements of the Information Security Program. Atrium Health CMHA did not include certain required elements within its Information Security Program. Effect or Potential Effect:The written Information Security Program is not compliant with federal regulations. Questioned Costs:None. Context:Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule of Expenditures of Federal Awards (Schedule) totaled $2,876,252 for the year ended December 31, 2024.Identification as a Repeat Finding, if Applicable:This finding is a repeat finding of 2023-005 from the prior year. Recommendation:Atrium Health CMHA should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately.Views of Responsible Officials:Atrium Health CMHA management, as part of the 2025 process and procedures consulting engagement, will ensure that all GLBA requirements over the Information Security Program are both documented completely and inclusive in scope of both general CMHA IT systems as well as IT systems specific to the SFA program.