Findings Citing § 200.303

Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Head Start Federal Assistance Listing Number: 93.600 Award Period: June 1, 2024 to June 30, 2025, August 1, 2024 to July 31, 2025, July 1, 2025 to May 31, 2026, August 1, 2025 to July 31, 2026 Type of Finding:  Significant Deficiency in Internal Control over Major Federal Programs and Other Matters Criteria or Specific Requirement: The organization must train all governing body and policy council members within 180 days of the beginning of the term of a new governing body or council. Under 2 CFR section 200.303, a non-federal entity must establish and maintain effective internal controls over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing we noted one new board member did not have support verifying they received the appropriate training. This individual was a past employee who would have received the training while employed but no support was retained to support that the training was done. Questioned Costs: N/A Context: No documentation was retained to support that a new board member had proper training. Cause: Individual was a past employee who would have received the training while employed but not support was retained to support that the training was done. Effect: Potential for a board member to not have the proper knowledge and understanding of how to provide adequate oversight of the Head Start program. Repeat Finding: No Recommendation: Ensure support is retained to show all new board members received training within 180 days. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

Finding 2025-009 – Reporting (Material Weakness and Noncompliance)(Repeat Finding) Identification of the Federal Program: Community Development Block Grants, ALN 14.218, Department of Housing and Urban Development (CDBG) and Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Department of the Treasury (CRF). Criteria: 2 CFR 200.328-330 establish the requirements of nonfederal entities for financial and performance reporting that include timely and accurate reporting. 2 CFR 200.303 requires nonfederal entities to establish, document and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Typical control procedures for reporting include having a supervisor review the submitted report and ensuring the work is performed and documented in a way that confirms the accuracy and completeness of all data and information included. Condition: We selected five reports for the two grant programs to test for compliance and controls over reporting requirements. No documentation of review or approval of the reports was available. For CDBG, 2 quarterly cash reports and the FY24 Consolidated Annual Performance and Evaluation Report (CAPER) were tested, one cash report was late. Cause: The City did not retain documentation of a review and approval of federal reports submitted. Effect: The City did not have appropriate controls in place over documentation of reporting requirements. Questioned Costs: None reported. Recommendation: We recommend the City strengthen its policies and procedures over the grant reporting process to ensure controls are properly implemented and working effectively. Views of Responsible Officials: The City agrees with the finding. See Management’s View and Corrective Action Plan included at the end of the report.

ESTABLISH, DOCUMENT, AND MAINTAIN EFFECTIVE INTERNAL CONTROL OVER THE FEDERAL AWARD THAT PROVIDES REASONABLE ASSURANCE THAT THE RECIPIENT OR SUBRECIPIENT IS MANAGING THE FEDERAL AWARD IN COMPLIANCE WITH FEDERAL STATUTES, REGULATIONS, AND THE TERMS AND CONDITIONS OF THE FEDERAL AWARD. THESE INTERNAL CONTROLS SHOULD ALIGN WITH THE GUIDANCE IN “STANDARDS FOR INTERNAL CONTROL IN THE FEDERAL GOVERNMENT” ISSUED BY THE COMPTROLLER GENERAL OF THE UNITED STATES OR THE “INTERNAL CONTROL-INTEGRATED FRAMEWORK” ISSUED BY THE COMMITTEE OF SPONSORING ORGANIZATIONS OF THE TREADWAY COMMISSION (COSO), 2 CFR 200.303.

Condition: During our testing of controls over payroll, we identified three instances of payroll summary reports lacking an indication of review and approval. Criteria: The Uniform Guidance 2 CFR 200.303 requires auditees to establish and maintain effective internal control over federal awards that provides reasonable assurance that the awards are being managed in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Organization should have a system of internal control in place to provide reasonable assurance that payroll summary reports are accurate and are being reviewed. Cause: The Organization has experienced significant turnover in HR positions and has had the Executive Director and Finance Manager take on these duties, along with their normal duties, until a replacement can be found. Effect: In the absence of review, payroll errors may go undetected, potentially resulting in inaccurate payroll records and payments. The possibility of fraud or noncompliance occurring and not being prevented or detected and corrected is present. Context: During our testing of a sample of six payroll summary reports, we noted an instance of a lack of review and approval. We then expanded the sample to 12 payroll summary reports, identifying one further instance of lack of review and approval, at which point the sample was again expanded to 24. A third instance was identified during the testing over the expanded sample, at which point testing ceased, and we determined that we could not rely on controls. The control deficiency did not result in a material impact on the program and did not reach the threshold for reporting questioned costs. Repeat of Prior Year Finding: No Auditor’s Recommendation: We recommend that payroll summary reports be reviewed and approved prior to completing the payroll process. If the Executive Director is unavailable, another staff member should review and approve the reports so the payroll process can be completed. View of Management: Management agrees with the finding. A response can be found in the Corrective Action Plan.

2025-001 – Internal Control over Compliance and Compliance with Reporting Information on the Major Federal Program: Federal Agency: Department of Interior Program Name: National Park Service Second Century Endowment and Appropriation Assistance Listing Number: 15.U01 Award Number: H.R. 4680/P.L. 114-289 Award Period: October 1, 2024 to September 30, 2025 Criteria – The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with the requirements 2 CFR §1402.300(b), a non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of the Federal Funding and Accountability Act (FFATA), which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR part 25, Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR part 170, Reporting Subaward and Executive Compensation Information. In accordance with 2 CFR Part 170, Appendix A, under FFATA, the Foundation is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System. Condition – During our testing of reporting, we selected five subrecipient awards. For all samples tested, the Foundation did not comply with the mandatory FFATA report filing requirements. Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 5 5 5 Not applicable – no report was submitted Not applicable – no report was submitted Dollar Amount of Tested 2025 Subawards Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $ 319,000 $ 319,000 $ 319,000 Not applicable – no report was submitted Not applicable – no report was submitted Cause - The Foundation did not have adequate policies and procedures in place to ensure compliance with the FFATA filing requirements. Effect or Potential Effect - Failure to comply with the reporting requirements of the Uniform Guidance could result in noncompliance and awarding agency taking administrative action. Questioned Costs – None. Context - This is a condition identified based upon our review of the Foundation’s compliance with specified requirements. The sample was selected based on a non-statistical basis. The prevalence of these finding is detailed in the condition section above. Repeat Finding – This is a repeat finding from prior year. This was reported as finding 2024-001 in the 2024 report. Recommendation – BDO noted management’s actions to continuously work with federal grantor/agencies to address the prior year finding. However, the Foundation’s grant agreement does not have a Federal Award Identification Number (FAIN) which is a requirement to comply with FFATA reporting, therefore management is still unable to file the required FFATA reporting. BDO recommends that the Foundation continue to work with federal grantor/agencies to determine the required information and immediately comply with the FFATA requirements. Views of Responsible Officials – The Foundation’s management has been given a legal opinion from counsel that the Appropriation and the Endowment are exempt from the Uniform Guidance and the Single Audit. As such, will continue to work with Department of Interior to remedy this situation. The planned corrective actions are presented in the Foundation’s management’s corrective action plan attached as Appendix C.

Department of Housing and Urban Development - Direct Project - Community Development Block Grant- ALN 14.218- Program Year 2025 (B-20-UC-11-0018 FY 2021, B-20-UW-12-0018 FY 2020, B-22-UC-12-0018 FY 2022, B23-UC-12-0018 FY 2023, B-24-UC-12-0018 FY 2024, FR-6512-N-01 FY 2024) Criteria — 2 CFR section 200.303 – Internal Controls of the Uniform Guidance states that the non‐federal entity must: (a) Establish and maintain effective internal controls over Federal award that provides reasonable assurance that the non‐Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition — There was no evidence of the controls in place to review and approve reports prior to submission. The lack of internal control is a systemic issue over reporting. Cause/Effect—There is no evidence of the internal control requiring review and approval prior to submission of the cash on hand quarterly report and the FFATA reports prior to submission. If the internal controls are not in place the reports might not be accurately and timely filed, which could cause a delay in payment or loss of funding. Questioned Costs– None noted. Reported finding is for noncompliance in the reporting compliance requirement that does not affect the amount expended or received from the Federal award. Auditor’s Recommendation – Develop an internal control process with evidence of a review of reports prior to submission. CRI also recommends that the County develop a process to track all grant reports required by ALN#/CSFA# and by contract. This system would provide a repository of all the required reporting which the county could use to verify reports are filed timely and accurately. Management Response – See Corrective Action Plan Letter.

Interest Earned on Federal Funds. Criteria: 2 CFR 200.303 provides that non-federal entities must establish and maintain effective internal controls to provide reasonable assurance of compliance with Uniform Guidance. 2 CFR Section 200.305 sets forth the requirements for the return of interest earned on federal funds. Recipients of federal grants are required to establish internal controls to minimize the time that elapses between the receipt of federal funds from the grantor, and the payment of those funds to vendors who provide goods or services. Interest earnings that exceed $500 per year from excess cash balances must be paid to the federal grantor. Condition: CASIS did not calculate interest earnings on the federal cash balance to determine if any earnings should be repaid to the grantor. Cause: CASIS does not have a policy to monitor federal cash balances for cash management requirements, including the calculation of interest earnings. Effect: CASIS did not take steps to reduce the time elapsing from the date it received federal funds to the date it spent the funds on program costs. The lapse resulted in interest earned on federal funds. Questioned Costs: Fontana calculated that CASIS earned approximately $17,000 of interest on the federal funds balance for the fiscal year ended September 30, 2025. Interest earnings on federal funds of more than $500 must be returned to the grantor. Perspective: Interest was not calculated or returned to the grantor for fiscal year ended September 30, 2025. Recommendation: Fontana recommends that CASIS: o Implement controls to minimize the time between receipt of funds from the granting agency and disbursement of those funds. o Compute interest earned on advance funds and remit amounts in excess of $500 to the grantor when required.

Finding 2025-001: Significant Deficiency in Internal Control Over Compliance and Non-Material Non-Compliance Federal Awarding Agency: U.S. Department of Housing and Urban Development (HUD) Department: Department of Housing and Community Development (DHCD) Program name: Housing Voucher Cluster ALN: 14.879 Compliance Requirement: Special Test-Housing Quality Standards (HQS) Inspection and Enforcement Prior Year Finding Number: N/A Criteria or Specific Requirements: Per 24 CFR 982.404 “The public housing Organization (PHA) must not make any housing assistance payments (HAP) for a dwelling unit that fails to meet the HQS, unless the owner corrects the defect within the period specified by the PHA and the PHA verifies the correction. If a defect is life threatening, the owner must correct the defect within no more than 24 hours. For other defects, the owner must correct the defect within no more than 30 calendar days (or any PHA-approved extension)”. Additionally, per 24 CFR 982.405 “The PHA must inspect the unit at least biennially during assisted occupancy to ensure that the unit continues to meet the HQS”. Per 2 CFR section 200.303, non-Federal entities receiving Federal awards must establish and maintain internal control designed to ensure reasonably compliance with Federal statutes, regulations, and terms and conditions of the Federal award. Condition: During our testing of sixty (60) inspections, we noted the following: - One instance where a unit failed its inspection and re-inspection was not performed or scheduled within the required timeframe. The Organization also failed to abate the housing assist payments (HAP) or terminate the HAP contract for this unit in a timely manner. Additionally, for this unit the inspection was not performed on the required biennial basis. Questioned Costs: We identified $984 in known and $54,962 in likely questioned costs as a result of our sampling and testing procedures. Cause: The Organization did not follow the internal controls, policies and procedures in place to ensure inspections and re-inspections of units are performed on a timely basis. Context: This is a condition based on testing of the Organization’s compliance with specified requirements. The prevalence of the finding is detailed in the Condition section above. The samples were selected using a nonstatistical method. Effect: The Organization’s control environment over HQS enforcements did not ensure that re-inspections were performed timely or documented within the system or that HAP abatements occurred in a timely manner. As a result, the Organization was not in compliance with the HQS enforcement requirements as of September 30, 2025. Non-compliance with these requirements creates a risk that the Organization may provide federal funds to tenants of ineligible units. Recommendation: We recommend the Organization review their system functionality to determine whether an electronic process for scheduling and follow-up or comprehensive reporting can be identified to improve efficiency and eliminate the potential for human error. If an electronic process or comprehensive reporting is not available, or cannot fully cover the deficiency, we recommend the Organization look into measures to streamline their current internal controls, policies and procedures to eliminate non-compliance. Potential examples include adding an inspection checklist, having the inspection supervisor review and schedule upcoming inspections in advance, building room into the schedule for life-threatening re-inspections, having the inspection supervisor ensure that each scheduled inspection is timely documented in the system, etc. Repeat Finding: No Views of responsible officials: Organization management agrees with the finding and recommendations set forth within. Refer to management’s corrective action plan for additional information.

2025-004 Suspension and Debarment 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds US Department of Treasury Passed through Florida Department of Environmental Protection 2024 Funding Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Documentation of the check for suspension or debarment needs to be retained. Condition: Review of checking for suspension and debarment was not done prior to contracting with the vendor. Cause of condition: The City did not consistently complete reviews for all vendors to ensure that the vendors were not suspended and debarred before projects had. Perspective (context): For 5 of the 8 vendors selected, suspension and debarment was not checked prior to paying the vendor. The sample was not statistically valid. Potential effect of condition: Good or services could be contracted with a suspended or debarred vendor, creating questioned costs. Questioned Costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should require all vendors to provide certification of their status before a contract or purchase order is completed with the vendor and the City should obtain new certificates annually to ensure the vendors status has not changed. Management’s response on planned corrective action: Management agrees with the recommendation. The City has implemented procedures requiring all departments to obtain vendor certification of status prior to executing a contract or issuing a purchase order. Over the past year, we have worked diligently to educate departments on the importance of obtaining and maintaining proper vendor certifications to ensure compliance with applicable requirements. We will continue to reinforce this expectation and monitor compliance, including obtaining updated certifications annually to ensure vendor status has not changed.

2025-005 Lack of Report Review 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds US Department of Treasury 2021 Funding Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Reports should be subject to independent review to verify completeness, validity and timeliness of submission. Condition: There was no documented review by the City Manager of the annual report submitted to the Us Treasury department prior to submittal. Cause of condition: The annual report to the US Treasury was not reviewed prior to submittal. Perspective (context): The one annual report was not reviewed. Potential effect of condition: Review could contain errors, could be submitted incomplete or late. Questioned Costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should have controls in place to ensure all reports are reviewed prior to submittal. Management’s response on planned corrective action: Management agrees that reports should be reviewed prior to submission and notes that the City does have controls in place to ensure appropriate review procedures are performed. In this instance, the report was prepared and submitted by the City Manager, and due to limitations within the Federal Government’s online reporting system, there was not a built-in approval workflow available to document the review process.

Finding: 2025-001. Insufficient Controls Over Monitoring Federal Expenditures and SEFA Preparation Federal Agency: Federal Highway Administration Pass-through Agency: Texas Department of Transportation Assistance Listing Number: 20.205 Federal Program Name: Highway Planning and Construction Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR §200.303 requires entities to establish and maintain effective internal control over Federal awards that provides reasonable assurance the entity is managing the awards in compliance with Federal statutes, regulations, and the terms and conditions of the awards. 2 CFR §200.501 requires a Single Audit when a non-Federal entity expends $1,000,000 or more in Federal awards during the current fiscal year (or $750,000 during the prior year). 2 CFR §200.510(b) requires the preparation of a complete and accurate Schedule of Expenditures of Federal Awards (SEFA). Applicable GAAP requires recognition of grant revenue and related receivables when allowable expenditures are incurred. Condition: The City incurred reimbursable federal expenditures in the prior year but did not submit reimbursement requests or record the related receivable and revenue. As a result, certain federal expenditures were omitted from the SEFA, and total federal expenditures were understated below the $750,000 threshold for a Single Audit in the prior year. Cause: Grant administration is decentralized across multiple departments, and formal controls were not in place to reconcile grant expenditures to reimbursement requests or to monitor total federal expenditures and review the SEFA for completeness. Effect: Grant revenue and related receivables were understated, and the prior year SEFA was incomplete. As a result, the City did not include this grant award in the Single Audit in the prior year as required by Uniform Guidance. Questioned costs: N/A Context: N/A Repeat finding reference: N/A Recommendation: The City should strengthen oversight of federal grant activity by implementing procedures to monitor federal expenditures and ensure the SEFA is complete and accurate. This may include centralizing grant oversight within the finance function or designating a responsible grant administrator. Procedures should include periodic reconciliations of grant expenditures to reimbursement requests and a formal year-end review of total federal expenditures and the SEFA, with coordination between the finance function and departments administering federal programs. Personnel involved in grant administration should receive training on Uniform Guidance requirements. View of Responsible Officials Management’s response and corrective action plan are included in the accompanying corrective action plan.

Reviews of Grant Reports U.S. Department of Treasury ALN 21.027 - COVID 19 Coronavirus State and Local Fiscal Recovery Funds Contract No. Y5177 2021 Funding Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Reports should be subject to independent review to verify completeness, validity and timeliness of submission. Condition: There was no documented review by an independent individual for the reports submitted to the US Treasury department prior to submittal. Cause: The City did not have a process in place to document the review of reports to the US Treasury was prior to submittal. Effect: Reports submitted to the Florida Department of State may be incomplete, include errors, or be submitted late. Perspective: There was no evidence of review provided for the reports submitted during Fiscal Year 2025. Questioned Costs: None, reported finding is a deficiency in internal control. Recommendation: The City should have controls in place to ensure all reports are reviewed prior to submittal and the review is documented. Management Response: Management agrees with the finding. Management will implement procedures to document independent review of all reports submitted to the U.S. Treasury to ensure completeness, accuracy, and timeliness.

2025-002 DISALLOWED COSTS ALN 97.083 Staffing for Adequate Fire and Emergency Response (SAFER) Grant Program U.S. Department of Homeland Security Federal Emergency Management Agency (FEMA) Federal Award No. EMW-2022-FF-00868 2024/2025 Funding Criteria: 2 CFR 200.303(a) requires non-federal entities to establish and maintain effective internal controls over federal awards. The award terms allow for reimbursement of personnel costs including wages, the employer portion of payroll taxes, and fringe benefits (health insurance, life insurance, and retirement benefits. Compensation for a firefighter’s normal, contracted work schedule is reimbursable, but overtime costs are not eligible for reimbursement by the SAFER grant award (including overtime for holdovers, extra shifts, to attend training, etc.). Only costs for overtime that the fire department routinely pays as a part of the base salary or a firefighter’s regularly scheduled and contracted shift hours, in order to comply with the Fair Labor Standards Act (FLSA), are eligible. Semi-annual financial reporting is required of all grant award recipients (per the award agreement terms). Condition: There was no independent review of reimbursement requests or semi-annual financial reports prior to submission to the grantor. Reimbursement requests included disallowed costs related to overtime (associated fringe benefits expense) but not the overtime itself. Additionally, semi-annual financial reports were based on reimbursement requests which resulted in reporting errors. Cause: There was no independent review of reimbursement requests or semi-annual financial reports prior to submission to the grantor. Effect: Lack of review increases the likelihood that reports are incomplete, inaccurate, or not submitted timely. Reimbursement requests and financial reports included errors and the City was inadvertently reimbursed for disallowable costs Questioned Costs: Known questioned costs are $10,551. Questioned costs computed through recalculation of fiscal year 2025 reimbursement requests. Perspective: Disallowed costs impacted all fiscal year 2025 reimbursement requests and semi-annual financial reports. Recommendation: Independent review of program reimbursement requests and reports should be consistently performed and documented prior to submission the grantor. Management Response: The City agrees with this finding and will establish internal procedures for review of program reimbursement requests before submission to the grantor. The Grant Compliance Manager will prepare the reimbursement requests and semi-annual reports and provide to the Director of Finance for review and approval prior to submission. This corrective action will take effect immediately.

2025-001 REPORTING ALN 20.106 Airport Improvement Program U.S. Department of Transportation Federal Aviation Administration Federal Award No. 3-12-0046-064-2024 2024/2025 Funding Criteria: 2 CFR 200.303(a) requires non-federal entities to establish and maintain effective internal controls over federal awards. The award terms require submission of quarterly construction and inspection reports within 30 days of the end of each Federal fiscal quarter. Condition: A quarterly report was not submitted for the period January 2025 – March 2025. Cause: The staff member who typically prepared the report was out on medical leave during this period. Effect: The Airport, a component unit of the City, was out of compliance with award requirements which could jeopardize its ability to be reimbursed for this award or obtain additional awards in the future. Questioned Costs: None. Reported finding is for noncompliance in the reporting compliance requirement that does not affect the amount expended or received for the federal award. Perspective: All other quarterly reports sampled were appropriately submitted timely. When we brought this issue to the attention of management they submitted the quarterly report late. Recommendation: The Airport, a component unit of the City, should develop a process to ensure reports are submitted timely for all awards including re-assigning tasks when personnel are on leave. Management Response: Airport management has set up a process whereby the quarterly reports are reviewed by another team member to ensure the reports are completed and submitted in the time frame required by the Federal Aviation Administration. This review will be completed by the Accounting Manager who understands the importance of submitting the information and, if they are not completed, will complete and submit the reports. Any issues or omissions observed by the Accounting Manager with submitting the required reports will be reported to the Director of Finance and Administration for further follow-up with the staff member who is primarily responsible for this task.

Year Finding Originated: 2025 Title and Assistance Listing Number of Federal Program: Staffing for Adequate Fire and Emergency Response 97.083 Federal Award Identification Number and Year: EMW-2022-FF-00974 Name of Federal Agency: Department of Homeland Security Questioned Costs: $13,801 Criteria: Per 2 CFR § 200.305, non-Federal entities must minimize the time between the transfer of federal funds and the disbursement of those funds for program purposes. Federal regulations and the SAFER grant terms require that reimbursement requests be based on allowable expenditures that have been incurred by the District. Additionally, 2 CFR § 200.303 requires non-Federal entities to establish and maintain effective internal controls over Federal awards to ensure compliance with Federal statutes, regulations, and terms and conditions of the Federal awards. Condition: During testing of SAFER reimbursement requests, one reimbursement request contained an error in the benefits calculation formula, resulting in the employer insurance costs being included twice in the request. The District received funds in excess of allowable costs incurred during the reimbursement period due to the calculation error. The District’s control designed to prevent such errors, management review and approval of SAFER reimbursement requests prior to submission, did not operate effectively. Although reimbursement requests are prepared and submitted by District personnel, documentation supporting management’s review and approval of the reimbursement calculations was not maintained, and the error in the reimbursement calculation was not detected prior to submission. Cause: The reimbursement request was prepared using a manual spreadsheet containing a formula error that duplicated certain benefit costs. The District’s reviewed procedures were not formally documented or designed to ensure the accuracy of reimbursement calculations prior to submission. Effect: The District requested and received federal funds in excess of allowable expenditures incurred during the reimbursement period. Additionally, the lack of effective review controls increases the risk that reimbursement requests may contain errors or unsupported amounts. Recommendation: We recommend that the District strengthen controls over reimbursement calculations and implement review procedures to ensure reimbursement requests are based solely on allowable costs incurred prior to submission. Views of responsible officials: See management’s response to finding on Page 59.

Year Finding Originated: 2025 Title and Assistance Listing Number of Federal Program: Staffing for Adequate Fire and Emergency Response 97.083 Federal Award Identification Number and Year: EMW-2022-FF-00974 Name of Federal Agency: Department of Homeland Security Questioned Costs: $0 Criteria: Per 2 CFR § 200.303(a), the non-Federal entity must establish, document, and maintain effective internal control over Federal awards to ensure compliance with federal statutes, regulations, and terms and conditions of the federal awards. Condition: During testing of reporting requirements for the SAFER grant, the District could not provide documentation evidencing management review and approval of required federal reports prior to submission. Discussions with management indicated that reports were prepared and submitted by District personnel; however, formal documentation evidencing management review and approval was not maintained. Cause: The District relied on informal communication and oversight rather than detailed review procedures to ensure required federal reports are accurately prepared prior to submission. Effect: While no instances of noncompliance were noted, the lack of documented controls in practice increases the risk that future required reports could be incomplete, inaccurate, or untimely. Recommendation: We recommend that the District enhance and document internal controls over financial reporting, including a detailed review and approval process for required federal reports prior to submission, including maintaining documentation evidencing such review. Views of responsible officials: See management’s response to finding on Page 59.

2025-004 Reporting ALN 21.027 Coronavirus State and Local Fiscal Funds US Department of the Treasury Fiscal Year 2025 Funding Grant Y5314 Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Reports should be subject to independent review to verify completeness, validity, and timeliness of submission. Condition: The City’s controls over reports issued to U.S. Treasury failed to operate correctly as the underlying data contained errors which were noted on the report issued to the US Treasury. Cause of the condition: The City did not have a proper review of the underlying data for the reports sent to the US Treasury as the underlying data caused the reports to be incorrect. Potential effect of condition: Reports submitted could contain errors or could be incomplete. Questioned costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should review the underlying data along with the report to ensure the report agrees with the support and the underlying data is correct. Management Response: Management recognizes the importance of accurate and complete reporting to the U.S. Treasury. While procedures were in place, the review of underlying data was not sufficient to ensure accuracy and completeness prior to submission. The issue was limited to a single report and was corrected in the subsequent U.S. Treasury reporting cycle in accordance with program requirements. To prevent recurrence, management has enhanced its review procedures over grant reporting to include reconciliation of underlying data and validation checks for inconsistencies prior to report submission. Additionally, a secondary level of review will be performed to ensure reports are complete and accurate before submission to the U.S. Treasury.

2025-003 Suspension and Debarment ALN 21.027 Coronavirus State and Local Fiscal Funds US Department of the Treasury Fiscal Year 2025 Funding Criteria: CFR 180.300 requires the City to ensure vendors and contractors are not disqualified, excluded, or debarred prior to entering into a covered transaction. Per 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. The City should have a process to ensure compliance with 2 CFR 180.300. Condition: The City did not have documented controls over the review of verifying vendors are not debarred or suspended. Cause of the condition: The City completes SAM checks of all vendors however, the City does not have a review process to verify the vendor is not suspended or debarred before a contract or payment with the vendor. Potential effect of condition: The City may have covered transactions with federally debarred vendors. Questioned Costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should put controls in place to verify SAM checks before authorizing a contract or a purchase order with a vendor for a covered transaction. Management Response: Management recognizes the importance of compliance with federal suspension and debarment requirements. Management has implemented procedures to ensure compliance with suspension and debarment requirements for federally funded transactions. As part of the procurement process, vendors responding to solicitations for grant-funded projects will be required to provide evidence of active SAM registration and certify that they are not suspended or debarred. In addition, prior to execution of contracts or issuance of purchase orders for covered transactions, management will perform and document an independent SAM.gov verification as part of standard pre-award procedures to confirm vendor eligibility.

Assistance Listing, Federal Agency, and Program Name ALN 93.982, U.S. Department of Health and Human Services, Mental Health Disaster Assistance and Emergency Mental Health Regular Services Program Wayne County Strong Federal Award Identification Number and Year 20255313 00, 2025 Pass through Entity Michigan Department of Health and Human Services Finding Type Significant deficiency Repeat Finding No Criteria Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition DWIHN’s internal controls were not sufficiently designed and/or operating effectively to prevent the submission of unallowable costs for reimbursement under the federal award. Questioned Costs None If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported Not applicable Identification of How Questioned Costs Were Computed Not applicable Context DWIHN submitted unallowable costs for reimbursement to the funding agency, including unallowable indirect costs and a duplicate invoice from one vendor. While DWIHN had a detective control in place to review expenditures included in reimbursement requests, the control was performed after the expenditures had been paid and included in reimbursement submissions. Due to the timing of this review, the detective control did not prevent DWIHN from paying the unallowable costs and subsequently requesting reimbursement for those costs. Upon identification of the unallowable expenditures, DWIHN took prompt corrective action, including recoupment of the funds from the applicable sources and repayment to the funding agency for the disallowed amounts. Ultimately, the grant was properly accounted for at the end of the grant period. Cause and Effect Although DWIHN had preventive and detective controls in place related to reimbursement requests, those controls did not operate effectively as designed for this grant program. As a result, unallowable costs were reimbursed to DWIHN by the granting agency prior to being identified and remediated. Recommendation We recommend that DWIHN strengthen and timely execute its review procedures over reimbursement requests and supporting documentation to ensure that all expenditures submitted for reimbursement comply with the terms and conditions of the grant award. This may include enhancing preventive controls or adjusting the timing of existing reviews to ensure unallowable or duplicate costs are identified and excluded prior to submission to the funding agency. Views of Responsible Officials and Corrective Action Plan DWIHN concurs with the finding. However, it should be noted that it is customary and standard practice to charge the indirect de minimis rate to federal grants in accordance with 2 CFR 200.414(f) Indirect Costs and the Department of Health & Human Services Grants Policy Statement section 2.3.4.6. Indirect Cost Rates. In addition, one (1) out of the seven (7) contracted vendors submitted FSR’s with indirect costs to the project; six (6) providers submitted the FSR’s without indirect cost thus adhering to the instructions. Further, the unallowed costs and duplicate payment were identified, corrected, and remediated by the finance staff prior to submission of the final reports, closeout of the grant and audit fieldwork. Finally, program and finance staff responsible for the approving and processing of FSR’s have been informed of the need to review FSR’s in greater detail before they are submitted, approved, and payment occurs. A more detailed review of the FSR’s as adherence to established policies and procedures, will eliminate the risk of errors and omissions.

Finding 2025-003 – Internal Controls over Federal Awards (Significant Deficiency) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance and Assistance Listing #93.959 Block Grants for Prevention and Treatment of Substance Abuse. Criteria: 2 CFR section 200.303 establishes the requirements for non‑federal entities to establish and maintain effective internal control over federal awards to provide reasonable assurance that transactions are properly authorized. Condition: The Council’s Grant Management Policies & Procedures Manual requires credit card purchase requests be submitted on the Council's approval form at least two weeks prior to the date needed and must have the signed approval of the Executive Director. In three of the 35 transactions tested, the credit card purchase approval form was dated after the date of purchase. Cause: Purchase requests were not consistently submitted and approved in advance of the purchase date, indicating a breakdown in adherence to established procurement timelines. . Effect: Although the transactions were ultimately approved and the costs were otherwise allowable, allocated, and properly charged to the program, failure to obtain timely approval increases the risk that purchases may be made without appropriate prior authorization. Questioned Costs: None Recommendation: We recommend management reinforce procurement procedures to ensure purchase requests are submitted and approved in accordance with the established policy requiring approval at least two weeks prior to the date needed, thereby strengthening internal controls over procurement and disbursements. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.

SD 2025-001 REPORTING Department of Commerce ALN 11.463 – Habitat Conservation Federal Award ID Number: FX463C0051 2025 Funding Criteria: Per 2 CFR 200.303, non-Federal entities must establish and maintain effective internal controls over Federal awards that provide reasonable assurance the entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. In addition, pursuant to 2 CFR Part 170, recipients of Federal awards are required to report first-tier subawards and executive compensation data in accordance with the Federal Funding Accountability and Transparency Act (FFATA). Specifically, subaward information must be reported in the Federal Subaward Reporting System (FSRS) by the end of the month following the month in which the subaward was obligated, as required by the terms and conditions of the Federal award. Condition: The FFATA report was not filed during the year as subawards were granted. Cause: The Council was unaware of the requirement to file the FFATA. Effect: Potential for unintended errors to occur without being immediately identified and corrected. The Council was not in compliance with the Uniform Guidance and the Habitat Conservation Program. Questioned Costs: None. The finding is for reporting which does not relate to questioned costs. Perspective: None of the FFATA reports were filed during 2025 for all 10 subrecipients. Recommendation: The Federal Funding Accountability and Transparency Act (FFATA) reporting requirement is a general term and condition from the Department of Commerce and should be completed as required and reviewed by someone other than the preparer before submission. Management Response: The FFATA reporting requirement was not a specific award condition on the grant award to the IRL Council from NOAA Fisheries. However, it is a standard general term and condition from the Department of Commerce which is referenced on the grant award. The subawards for the NOAA grant have now been input into SAM.gov. The IRL Council will review the specific FFATA requirements required by the Department of Commerce (different than the EPA requirements) and will make sure that the IRL Council continues to be in compliance.

Federal Agency: Environmental Protection Agency Federal Program Name: Water Pollution Control Assistance Listing Numbers: 66.419 Federal Award Identification Number: 98339418 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: 10/1/2023 - 12/30/2025 Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matter Criteria or specific requirement: Compliance: Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR §200.318 through §200.327. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. Small purchase procedures are used for purchases that exceed the micro-purchase amount but do not exceed the simplified acquisition threshold ($250,000). If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources (2 CFR §200.320(b)). Control: Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: For two of five procurements selected for testing, the Commission was unable to provide documentation (completed requisition form) to demonstrate compliance with their procurement policy. Questioned costs: Undetermined. Cause: Controls were not operating effectively to ensure that the Commission’s procurement policies were followed for procurements entered into where expenses were charged to the federal program. Effect: The Commission was unable to provide documentation to support compliance with Federal requirements. Repeat Finding: No. Recommendation: We recommend that the Commission ensure that it follows its procurement policies for all goods and services charged to the program and that documentation be readily available for audit. Views of responsible officials: To prevent future noncompliance the Commission will 1)clarify vendor coverage on existing agreements, 2) strengthen controls over procurement threshold, 3) monitor cumulative spending by vendor, and 4) reinforce training and communication.

Payroll Federal Agency: Department of Housing and Urban Development Federal Program Name: Community Development Block Grants Cluster Entitlements/Special Purpose Assistance Listing Number: 14.218 Federal Award Identification Number and Year: B-23-UN-12-0002 and B-25-UU-12-0003 Award Period: November 11, 2023 – November 20, 2029 and January 16, 2025 – June 6, 2031 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria: 2 CFR 200.302(b)(3) states that the recipient must maintain records that sufficiently identify the amount, source, and expenditure of funds for federally-funded activities. These records must contain information pertaining to federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. 2CFR 200.403 states that costs must be adequately documented. 2 CFR section 200.303(a) states a non-Federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should comply with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: There were two conditions present: • One employee had duplicate hours for three pay periods. • Two employees had incorrect pay rates used for the calculation of allowable payroll costs for seven pay periods. Questioned costs: • $3,974 - B-23-UN-12-0002 • $81 - B-25-UU-12-0003 Context: Forty employee pay periods were selected for testing. • One employee had a total of twenty-four hours duplicated over four pay periods. • Two employees had incorrect pay rates across seven pay periods. Cause: Allowable payroll costs are performed using a manual process. While the calculation was reviewed and approved, a cross check between the KRONOS report and the allowable cost calculation was not performed. Allowable payroll costs are calculated using pay rates at end of the quarter. When there are no changes during the quarter, this methodology results in an accurate calculation. However, if a pay rate changes during the quarter, this methodology results in a misstatement for the calculation of allowable payroll costs. Effect: Using incorrect hours or pay rates to calculate wages recorded quarterly can result in overcharging grant and submitting inaccurate expenditures to the grant which may lead to non-compliance with grant requirements. Repeat Finding: No Recommendation: It is recommended the County modify its procedure to include: • Improve reconciliation procedures to verify hours per pay period recorded in quarterly spreadsheet agrees to hours recorded in the KRONOS system. • Record grant wages using the pay rate at the beginning of the quarter if recorded on a quarterly basis or use pay rates for each pay period if recorded on a pay period basis. Views of responsible official and planned corrective actions: Management concurs with the auditor’s recommendations. Action taken in response to finding: • Document the audit process in a formalized SOP and cross train all reviewers from SRGA Admin, Budget, and Fiscal. • Create a checklist to accompany each personnel draw to ensure that after rates are verified that SRGA Admin certifies that no RPAs or pay adjustments were approved during the pay periods reported and if there were, a second pay rate is entered for that draw and hours are split according to accurate rates/dates. • Document the cure process in the SOP to ensure that any errors found after the fact will be corrected with HUD to remain compliant and to ensure that no funds drawn in error are retained. • Include a date verification process prior to submission of the draw to ensure that staff did not duplicate any dates. This verification will be an audit of the Time Tracking Review completed by Admin staff. Ongoing training and coaching will be administered should duplicate entries be found on final draw reports. • Audit of all personnel draws for both allocations of CDBG-DR grants will be completed using the new SOP and verification tools before the end of fiscal year 2026.

Assistance Listing, Federal Agency, and Program Name 93.870, Maternal, Infant, and Early Childhood Home Visiting Grant Federal Award Identification Number and Year S-MIEC-F-2025-9-1 Pass through Entity Children's Trust of South Carolina Finding Type Significant deficiency Repeat Finding No Criteria Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control-Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Organization was reimbursed $22,968 under the grant award but amounts were outside of performance year of the grant. The control in place to review expenditures was not effective in identifying expenditures that were outside the grant period. Questioned Costs $22,968 If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported N/A Identification of How Questioned Costs Were Computed The question costs were determined by totaling all of the expenses that were identified to be outside the period of performance of the grant. Context Two contracts were entered into during the year with both having costs that were to be incurred in future period not covered by grant, but both were fully charged to grant for current fiscal year. Through testing of procurement noted that contract term started part way though grant year and for period after end of the grant's period of preformance. As through procurement there were only two contracts entered into the total cost is $22,968 of expenditures related to future period. Cause and Effect The Organization's control over contractor payments was not designed effectively to ensure costs incurred prior to requesting for reimbursement. The failure to have an effective control in place caused the Organization to charge a cost to the program that the Organization had not yet incurred. Recommendation We recommend that the review of process ensure that items have been expended prior to charging amount to the grant. Views of Responsible Officials and Planned Corrective Actions The Organization acknowledges that the expenditure was reimbursed outside of the grant’s period of performance under review due to the nature of the expenditure and accounting treatment selected. The Organization will implement enhanced review procedures of federal expenditures sought for reimbursement to better align with the underlying accounting treatment.

Finding 2025-001: Review of Compliance Matrices and Narratives - Special Tests and Provisions Federal Program Name: National Railroad Passenger Corporation Grants Assistance Listing No. 20.315 Federal Award Nos.: 69A36525520030AMTDC 69A36525520040AMTDC 69A36524520000AMTDC 69A36523504100AMTDC 69A36523504110AMTDC FR-AMT-0025-22 FR-AMT-0026-22 FR-AMT-0028-22 FR-AMT-0027-22 Federal Agency: Department of Transportation, Federal Railroad Administration Criteria 1. The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each state must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms of the conditions of the federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. For the compliance matrix that is maintained for the annual grants under Assistance Listing No. 20.315, Ernst & Young (EY) identified that for two provisions, the wording contained within the matrix did not match in its entirety to the respective grant agreement. Additionally, EY noted that two provisions that were present in the grant agreements were not included in the matrix. 2. For the compliance matrix that is maintained for Infrastructure Investment and Jobs Act (IIJA) grants under Assistance Listing No. 20.315, EY identified that two provisions present in the grant agreements were not included in the matrix. 3. For the compliance matrices maintained for both the annual grants and IIJA grants under Assistance Listing No. 20.315, EY identified a lack of evidence to support management's assessment of certain provisions as not applicable. Cause In reviewing management’s internal controls, the key internal control identified by management is not designed such that consistent, proactive monitoring and/or review occurs to ensure all compliance requirements and any changes to the wording of specific provisions are updated and reviewed within the compliance matrices and narratives. Effect or Potential Effect Amtrak is not in compliance with the 2 CFR 200.302 (a) and 2 CFR 200.303. This may also put Amtrak at greater risk of non-compliance with specific provisions in accordance with the federal awards. Questioned Costs None identified. Context EY reviewed the federal awards in scope and compared them to the compliance matrices and compliance narrative maintained by the company as part of the audit procedures in connection with the testing of the special tests and provisions compliance requirement. Per review of the grant agreements, a total of 159 provisions exist of which EY identified six provisions as missing or inaccurate as described in the condition section above. As such, this finding relates to 3.77% of the total population of provisions. Identification as a Repeat Finding This is a repeat finding of 2024-002. Recommendation EY recommends that Amtrak update the control design with enough precision to ensure that reviews and updates to the compliance matrices are made on a regular cadence to ensure that any updates, amendments or changes are monitored and updated timely. Views of Responsible Officials Amtrak recognizes the need to improve our controls over the updates of the compliance matrices and will review its control processes by the end of FY2026.

Finding 2025-002: Equipment and Real Property Management Federal Program Name: National Railroad Passenger Corporation Grants Assistance Listing No. 20.315 Federal Award Nos.: 69A36524520000AMTDC 69A36524520010AMTDC FR-AMT-0025-22 FR-AMT-0026-22 69A36523504100AMTDC 69A36523504110AMTDC FR-AMT-0019-20 FR-AMT-0020-20 FR-AMT-0003-14-01-02 FR-AMT-0022-21 FR-AMT-0023-21 DTFRDV-07-G-00002 DTFRDV-09-G-00002 FY2000 Appropriation FY1975 Appropriation Federal Agency: Department of Transportation, Federal Railroad Administration Criteria The code of federal regulations – 2 CFR 200.313 Equipment (d) Management Requirements requires that: (2) A physical inventory of the property must be conducted, and the results must be reconciled with the property records at least once every two years. (3) A control system must be in place to ensure safeguards for preventing property loss, damage, or theft. Any loss, damage, or theft of equipment must be investigated. The recipient or subrecipient must notify the Federal agency or pass-through entity of any loss, damage, or theft of equipment that will have an impact on the program. The code of federal regulations 2 CFR 200.303 Internal Controls states the recipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by COSO. (d) Take prompt action when instances of noncompliance are identified. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. For three of the equipment samples reviewed (approximately $1.1 million net book value), it was observed that the assets within Penn Coach Yard, in Philadelphia PA, lacked adequate safeguards to prevent property loss, damage or theft, as evidenced by the occurrence of two instances of property damage in the current year. EY notes Amtrak performed satisfactory investigations into both instances. 2. During EY's procedures performed for two assets (approximately $7.2 million net book value), EY identified that no inventory had occurred for the assets, even though they had been placed in service over two years prior and would have required an inventory prior to EY's observation. As this came to EY's attention after the inventory was required and during observation procedures, EY investigated further and could not obtain alternative evidence to support that an inventory had occurred within the two-year period. Cause The lack of adequate safeguards at Penn Coach Yard is attributable to a variety of insufficiencies related to security at Penn Coach Yard. The nature of much of Amtrak’s equipment is composed of moving assets on the tracks, operating up and down the corridors, operating around the yards, or moving from location to location in a geographical region to achieve daily operational objectives thus making tracking timely inventories more challenging. Furthermore, Amtrak resources are deployed such that managers and supervisors oversee geographical regions and equipment that are stationed throughout various routes, often connecting through multiple states with many unmanned and less traveled stations. In reviewing management’s internal controls, the key internal controls identified by management are not designed to ensure consistent, timely, and proactive monitoring to verify that inventory observations occur no less than once every two years. While there is an identified internal control stating that “On a monthly basis, these reports will identify all equipment that has not been observed within 2 years and communicate to the Enterprise Asset Management and Disposition Team (EAMDT) and other appropriate parties for action to be taken. EAMDT is responsible for ensuring the observations of equipment are completed. Once the equipment is observed, information is updated in the departmental source system and subsequently updated within the EAMDT reports,” the internal control does not establish a clear action plan or expected timeframe for responsible parties to respond to or remediate identified items. Further, the internal control is designed to identify assets that are already out of compliance, rather than to proactively monitor assets approaching the two‑year threshold. As a result, the internal control design is detective in nature and may not identify the risk of noncompliance until after noncompliance has occurred. Effect or Potential Effect Noncompliance with 2 CFR 200.313 (d) (2) and (3), and potential refund of grant funds used to purchase noncompliant assets. Questioned Costs The questioned costs below represent the total underlying net book value associated with EY's five equipment selections with exceptions. Assistance Listing No. 20.315 69A36524520000AMTDC/69A36524520010AMTDC $ 4,868,340 FR-AMT-0025-22/FR-AMT-0026-22 2,624,469 69A36523504100AMTDC/69A36523504110AMTDC 590,078 FY2000 Appropriation 110,077 FR-AMT-0019-20/FR-AMT-0020-20 98,376 FR-AMT-0003-14-01-02 88,840 DTFRDV-07-G-00002 30,532 FY1975 Appropriation 9,097 FR-AMT-0022-21/FR-AMT-0023-21 5,831 DTFRDV-09-G-00002 (94,917) Total Questioned Costs $ 8,330,723 Context EY performed equipment observations as a part of the testing of the equipment compliance area, randomly selecting 60 equipment units, and performing live observations with Amtrak personnel at the site with the equipment. EY performed inquiries relating to Amtrak’s safeguarding and maintenance procedures along with an inspection of the property records. Identification as a Repeat Finding Condition 2 represents a repeat finding of 2023-001. Condition 1 is not a repeat finding. Recommendation EY recommends Amtrak set up a system with certain criteria for identifying sites at a higher risk for noncompliance with safeguard requirements, and creates an action plan for evaluating, and remediating potential noncompliance. EY recommends that management consider redesigning one of its key controls to help ensure that the monitoring of the observations is occurring on a preventive basis to help identify any exposure to non-compliance before it occurs and clearly identifies any follow-up steps and actions. For example, there should be established a protocol as well as timeline for when required observations are to take place, additionally, as it is known in advance, which items are coming up for inventory, Amtrak could prepare an annual schedule of inventories, that could be revised quarterly. Views of Responsible Officials Amtrak acknowledges the recommendation that Amtrak should have a system with certain criteria for identifying sites at a higher risk for noncompliance with safeguard requirements and create an action plan for evaluating and remediating potential noncompliance. As part of this effort, the EAMDT will work with Corporate Security to review and, as appropriate, align existing governance processes to reduce the likelihood of similar noncompliance. Amtrak agrees with the recommendation to redesign key controls to help ensure that the monitoring of the observations happens on a preventive basis to help identify any exposure to non-compliance before it occurs. Amtrak published an updated Equipment Control Policy and created an eLearning course, as well as implemented several processes, technologies, and reports that help to proactively monitor and identify equipment that is 90 days or less from needing an inventory. This has improved the compliance rate from less than 70% in FY22 to over 97% in FY25. Amtrak understands that this is a repeat finding and will review with the Amtrak departmental owner of equipment that was out of compliance to strengthen the practice and reduce the likelihood of noncompliance.

Assistance Listing, Federal Agency, and Program Name - 93.045/93.053, Department of Health and Human Services, Aging Cluster Federal Award Identification Number and Year - N/A Pass through Entity - Area Aging on Aging 1C Finding Type - Material weakness Repeat Finding - Yes 2024-15 Criteria - Per 2 CFR 200.303, nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Per 2 CFR 200.318(b), recipients must maintain oversight to ensure contractors perform in accordance with the terms, conditions, and specifications of their contracts. Per the “Minimum Nutrition Program Standards” issued Commission on Services to the Aging, individuals receiving certain nutrition benefits to undergo a periodic reassessment of eligibility that includes obtaining confirmation of medical necessity for certain benefit levels. Condition - The County engaged a third party contractor to perform certain eligibility reassessments, including obtaining verification of medical necessity, when required. While the County had a process in place to properly identify when reassessment was required and to follow up with the contractor about the status of reassessments, controls did not ensure the third party contractor followed through on reassessments on a timely basis. Questioned Costs - None If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - N/A Identification of How Questioned Costs Were Computed - N/A Context - The County is responsible for ensuring participants who receive meals are eligible under the terms of the grant. The County did not have a control over home delivered meal participants that ensured the third party contractor timely reassessed participants every six months. 3 of the 43 samples selected did not have updated assessment forms within six months of receiving meals and 17 of the 43 samples did not have updated assessment forms. Cause and Effect - The County's controls were not adequate to ensure that the third party contractor was reassessing participants every six months. The lack of controls could result in the County providing meals to ineligible participants. Recommendation - We recommend the County update its policy on the reassessment process, including actions to be taken when participants refuse to complete the reassessment or cannot be contacted. This plan should also include a schedule for actions to be taken when participants do not complete reassessment submissions timely. The County should also implement the appropriate controls to monitor the third-party contractor and ensure reassessments are being performed timely. Views of Responsible Officials and Corrective Action Plan - The Department of Senior Services would like to clarify that the third-party contractor is contracted through The Senior Alliance, the Area Agency on Aging for region 1 C and not Wayne County. Wayne County Senior Services will continue to monitor the third-party vendor for timely assessments and reassessments through the existing controls which include: • Providing the third-party contractor monthly lists of clients in need of assessment/reassessment • Generating monthly lists of outstanding reassessments (clients not reassessed from the monthly list) • Reminding clients of the requirement for six-month reassessments • Obtaining updated information (phone numbers, emergency contacts, etc.) twice per year • Providing updated information to third-party contractor • Documentation of communicated information regarding third-party contractor’s performance to The Senior Alliance

Assistance Listing, Federal Agency, and Program Name - 93.045/93.053, Department of Health and Human Services, Aging Cluster Federal Award Identification Number and Year - N/A Pass through Entity - Area Aging on Aging 1C Finding Type - Material weakness Repeat Finding - No Criteria - Uniform Guidance at 2 CFR 200.510(b) requires the auditee to prepare a Schedule of Expenditures of Federal Awards (SEFA) that accurately reports total federal expenditures for each federal program. In addition, effective internal control over compliance, as required by 2 CFR 200.303, requires controls that ensure expenditures reported on the SEFA are complete, accurate, and properly reconciled to underlying accounting records and amounts billed to the funding agency. Condition - The County did not maintain effective internal control over the reconciliation of expenditures reported on the Schedule of Expenditures of Federal Awards to amounts billed to the funding agency. If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - None Identification of How Questioned Costs Were Computed - N/A Context - The SEFA is a key component of the Single Audit and serves as the primary basis for determining major programs subject to audit under the Uniform Guidance. As part of the SEFA preparation process, management compiles federal expenditures from multiple sources, including underlying accounting records and amounts billed to funding agencies. Accurate reconciliation of these sources is critical to ensure that federal expenditures are reported completely and accurately, and that major program determinations are appropriately made. As a result of the audit, it was identified that expenditures related to the Aging Cluster were understated by approximately $126,000 on the preliminary SEFA due to the omission of expenditures that had been billed to the funding agency but backed out of amounts reported on the SEFA during the reconciliation process. Management recorded an adjustment to correct the understatement prior to issuance of the final SEFA. Cause and Effect - The County’s SEFA preparation process did not include a sufficiently designed and implemented control to ensure the accuracy of reconciling items between expenditures reported on the SEFA to amounts billed to the funding agency. As a result of this deficiency, expenditures in the Aging Cluster were understated by approximately $126,000 on the preliminary SEFA. The correction of this error on the final SEFA increased total expenditures for the Aging Cluster, resulting in the program being classified as a Type A program rather than a Type B program for major program determination purposes. Because the deficiency resulted in a material misstatement of the SEFA that was not prevented or detected by internal control, it is considered a material weakness in internal control over compliance. Recommendation - We recommend that management design and implement effective controls over the preparation of the SEFA, including maintaining adequate support for adjustments and reconciling items. Such controls should be performed and reviewed by personnel independent of the SEFA preparation process to ensure the completeness and accuracy of federal expenditures reported. Views of Responsible Officials and Planned Corrective Actions - The County has established procedures for reconciling general ledger activity to supporting documentation and Federal Financial Reports (FFRs/FSRs) throughout the fiscal year, including additional reconciliation procedures performed at year end to capture late or adjusting entries. The condition was further impacted by timing differences between departmental reporting and subsequent adjusting entries, as well as the aggregation of adjustments across multiple programs without sufficient program-level detail at the time of review. While follow-up was initiated to obtain supporting breakdowns, the process did not require resolution of these items prior to final classification and inclusion in year-end reporting. The County is strengthening internal controls over grant-related financial activity and SEFA preparation by enhancing and enforcing requirements for accurate transaction recording, supporting documentation, and independent validation. Key improvements include: • Enhanced documentation and classification requirements for grant-related entries • Strengthened review and validation controls to ensure proper support and classification • Improved reconciliation and adjustment protocols, including postreporting revalidation • Control enforcement and escalation for unsupported or unresolved items • Training and guidance on federal compliance requirements

2025-001 – Allowable Cost Federal Agency: Department of Homeland Security Federal Program Name: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Pass-Through Agency: Florida Division of Emergency Management Pass-Through Numbers: Z2891 and Z4745 Award Period: September 23, 2022 to March 29, 2024 and October 5, 2024 to April 11, 2025 Type of Finding: 􀁸 Material Weakness in Internal Control over Compliance 􀁸 Other Matters Criteria or specific requirement: Per 2 CFR §200.303(a), the County must establish and maintain effective internal controls over federal awards that provide reasonable assurance of compliance with federal statutes, regulations, and award terms. Internal controls should ensure that employees' hours worked and documented on Activity Logs are accurately reflected in the amounts submitted to the grantor for reimbursement. Condition: During our testing, we noted that employees' hours reported on the Activity Logs did not reconcile to the corresponding amounts requested for reimbursement, resulting in discrepancies between the supporting documentation and the reimbursement requests submitted. Questioned costs: $7,568 of known questioned costs. There are also unknown questioned costs because the extent of the discrepancies between the employees' hours reported on the Activity Logs and the amounts requested for reimbursement could not be determined without further details of the activity performed during fiscal years 2022 and 2025. Context: During our testing of 40 employees, we noted 24 instances (60%) where employees' hours reported on the Activity Logs did not reconcile to the corresponding amounts requested for reimbursement. Cause: The County had not established adequate review and reconciliation procedures to ensure that employees' hours reported on Activity Logs were accurately reflected on reimbursement requests. Effect: Without adequate review and reconciliation procedures, there is an increased risk that inaccurate reimbursement amounts could be submitted to the grantor, potentially resulting in questioned costs, noncompliance with award terms, or the requirement to return federal funds. Repeat Finding: No. Recommendation: We recommend the County implement a formal review and reconciliation process to ensure that employees' hours reported on Activity Logs are verified against the reimbursement request prior to submitting it to the grantor. This review should be performed by personnel knowledgeable of the grant requirements and documented to evidence the review was completed. Views of responsible officials: There is no disagreement with the finding.

2025-002 – Reporting Federal Agency: Department of Homeland Security Federal Program Name: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Pass-Through Agency: Florida Division of Emergency Management Pass-Through Numbers: Z2891, Z0581, Z4745, Z4858 Award Period: September 23, 2022 to March 29, 2024; September 4, 2017 to March 10, 2019; October 5, 2024 to April 11, 2026; and October 5, 2024 to April 11, 2025 Type of Finding: 􀁸 Material Weakness in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), the County must establish and maintain effective internal controls over federal awards that provide reasonable assurance of compliance with federal statutes, regulations, and award terms. Internal controls should include procedures to ensure that required reports are accurate, complete, and subject to appropriate supervisory review prior to submission. Condition: During our testing, we reviewed 5 quarterly reports submitted to the grantor and noted that noted that none contained evidence of supervisory review or approval to ensure the accuracy and completeness of the reported information prior to submission. Questioned costs: None Context: 5 of the 12 quarterly reports were reviewed as part of the audit. No documentation of review or approval was identified for any of the reports tested. Cause: The County had not established or implemented formal review and approval procedures over the preparation and submission of grant reporting. Effect: The absence of documented review and approval controls increases the risk that errors or omissions in required reports may not be detected and corrected prior to submission, resulting in inaccurate information being provided to grantors. This could impact funding decisions, compliance with grant requirements, or future reimbursements. Repeat Finding: No. Recommendation: We recommend the County establish and implement formal procedures requiring supervisory review and approval of all reports submitted to grantors. Evidence of review should be documented and retained, including the reviewer’s signature or electronic approval, the date of review, and the date of submission, to support compliance with reporting requirements. Views of responsible officials: There is no disagreement with the finding.

Finding No.: 2025-001 Federal Agency: Environmental Protection Agency AL No. and Title: 66.039 Diesel Emission Reduction Act (DERA) National Grants 98T80301 Federal Award No.: Area: Procurement and Suspension and Debarment Criteria: 2 CFR 180.300 requires entities entering into a covered transaction with another person at the next lower tier to verify that the person with whom they intend to do business is not excluded or disqualified. Such verification can be made by (a) checking SAM.gov Exclusions, or (b) collecting a certification from that person; or (c) adding a clause or condition to the covered transaction with that person. 2 CFR 180.220 (b) (1) states that a contract for goods and services is a covered transaction if the contract is awarded by a participant in a nonprocurement transaction covered under §180.210, and the contract amount is expected to equal or exceed $25,000. 2 CFR 200.303 requires that a non-federal entity must “(a) establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: For one covered transaction during fiscal year 2025, the Authority represented that it performed verification of suspension or debarment from SAM.gov Exclusions, however, no formal documentation is kept on file to demonstrate compliance at the time of procurement. Cause: The Authority does not have formal policy requiring documentation of procedures performed to verify that the person in a covered transaction with whom they intend to do business is not excluded or disqualified. Effect or potential effect: The Authority lacked the formal documentation of procedures performed to demonstrate compliance to 2 CFR 180.300. Finding No.: 2025-001, continued Federal Agency: Environmental Protection Agency AL No. and Title: 66.039 Diesel Emission Reduction Act (DERA) National Grants 98T80301 Federal Award No.: Area: Procurement and Suspension and Debarment Questioned costs: None Context: There was only one covered transaction. The audit team verified that vendor is not excluded or disqualified. Recommendation: The Authority should formalize its policies and procedures in documenting procedures performed in verifying that the person in a covered transaction with whom they intend to do business is not excluded or disqualified. Views of responsible officials: The Authority agrees to the finding. Refer to the corrective action plan.

Finding: 2025-002 – Cash Management – Significant Deficiency in Controls over Compliance and immaterial instance of non-compliance Department: United States Department of Health and Human Services Program Name: Assistance for Torture Victims Federal Assistance Listing Number: 93.604 Criteria: 2 CFR 200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by COSO. 2 CFR 200.305 mandates that federal payments, including reimbursement, must minimize the time elapsing between fund transfer and disbursement. Condition/Context: During our walkthroughs of the cash draw process, the Organization indicated that evidence supporting preparation of the draw and review of the draw is not retained in its books and records. Additionally, the Organization drew funds in excess of their immediate cash needs, totaling approximately $350,000. Cause: Management did not have a documented policy and set of documented procedures in place to ensure consistent application of an independent review and memorializing that review. Effect: Draws in excess of amounts incurred may not be spent within three days. Further, any amounts claimed that are not allowable grant expenditures may be disallowed by the granting agency. Questioned Costs: None Repeat finding: This is a repeat finding – see prior year 2024-002. Recommendation: We recommend that the Organization establish a written policy and procedures for cash management that should be reviewed and approved by those charged with governance. The policy should require that all draws be reviewed by someone independent of the individual calculating the draw. The review should be documented in the Organization’s books and records. Views of responsible officials and planned corrective actions: Management agrees with the recommendation and has established a written policy and implemented a documented process for the preparation and review of federal drawdowns, including clear evidence of review such as signoffs or electronic approvals.

Finding 2025-002: Significant Deficiency in Internal Control Over Financial Statements – Inadequate Review of Expenditures Federal Programs 15.904 and 14.251 U.S Department of the Interior and U.S. Department of Housing and Urban Development Criteria: Under 2 CFR 200.303 and 2 CFR 200.508, the Organization must maintain effective internal control over compliance with federal award requirements, including documented evidence that disbursements are properly authorized, supported, and made in accordance with applicable grant agreements and organizational policies. Condition: During disbursement testing for the above federal programs, approvals were often evidenced only by the President’s signature on checks. Approval was not consistently documented on underlying invoices or in the accounting system, and practices for documenting preapproval of grant-related expenditures were not uniform. Cause: The Organization has not fully implemented a formal, documented expense approval process that requires and evidences review and authorization at the invoice or transaction level. Effect: Inconsistent documentation of approvals increases the risk that federal program disbursements may be processed without appropriate review, may not comply with grant requirements or organizational policies, or may be recorded in the wrong period or account. This represents a significant deficiency in internal control over compliance, although no unallowable or improper costs were identified in our testing. Questioned Costs: None. Recommendation: Implement a formal expense approval policy for federal program expenditures that requires documented approval at the invoice or transaction level (for example, signatures/initials on invoices or documented electronic approvals in QuickBooks Online). Establish an approval matrix with defined thresholds and authorized approvers to reduce reliance on the President and promote consistent application across programs. Views of responsible officials: See attached corrective action plan.

FINDING 2025‐001—ALLOWABLE COSTS/COST PRINCIPLES AND ACTIVITIES ALLOWED AND UNALLOWED AND SPECIAL TEST – DRAWDOWNS OF HOME/HOME ARP FUNDS—MATERIAL WEAKNESS IN INTERNAL CONTROLS OVER COMPLIANCE FEDERAL PROGRAM: Home Investment Partnerships Program (HOME) ASSISTANCE LISTING NUMBER: 14.239 YEAR(S): 2025 FEDERAL AGENCY: Department Of Housing and Urban Development (HUD) PASS‐THROUGH AGENCIES: Idaho Housing and Finance Association Criteria - In accordance with 2 CFR 200.303 the recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition/Context - On a periodic basis management submits draw-down requests to the pass-through agency. Management could not provide documentation to evidence that a review was performed over 100% of the draw-down requests prior to their submission. Further, during the testing of the underlying expenses, which are the primary inputs into the above-mentioned drawdown requests, management was able to evidence their review of payroll expenses via approved time sheets. However, non-payroll expenses and their associated indirect cost allocation calculations did not have evidence of management’s review for allowability. Cause - Management did not design and implement a control that required documented evidence of review and approval of the drawdown request. The control also did not ensure that the evidence of review of the underlying non-payroll expenses and indirect cost allocation calculations were retained. Effect - Management may not be able to detect and prevent unallowable expenses from being submitted to the passthrough agency for reimbursement, which could result in unallowed expenses being charged to the grant. Questioned Cost - Not Applicable Recommendation - Management should design and implement a control that ensures sufficient evidence of approval is obtained and retained, including underlying indirect cost allocation calculations and non-payroll costs. View of Responsible Officials - See Corrective Action Plan.

GRANT REPORTING U.S. Department of Homeland Security ALN 97.036 – Disaster Grants – Public Assistance Contract No. PA-B3-06-74-01-312 and PA-DR-06-74-01-166 Passed through the Florida Division of Emergency Management 2025 Funding Criteria: 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal controls. Reports and reimbursement requests should be subject to independent review for the full fiscal year to verify completeness, validity and timeliness of submission. The grant agreement requires quarterly progress reports to be filed with the pass-through entity, Florida Division of Emergency Management. Condition: Review of quarterly reports and reimbursement requests were not documented by the City before submittal. Cause of condition: The department at the City that is responsible for managing the grant does not have a process in place to document their review of quarterly reports and reimbursement requests submitted to the Florida Division of Emergency Management. Potential effect of condition: Reports submitted to the Florida Division of Emergency Management may be incomplete, include errors, or be submitted late. Perspective: The department of the City that manages the grant did not have a documented process in place for the review and approval of quarterly reports and reimbursement requests prior to submittal to the grantor. Questioned costs: None noted. Reported finding is a deficiency in internal control. Recommendation: The City should develop procedures to ensure documented management review of all reporting prior to submission to grantors. Management’s Response: The City updated its control process to ensure that reports prepared are reviewed by City staff or management prior to being submitted to grantor.

Finding 2025-001: Finding Type: Noncompliance and significant deficiency in internal control Federal Department: U.S. Department of Health and Human Services Identification of the Federal Program: Assistance Listing Number 93.297 – Teenage Pregnancy Prevention Program, United States Department of Health and Human Services (HHS) Award Number: 5 TP1AH000315-02-00 Compliance Requirements: Matching, Level of Effort, and Earmarking and Reporting Criteria Per 2 CFR 200.303 (Internal Controls), non-federal entities must establish and maintain effective internal control over federal awards that provides reasonable assurance of compliance with federal statutes, regulations, and terms and conditions of the award. Effective internal controls should ensure these requirements are consistently met. Per 2 CFR 200.306 (Cost Sharing), cost-sharing contributions, including third-party in-kind contributions, must be properly documented and allowable. Per 2 CFR 200.328 (Financial Reporting), financial reports must be accurate and complete. The SF-425 Federal Financial Report (FFR) instructions require recipients to report recipient share of expenditures (including cost matching or cost sharing). The Notice of Funding Opportunity #AH-TP1-23-001 for Advancing Equity in Adolescent Health through Evidence-Based Teen Pregnancy Prevention Programs and Services issued by HHS states at section D.3.b.1.s: “For awards that do not require matching or cost sharing by statute or regulation, where ‘cost sharing’ refers to costs of a project in addition to Federal funds requested that you voluntarily propose in your budget, if your application is successful, we will include this non-federal cost sharing in the approved budget and you will be held accountable for the non-federal cost-sharing funds as shown in the Notice of Award (NOA). Failure to meet a cost sharing or matching obligation that is part of the approved project budget on the NOA may result in the disallowance of federal funds. If you are funded, you will be required to report cost sharing or matching funds on your quarterly Federal Financial Reports.” Condition The Fund did not formally track or record the in-kind contribution required for federal award #5 TP1AH000314-02-00 for budget period July 1, 2024 through June 30, 2025. The Fund did not report the recipient share of expenditures on the quarterly SF-425 Federal Financial Reports (FFR) during fiscal year 2025. Through review of supporting documentation compiled subsequent to fiscal year 2025, the auditor verified that the Fund received third-party in-kind contributions via donated services performed during the budget period of July 1, 2024 through June 30, 2025 of $1,119,156, which is $22,521 less than the required cost share per the NOA. However, the Fund submitted a grant amendment to HHS on February 28, 2025 via the Grant Solutions system to reduce the Project Director's effort from 100% to 25% (because she was reassigned to another federal program), which would have reduced the required cost share amount to $1,039,482. Had the Fund's grant amendment request been approved, the Fund would have met and exceeded the required in-kind cost share. The Fund has made numerous attempts to contact HHS to obtain resolution regarding the outstanding grant amendment approval request, to no avail. As of May 29, 2026, the grant amendment has yet to be approved by HHS, and it appears as "in progress" in the Grant Solutions system. Therefore, the auditor was unable to determine whether the in-kind cost share was fully met. Cause When applying for the New York City Teens Connection Expansion project funds for budget period July 1, 2024 through June 30, 2025, the Fund included a voluntary non-federal cost share amount of $1,141,677 in their proposed budget. Upon receiving the federal award, HHS included the $1,141,677 cost share on the NOA as a requirement of the federal award. The Fund was aware of the required cost share, but did not formally track or report the donated services provided toward the cost share requirement during fiscal year 2025 because they thought that voluntary cost share amounts are not required to be formally tracked or reported on the FFR. Effect The Fund’s internal controls did not ensure that #93.297 in-kind contributions were formally documented and reported in accordance with Uniform Guidance requirements during fiscal year 2025. Recipient share of expenditures on the quarterly FFRs was underreported and the federal awarding agency may not have been able to verify the Fund’s compliance with matching requirements. Questioned Costs None. Recommendation We recommend that the Fund implement internal control procedures whereby someone reviews NOAs for any specified cost sharing or matching amounts, including those which are voluntary, and ensure that compliance with such requirements are formally tracked and reported over the life of the award. View of Responsible Officials Management agrees with the recommendation. The Organization’s corrective action plan is on page 45.

2025-006 – Internal Control over Compliance and Compliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles Requirement (Significant Deficiency) Information on the Major Federal Program - Federal Agency: United States Agency for International Development (USAID) Program Name: USAID Foreign Assistance for Program Overseas Assistance Listing Number: 98.001 Award Number: 72052122CA00007 Award Period: June 13, 2022 – February 26, 2025 Criteria – The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.403, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented.” Condition – During our testing of expenses charged to the federal program, we identified three (3) out of 43 sampled transactions where full supporting documentation, including evidence of transaction approval, were not available for our review. Based on discussions with management, the source documentation was shipped from the Haiti program location and was lost in transit. As a result, complete records to support the three expenses and evidence of approval of expenses were not readily available. Cause – This appears to have resulted from insufficient controls over the transfer, retention, and tracking of project documentation during closeout, particularly for records originating from Haiti, where significant security and logistical challenges increase the risk associated with transporting original hard-copy files. Effect - Without adequate internal controls in place to ensure costs are properly reviewed for allowability and documentation, Corus could be noncompliant with the allowability requirement and could request funds for costs that are unallowed. Questioned Costs – Below reportable threshold. Context – This is a condition identified per review of Corus’ compliance with the specified requirements. Repeat Finding - This is not a repeat finding. Recommendation – We recommend that management strengthen controls over the transfer, retention, and accessibility of project documentation during closeout, particularly for records originating from Haiti, which is currently operating in a distressed location with significant security and logistical challenges. Given the heightened risk of loss, delay, or inaccessibility of hard-copy records in a war zone–like environment, management should implement procedures to scan and retain electronic copies of all critical financial, contractual, and approval documentation, including signed journal vouchers, before shipment; maintain a detailed shipping manifest of all files transferred; and track shipments through receipt and inventory confirmation at headquarters. These steps would help mitigate the elevated risk associated with transporting original records from a high-risk environment and support timely access to documentation for accounting, audit, and compliance purposes. Views of Responsible Officials - Corus management agrees with the findings and recommendations. The planned corrective actions are presented in Corus management’s corrective action plan attached as Appendix B to the Single Audit Report.

FINDING 2025-056 WIOA Cluster, ALN 17.258, 17.259, and 17.278 See Schedule of Findings and Questioned Costs for chart/table. Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor and Economic Opportunity (LEO) did not report subaward information to SAM.gov timely or accurately. Context: Eight subawards were selected for testing and the following exceptions were noted: • 2 of 8 subawards were not reported timely. The subawards were issued in March 2025 and should have been reported by April 30, 2025, but were not reported until May 13, 2025, or thirteen days late. • 2 of 8 subawards were not reported accurately: o The total of subaward 58128 25-19 was $192,109 but $194,030 was reported which is a variance of $1,921. o The total of subaward 58140 25-19 was $152,340 but $153,863 was reported which is a variance of $1,523. See Schedule of Findings and Questioned Costs for chart/table. Cause: LEO's procedures and controls were not operating effectively to ensure that subawards were reported timely and accurately. Program financial staff indicated to auditors that the late reports were due to conflicting quarter-end priorities and that the inaccurate reports were due to rounding errors. Effect: Subawards were not reported timely or accurately to SAM.gov. Questioned costs: None noted. Recommendation: We recommend that LEO review and enhance procedures and internal controls to ensure that all required subawards are reported timely to SAM.gov by the end of the month following the month in which each subaward is issued. Controls should be designed to operate effectively throughout the year, including during peak workload periods and competing deadlines. We further recommend that LEO should have sufficient controls in place to verify the accuracy of FFATA reporting before submission, including controls to detect and correct rounding variances and other reporting errors. Views of Responsible Officials: Management Views LEO agrees with the finding.

FINDING 2025-057 Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs, ALN 20.106 See Schedule of Findings and Questioned Costs for chart/table. Criteria or specific requirement: Compliance: 2 CFR 200.313 prescribes the requirements for non-federal entities regarding equipment and real property management. Requirements include the following: Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the federal award identification number), who holds title, the acquisition date, cost of the property, percentage of federal participation in the project costs for the federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sales price of the property. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Michigan Department of Transportation (MDOT) did not manage equipment nor maintain property records in accordance with federal requirements. MDOT does not have sufficient policies and controls to adequately oversee equipment and real property purchased with program funds. Context: MDOT awards Airport Improvement Program Funding in accordance with provisions outlined in a Memorandum of Understanding with the Federal Aviation Administration to recipient airports across the State. MDOT is not the end recipient of the program funds, however, MDOT makes direct payments to vendors on behalf of Block Grant Program recipient airports in accordance with FAA policies and procedures. MDOT determined that the agreements it has with the non-primary airports are contractual relationships and not subrecipient. Therefore, despite programmatic requirements being part of the agreement, federal program requirements have not been passed on to the public airports and MDOT is responsible for adherence to applicable federal program requirements specified in the federal award. Auditors selected eight of the forty-three airports for testing and noted the following: • MDOT contracts contain requirements for the airports to manage equipment or maintain property records in accordance with federal requirements, however, MDOT did not require airports to report two-year equipment inventories or real property in a manner that allowed for verification that equipment and real property was acquired and managed by the airports in accordance with federal requirements in a timely manner. • 4 of 8 airports selected for testing did not provide equipment listings. MDOT was unable to provide auditors with a complete list of equipment and real property purchased with program funds to confirm the airports that did not submit information did not have any property or equipment purchases to report. • Two-year physical inventory verifications were not performed nor reconciled. Cause: MDOT informed us that due to variances between the Uniform Guidance and program guidance, MDOT exercised operational discretion and good faith and also sustained program continuity by following and executing program guidance. Effect: MDOT lacks assurance that equipment and real property purchased with federal funds is properly recorded, safeguarded, and used in accordance with program requirements. The absence of complete property records and required physical inventories increases the risk of loss, misuse, or unauthorized disposition of federally funded assets, and that noncompliance could occur and remain undetected. This condition may subject the program to federal actions such as increased oversight, withholding of funds, or other enforcement actions. Questioned costs: None. Recommendation: We recommend that MDOT strengthen its internal controls over equipment and real property in accordance with federal requirements. Specifically, MDOT should develop and implement policies and procedures to ensure that equipment and real property purchased with federal funds is properly tracked, recorded, and safeguarded. If MDOT determines that these requirements should be handled through a subrecipient agreement with the airports, MDOT should update policies and procedures, contracts, and controls regarding subrecipient relationships to ensure the federal requirements are passed through to the subrecipient in accordance with the federal requirements, and update reporting within the schedule of expenditures of federal awards to report subrecipient payments accordingly. Views of Responsible Officials: Management Views MDOT agrees with the finding.

FINDING 2025-058 Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs, ALN 20.106 See Schedule of Findings and Questioned Costs for chart/table. Criteria or specific requirement: Compliance: All laborers and mechanics employed by contractors or subcontractors to work on construction contracts in excess of $2,000 financed by federal assistance funds must be paid wages not less than those established for the locality of the project (prevailing wage rates) by the Department of Labor (DOL) (40 USC 3141–3147). Nonfederal entities shall include in their construction contracts subject to the Wage Rate Requirements (which still may be referenced as the Davis-Bacon Act) a provision that the contractor or subcontractor comply with those requirements and the DOL regulations (29 CFR Part 5, Labor Standards Provisions Applicable to Contracts Governing Federally Financed and Assisted Construction). This includes a requirement for the contractor or subcontractor to submit to the nonfederal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls) (29 CFR sections 5.5 and 5.6; the A-102 Common Rule (section 36(i)(5)); OMB Circular A-110 (2 CFR Part 215, Appendix A, Contract Provisions); 2 CFR Part 176, Subpart C; and 2 CFR section 200.326). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Michigan Department of Transportation (MDOT) did not ensure that contractors complied with Davis-Bacon wage rate requirements. It did not properly obtain weekly certified payrolls from contractors to monitor compliance. Context: MDOT determined that the agreements it has with the non-primary airports are contractual relationships and not subrecipient. Therefore, federal program requirements have not been passed on to the public airports and MDOT is responsible for adherence to applicable federal program requirements specified in the federal award. Auditors selected eight of the forty-three airports for testing Davis-Bacon wage rate requirements and noted the following exceptions: • 5 of the 8 contractors did not have certified payrolls, therefore, MDOT did not review payroll data during the fiscal year to ensure contractors complied with wage rate requirements in a timely manner. • For 2 of 8 contracts, MDOT included Davis-Bacon wage rate requirements in the bid documentation, but not in the executed contracts as required by program requirements. Cause: MDOT does not have sufficient procedures or internal controls to ensure that it monitors contractors' compliance with Davis-Bacon wage rate requirements. Effect: MDOT's failure to include Davis-Bacon wage rate requirements in its contracts and to obtain current year certified payrolls from contractors reduces its ability to monitor compliance with program requirements. As a result, there is an increased risk that contractors were not paid in accordance with required prevailing wage rates, which could result in noncompliance with federal requirements and potential questioned costs. Additionally, continued noncompliance may subject the program to sanctions such as withholding of funds, increased oversight, or other federal enforcement actions. Questioned costs: None. Recommendation: We recommend that MDOT strengthen its internal controls over compliance with Davis-Bacon wage rate requirements. Specifically, MDOT should ensure that contractors are appropriately informed of applicable wage rate requirements by incorporating these provisions into contracts and related documents. In addition, MDOT should develop and implement procedures to ensure that weekly certified payrolls are submitted by contractors and are reviewed in a timely manner to verify compliance. MDOT should also establish follow-up procedures to address instances of noncompliance and ensure timely resolution. If MDOT determines that these requirements should be handled through a subrecipient agreement with the airports, MDOT should update policies and procedures, contracts, and controls regarding subrecipient relationships to ensure the federal requirements are passed through to the subrecipient in accordance with the federal requirements, and update reporting within the schedule of expenditures of federal awards to report subrecipient payments accordingly. Views of Responsible Officials: Management Views MDOT agrees with the finding.

FINDING 2025-059 Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs, ALN 20.106 See Schedule of Findings and Questioned Costs for chart/table. Criteria or specific requirement: Compliance: All revenues generated by a public airport must be expended for the capital or operating costs of the airport, the local airport system, or other local facilities that are owned or operated by the owner or operator of the airport and are directly and substantially related to the actual air transportation of passengers or property. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Michigan Department of Transportation (MDOT) did not ensure that revenues generated by non-commercial airports were expended for the capital or operating costs of the airport, the local airport system, or other local facilities that are owned or operated by the owner or operator of the airport and are directly and substantially related to the actual air transportation of passengers or property. Context: MDOT determined that the agreements it has with the non-primary public airports are contractual relationships and not subrecipient. Therefore, federal program requirements have not been passed on to the public airports and MDOT is responsible for adherence to applicable federal program requirements specified in the federal award. Auditors selected eight of the forty-three airports for testing and for the eight airports selected, MDOT did not ensure that revenue diversion requirements were met. The contracts executed by MDOT included the program's revenue diversion requirements, but MDOT did not monitor the airports' compliance with these requirements and is unable to provide documentation that revenue diversion requirements were met. Cause: MDOT has not prioritized its monitoring and oversight efforts to help ensure that contractors comply with revenue and program income requirements to prevent revenue diversion. Effect: MDOT is unable to ensure that public airports used revenue in accordance with federal requirements. There is an increased risk of revenue diversion occurring or going undetected, potentially resulting in noncompliance with program requirements and questioned costs. Continued noncompliance may also subject the program to federal actions such as increased oversight, withholding of funds, or other enforcement actions. Questioned costs: None. Recommendation: We recommend that MDOT strengthen its internal controls over compliance with revenue diversion requirements. Specifically, MDOT should develop and implement monitoring procedures to ensure that public airports comply with contractual provisions prohibiting revenue diversion. Such procedures should include periodic reviews of financial and supporting documentation, documentation of monitoring activities performed, and timely follow-up on any identified instances of noncompliance to ensure appropriate corrective action is taken. If MDOT determines that these requirements should be handled through a subrecipient agreement with the airports, MDOT should update policies and procedures, contracts, and controls regarding subrecipient relationships to ensure the federal requirements are passed through to the subrecipient in accordance with the federal requirements, and update reporting within the schedule of expenditures of federal awards to report subrecipient payments accordingly. Views of Responsible Officials: Management Views MDOT agrees with the finding.

FINDING 2025-021 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - AASHTOWare Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MDOT did not fully establish effective security management and access controls over AASHTOWare users. MDOT program staff utilize AASHTOWare to administer construction contracts and approve payments to contractors. We noted: a. MDOT did not fully review internal users on an annual basis. b. MDOT did not disable 88 (4%) of 2,287 users who had not accessed the application within 365 days for internal user accounts and 18 months for external user accounts as of September 30, 2025. Our review disclosed: (1) For the 650 internal user accounts, 14 (2%) users had not logged into the application within 365 days, ranging from 1,399 to 4,597 days and 18 (3%) users had not logged in since access was granted. (2) For the 1,637 external user accounts, 56 (3%) users had not logged in since access was granted. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires accounts to be reviewed annually to validate their continued need and the information system to automatically disable inactive internal user accounts after 60 days and inactive external user accounts after 18 months. However, MDOT has a documented business need to allow user access to remain enabled until 365 days of inactivity. Cause MDOT's internal control and monitoring activities were not sufficient to ensure all appropriate parties adhered to established policies. Effect Without effective security management and access controls, individuals may maintain unauthorized or inappropriate access to AASHTOWare. Known Questioned Costs None. Recommendation We recommend MDOT fully establish effective security management and access controls over AASHTOWare users. Management Views MDOT agrees with the finding.

FINDING 2025-022 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - Concur Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition The Michigan Strategic Fund (MSF), in conjunction with the Michigan Economic Development Corporation (MEDC), did not fully implement effective security management and access controls over Concur. MSF and MEDC program staff utilize Concur to approve subrecipient* reimbursement requests. We noted: a. MSF did not fully implement an effective annual recertification process of non-privileged and privileged accounts. MSF did not review active employees' user accounts to ensure users still require system access and the users' access was assigned in accordance with their job responsibilities. b. MSF did not disable 8 (11%) of 73 Concur user accounts able to approve invoices who did not access the application in over 60 days as of September 30, 2025. In 7 instances, users last logged in between 190 to 1,406 days prior and in the other instance, the user had not logged in since access was granted. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. MEDC Standard SECU.01.020.01 requires accounts to be reviewed annually to validate the necessity of all accounts and ensure data permissions assigned to each account are based on the principle of least privilege. The Standard also requires monthly reviews of accounts with no activity for 60 days and determine which inactive accounts should be disabled. Cause MSF informed us its current policy does not apply to Concur because of undocumented risk assessments. However, MSF, in conjunction with MEDC, did not document any exceptions to the policy for Concur. Effect Without effective user access controls, individuals may maintain unauthorized or inappropriate access to Concur. As a result, an increased risk exists because MSF cannot ensure the security of the Concur application and data used to issue payments to subrecipients of federal awards. Known Questioned Costs None. Recommendation We recommend MSF, in conjunction with MEDC, fully implement effective security management and access controls over Concur. Management Views MSF agrees that Concur was not written as an exception in the identified policy, but disagrees that there is a control deficiency. MSF maintains effective controls within its control environment that effectively mitigate risks associated with exempting Concur from the identified policy and provide reasonable assurance MSF is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Auditor's Comments to Management Views MSF believes it has reasonable assurance federal awards are being managed in compliance with federal statutes, regulations, and the terms and conditions of federal awards. However, federal regulation 2 CFR 200.303 states internal control should align with the guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States (Green Book) or the "Internal Control-Integrated Framework" issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Appendix I of the Green Book requires management to document the results of risk assessments including identification, analysis, and response to risks. This includes documentation of the consideration of risks related to information security, which could impact the internal control system. While MSF disagrees a control deficiency exists, it acknowledges it does not have a written exception identified in the referenced policy; it also does not have documentation of its risk assessment related to Concur security, which could impact the internal control system and the response to additional risks by exempting this information system from policy. Therefore, the finding stands as written.

FINDING 2025-023 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - EGrAMS Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition The Department of Labor and Economic Opportunity (LEO) did not fully establish effective security management and access controls over EGrAMS users. LEO utilizes EGrAMS to approve subrecipient reimbursement requests. We noted: a. LEO did not maintain documentation to support the appropriate individual approved the system role for 4 of 6 sampled EGrAMS users, of which all 4 were external users. b. LEO did not establish a process to review internal user accounts on an annual basis. c. LEO did not disable 1,069 (76%) of 1,403 EGrAMS user accounts not accessing the application in over 60 days as of September 30, 2025, ranging from 62 to 838 days since last login. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires agencies to implement and document baseline controls, such as access authorizations. The Standard also requires accounts to be reviewed annually to validate their continued need and the information system to automatically disable inactive user accounts after 60 days. Cause LEO's internal control and monitoring activities were not sufficient to ensure all appropriate parties adhered to established policies. Effect Without effective user access controls, individuals may obtain or maintain unauthorized or inappropriate access to EGrAMS. As a result, an increased risk exists LEO cannot ensure the security of the EGrAMS application and data used to issue payments to subrecipients of federal awards. Known Questioned Costs None. Recommendation We recommend LEO fully establish effective security management and access controls over EGrAMS users. Management Views LEO agrees with the finding.

FINDING 2025-024 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - MiSSG Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MiLEAP did not fully establish effective security management and access controls over the Michigan Student Aid Scholarships and Grants (MiSSG) users. MiLEAP program staff utilize MiSSG to administer Michigan Reconnect scholarships and approve payments to community colleges on behalf of Michigan students. We noted: a. MiLEAP did not maintain documentation for 2 of 7 sampled MiSSG access request forms. b. MiLEAP did not maintain sufficient documentation of its recertification review of internal users. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires agencies to implement and document baseline controls, such as access authorization. The Standard also requires accounts to be reviewed annually to validate their continued need. Cause MiLEAP informed us internal control and monitoring activities were not sufficient to ensure all appropriate parties adhered to established policies and procedures. Effect Without effective security management and access controls, individuals may obtain or maintain unauthorized or inappropriate access to MiSSG. Known Questioned Costs None. Recommendation We recommend MiLEAP fully establish effective security management and access controls over MiSSG. Management Views MiLEAP agrees with the finding.

FINDING 2025-025 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - PTMS Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MDOT did not fully establish effective security management and access controls over PTMS users. MDOT program staff utilize PTMS to approve subrecipient budget and payment requests. We noted MDOT did not maintain a sufficient audit trail to document the users' roles in place during the audit period. As a result, we were unable to isolate a population of users who received access to PTMS during fiscal year ending on September 30, 2025. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.040.01 requires the information system owner to ensure the logging of user access management activities, such as additions, modifications, and deletions of user accounts. Cause MDOT informed us, because of a system limitation, historical user access data was deleted when an existing user received a new role. Effect Without effective user access controls, individuals may obtain or maintain unauthorized or inappropriate access to PTMS. As a result, an increased risk exists where MDOT cannot ensure the security of the PTMS application and data used to issue payments to subrecipients of federal awards. Known Questioned Costs None. Recommendation We recommend MDOT fully implement effective security management and access controls over PTMS users. Management Views MDOT agrees with the finding.

FINDING 2025-026 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - Insufficient Respite Payment Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not have sufficient controls in place to prevent or detect and correct payment errors made to respite grant recipients. We noted MDHHS did not review and approve respite grant payments subsequent to manual input into the Medical Services Administration Manual Payment System (MSAPay). Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Also, Subpart E of federal regulation 2 CFR 200 requires costs charged to federal programs be necessary and reasonable for the administration of the federal award and be in accordance with the relative benefits received by the program. Cause MDHHS's internal control and monitoring activities were not sufficient to ensure it documented its review and approval of respite grant payments in MSAPay. Effect These deficiencies could potentially result in improper payments to recipients. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS improve its controls to prevent or detect and correct payment errors made to respite grant recipients. Management Views MDHHS agrees with the finding.

FINDING 2025-027 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance, and Subrecipient Monitoring - Salesforce Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MSF, in conjunction with MEDC, did not fully implement effective security management and access controls over Salesforce. Program subrecipients utilize Salesforce to submit expenditure reports and reimbursement requests to MSF. Also, MEDC program staff utilize Salesforce to review and approve reimbursement requests. We noted: a. MSF did not fully implement an effective annual recertification process of non-privileged and privileged accounts. MSF did not review active employees' user accounts to ensure users still required access and the users' access was assigned privileges in accordance with their job responsibilities. b. MSF did not disable 14 (4%) of 347 Salesforce user accounts not accessing the application in over 60 days as of September 30, 2025, ranging from 117 to 2,128 days since last login. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. MEDC Standard SECU.01.020.01 requires accounts to be reviewed annually to validate the necessity of all accounts and data permissions assigned to each account are based on the principle of least privilege. The Standard also requires monthly reviews of accounts with no activity for 60 days to determine which inactive accounts should be disabled. Cause MSF informed us its current policy does not apply to Salesforce because of undocumented risk assessments. However, MSF, in conjunction with MEDC, did not document any exceptions to the policy for Salesforce. Effect Without effective user access controls, individuals may maintain unauthorized or inappropriate access to Salesforce. As a result, an increased risk exists where MSF cannot ensure the security of the Salesforce application and data used to issue payments to subrecipients of federal awards. Known Questioned Costs None. Recommendation We recommend MSF, in conjunction with MEDC, fully implement effective security management and access controls over Salesforce. Management Views MSF agrees that Salesforce was not written as an exception in the identified policy, but disagrees that there is a control deficiency. MSF maintains effective controls within its control environment that effectively mitigate risks associated with exempting Salesforce from the identified policy and provide reasonable assurance MSF is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Auditor's Comments to Management Views MSF believes it has reasonable assurance federal awards are being managed in compliance with federal statutes, regulations, and the terms and conditions of federal awards. However, federal regulation 2 CFR 200.303 states internal control should align with the guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States (Green Book) or the "Internal Control-Integrated Framework" issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Appendix I of the Green Book requires management to document the results of risk assessments including identification, analysis, and response to risks. This includes documentation of the consideration of risks related to information security, which could impact the internal control system. While MSF disagrees a control deficiency exists, it acknowledges it does not have a written exception identified in the referenced policy; it also does not have documentation of its risk assessment related to Salesforce security, which could impact the internal control system and the response to additional risks by exempting this information system from policy. Therefore, the finding stands as written.

FINDING 2025-029 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Subrecipient Monitoring - MiGrants Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition The Department of Natural Resources (DNR) did not fully establish effective security management and access controls over MiGrants. DNR program staff utilize MiGrants to approve subrecipient reimbursement requests. We noted: a. DNR did not maintain documentation to support the appropriate individual approved the system role for 2 (8%) of 24 sampled MiGrants user accounts. Of the 22 user accounts reviewed, DNR did not ensure it properly approved 1 (5%) user account prior to granting access to MiGrants. b. DNR did not maintain documentation of its annual recertifications for 10 (91%) of 11 sampled internal MiGrants user accounts. c. DNR did not disable 219 (16%) of 1,391 MiGrants user accounts not accessing the application in over 60 days as of September 30, 2025, ranging from 61 to 363 days since last login. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires agencies to implement and document baseline controls, such as access authorizations. The Standard also requires accounts should be reviewed annually to validate their continued need and the information system to automatically disable inactive user accounts after 60 days. Cause DNR's internal control and monitoring activities were not sufficient to ensure all appropriate parties adhered to established policies. Effect Without effective user access controls, individuals may obtain or maintain unauthorized or inappropriate access to MiGrants. As a result, an increased risk exists where DNR cannot ensure the security of the MiGrants application and data used to issue payments to subrecipients of federal awards. Known Questioned Costs None. Recommendation We recommend DNR fully establish effective security management and access controls over MiGrants. Management Views DNR agrees with the finding.

FINDING 2025-060 Coronavirus Capital Projects Fund, ALN 21.029 See Schedule of Findings and Questioned Costs for chart/table. Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. For the Coronavirus Capital Projects Fund program, FSRS was inaccessible to recipients due to a technical configuration problem until August 2023. Due to this technical issue, Treasury issued guidance requesting that recipients complete FSRS reporting by no later than June 30, 2024. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor and Economic Opportunity (LEO) did not report subaward information timely. Context: Seven of eight subawards selected for testing were not reported timely. Specifically, we noted the following: • 5 of 8 subawards, totaling $50,553,778, were issued in 2023 and early 2024 and, per Treasury's reporting guidance, should have been reported in FSRS no later than June 30, 2024. Two of the subawards were reported in March 2025 and three of the subawards were reported in September 2025, which was eight to thirteen months after Treasury's extended deadline. • 2 of 8 subawards, totaling $9,739,385, were issued on August 1, 2024, but were not reported until January and February 2025, or four to five months late. See Schedule of Findings and Questioned Costs for chart/table. Cause: LEO's procedures and controls were not operating effectively to ensure that subawards were reported timely, in accordance with FFATA reporting requirements and Treasury's reporting guidance. Effect: Subawards were not reported timely to FSRS or SAM.gov. Questioned costs: None noted. Recommendation: We recommend that LEO review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to SAM.gov no later than the end of the month following the month of issuance of each subaward, or in accordance with deadlines established by Treasury. Views of Responsible Officials: Management Views The Department of Labor and Economic Opportunity (LEO) agrees with the finding.