Findings Citing § 200.303

BETH ISRAEL LAHEY HEALTH, INC. AND AFFILIATES Schedule of Findings and Questioned Costs Year ended September 30, 2025 Criteria: Title 2 U.S. Code of Federal Regulations Part 200 (2 CFR 200) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Section 200.430(a) states that compensation for personal services includes all remuneration, paid currently or accrued, for services of employees rendered during the period of performance under the Federal award, including but not necessarily limited to wages and salaries. Costs of compensation are allowable to the extent the compensation is reasonable for the services rendered and conforms to the established written policy of the recipient or subrecipient consistently applied to both Federal and non-Federal activities; follows an appointment made in accordance with the recipient's or subrecipient's laws, rules, or written policies and meets the requirements of Federal statute, where applicable; and is determined and supported by records that accurately reflect the work performed. 2 CFR 200.403(b) further states costs must meet the criteria of conforming to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items to be allowable under Federal awards. This includes the auditor to determine if the awards contain any negotiated wage or salary rates, or contain any restrictions on salaries and wages, such as the NIH restriction on the amount that may be charged for individual salaries (https://grants.nih.gov/grants/policy/salcap_summary.htm). Additionally, 2 CFR 200.400(d) requires the accounting practices of the recipient and subrecipient to be consistent with the cost principles and support the accumulation of costs as required by the cost principles, including maintaining adequate documentation to support costs charged to the Federal award. Furthermore, 2 CFR 200.403 states the factors affecting allowability of costs. These factors include the cost to (a) be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principes and (g) be adequately documented to meet the criteria to be allowable under Federal awards. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During our testing of payroll for Beth Israel Deaconess Medical Center (BIDMC), an affiliate of Beth Israel Lahey Health, Inc., management did not consistently adhere to the specific award conditions set forth in the Notice of Award (NOA) related to salary limitations for 1 out of 12 of our samples related to our testing. The control operator applied an erroneous National Institutes of Health (NIH) Salary Cap limit when calculating the payroll allocation for an individual’s time allocated to a specific NIH grant selected for testing. As a result, the portion of the individual’s salary charged to the federal grant exceeded the maximum allowable NIH Salary Cap, resulting in an unallowable cost of $41 charged to the award. Furthermore, Joslin Diabetes Center (the Center), an affiliate of Beth Israel Lahey Health, Inc., manually matches purchase orders to the corresponding invoice once received. During our testing for 1 out of 25, we identified an invoice that was incorrectly matched to the purchase order for the Federal award selected for testing. This invoice was processed for payment and subsequently included in the monthly reimbursement draw. At the time of testing, the correct invoice corresponding to the valid purchase order for the selected grant had not yet been received by the Center. This resulted in the expenditure in the amount of $14 being BETH ISRAEL LAHEY HEALTH, INC. AND AFFILIATES Schedule of Findings and Questioned Costs Year ended September 30, 2025 allocated to the incorrect Federal award as well as the Federal award charged not being supported by adequate documentation. Cause: The conditions results from a lack of effective operation of internal controls over the allowability of costs related to Federal awards; specifically, ensuring the cost conforms to any limitations set forth in the Federal award as to the amount of cost items at BIDMC as well as ensuring the cost is allocable to the Federal grant and is adequately documented at the Center. Possible Asserted Effect: Failure to maintain sufficient internal controls to ensure a cost is allowable to a Federal award may result in unallowable costs being charged to Federal awards. Questioned Costs: None. Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Identification of Whether the Audit Finding was a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that BILH enhance its internal controls over Federal award expenditures to ensure, where applicable, all costs charged to Federal awards conform to any limitations or salary caps set forth in the Federal award agreement, are accurately allocated to the correct grant and are adequately documented.

Finding 2025-001- Material Weakness related to Procurement and Suspension and Debarment Identification of the Federal Program Federal Agency: Department of Health and Human Services, Department of Homeland Security, Department of Defense, Department of Justice, National Science Foundation, Department of Agriculture, US Agency for International Development Program Name: Research and Development Cluster Assistance Listing Number: Various Criteria or Specific Requirement: 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR Section 200.214 – Suspension and debarment – Non-Federal entities are subject to the non-procurement debarment and suspension regulations that restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. Condition: The Medical Center did not evaluate all vendors for suspension and debarment during the fiscal year. As a result, there were instances of procurement transactions where the vendor was not subjected to suspension and debarment evaluation procedures prior to entering into the transaction. Cause: The issue occurred due to deficiencies in the design and operation of controls over the completeness and accuracy of vendor information provided to the third-party service provider for suspension and debarment monitoring. Specifically, controls were not in place to ensure that all vendors used for the Research and Development Cluster program expenditures were included in the vendor listing submitted for suspension and debarment monitoring. Effect or Potential Effect: The lack of an effective control over suspension and debarment has the potential to result in noncompliance with applicable requirements. Accordingly, the Medical Center could have entered into a procurement transaction with a suspended or debarred vendor. Questioned Costs: No questioned costs were identified. Context: Management was unable to provide evidence of a control being consistently performed throughout the audit period. The total population consisted of 1,374 vendors utilized for expenditures charged to the Research and Development Cluster. Our testing identified that 844 vendors, representing approximately $80 million in expenditures, were not evaluated for suspension and debarment prior to entering into a transaction. The remaining 530 vendors were appropriately evaluated. Subsequently, all 1,374 vendors were evaluated for suspension and debarment and none were noted as being suspended or debarred. Identification as a Repeat Finding: Not a repeat finding. Recommendation: Management should design and implement effective internal controls to ensure the completeness and accuracy of vendor listings submitted for suspension and debarment evaluation. Controls should include procedures to verify that all vendors associated with Federal program expenditures are evaluated prior to entering into transactions and that evaluation results are appropriately documented and monitored on an ongoing basis. Views of Responsible Officials: Management concurs with the finding and has implemented procedures to ensure the vendor list for suspension and debarment evaluation is complete and accurate.

United States Department of Agriculture Federal Financial Assistance Listing #10.766 Community Facilities Loans and Grants USDA Rural Development Building Loan 97-07 & 97-08 Special Tests and Provisions Material Weakness in Internal Control over Compliance and Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Section 4 of the loan resolution security agreements dated March 28, 2012 states the Hospital must set aside a reserve amount which may be established as a bookkeeping account or as a separate bank account. Funds may be deposited in institutions insured by state and federal government or invested in marketable securities backed by the full faith and credit of the United States and should be deposited each month until the minimum amount is accumulated within the account. Condition: As a part of the audit process, a reclassification entry was made to move an additional 12 months of reserve funds from the cash sweep general fund to a separate bookkeeping account. The Hospital had excess cash available to cover the required reserve amount for the fiscal year. Cause: The Hospital did not monitor the funds throughout the year to ensure the required monthly deposits were properly made or identified as it relates to the required reserve. Effect: The Hospital could be in violation of the reserve amount requirements if management is not monitoring compliance. Questioned Costs: None reported. Context/Sampling: Sampling was not used. Repeat Finding from Prior Years: Yes, prior year finding 2024-004. Recommendation: We recommend the Hospital transfer the required reserve amount to a separate bookkeeping account in the trial balance and ensure the funds are deposited monthly in institutions insured by state and federal governments or invested in marketable securities backed by the full faith and credit of the United States. Controls should be established and documented to monitor compliance with the reserve fund provision. Views of Responsible Officials: Management agrees with the finding.

Finding Number: 2025-001 Finding Title : Internal Controls and Compliance over Eligibility for Multifamily Housing Projects Compliance Requirement(s): Eligibility Classification: Material Weakness Programs: HOME Investment Partnerships Program (HOME) ALN #: 14.239 Pass-through entity: N/A – Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Numbers: M20-MC060518, M21-MP060518, M21-MC060518, M22-MC060518, M23-MC060518 Federal Award Year: 2020, 2021, 2022, 2023, 2024 Criteria or specific requirement (including statutory, regulatory, or other citation) 24 CFR92.252 Qualification as affordable housing: Rental housing (e) Periods of affordability. The HOME-assisted units must meet the affordability requirements for not less than the applicable period, beginning after project completion. (1) The affordability requirements: (i) Apply without regard to the term of any loan or mortgage, repayment of the HOME investment, or the transfer of ownership. (ii) Must be imposed by a deed restriction, a covenant running with the land, an agreement restricting the use of the property, or other mechanisms approved by HUD and must give the participating jurisdiction the right to require specific performance (except that the participating jurisdiction may provide that the affordability restrictions may terminate upon foreclosure or transfer in lieu of foreclosure); and (iii) Must be recorded in accordance with State recordation laws. (2) The participating jurisdiction may use purchase options, rights of first refusal or other preemptive rights to purchase the housing before foreclosure or deed in lieu of foreclosure to preserve affordability. (3) The affordability restrictions shall be revived according to the original terms if, during the original affordability period, the owner of record before the foreclosure, or deed in lieu of foreclosure, or any entity that includes the former owner or those with whom the former owner has or had family or business ties, obtains an ownership interest in the project or property. (4) The termination of the restrictions on the project does not terminate the participating jurisdiction's repayment obligation under § 92.503(b). (h) Tenant income. The income of each tenant must be determined initially in accordance with § 92.203(a)(1)(i). In addition, each year during the period of affordability the project owner must re-examine each tenant's annual income in accordance with one of the options in § 92.203 selected by the participating jurisdiction. An owner of a multifamily project with an affordability period of ten years or more who re-examines tenant's annual income through a statement and certification in accordance with § 92.203(b)(1)(ii), must examine the income of each tenant, in accordance with § 92.203(b)(1)(i), every sixth year of the affordability period, except that, for units that receive Federal or State project-based rental subsidy, the owner must accept the income determination pursuant to § 92.203(a)(1) 24 CFR 92.203 Income determinations - (b) Required Documentation for Annual Income Calculations (1) For families who are tenants in HOME-assisted housing and not receiving HOME tenant-based rental assistance, the participating jurisdiction must initially determine annual income using the method in paragraph (b)(1)(i) of this section. For subsequent income determinations during the period of affordability, the participating jurisdiction may use any one of the following methods in accordance with §92.252(h): (i) Examine at least two months of source documents evidencing annual income (e.g., wage statement, interest statement, and unemployment compensation statement) for the family. (ii) Obtain from the family a written statement of the amount of the family's annual income and family size, along with a certification that the information is complete and accurate. The certification must state that the family will provide source documents upon request. (iii) Obtain a written statement from the administrator of a government program under which the family receives benefits, and which examines each year the annual income of the family. The statement must indicate the tenant's family size and state the amount of the family's annual income; or alternatively, the statement must indicate the current dollar limit for very low- or low- income families for the family size of the tenant and state that the tenant's annual income does not exceed this limit. Title 45 US Code of Federal Regulations Part 75 (45 CFR part 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 75.303 also states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designated to ensure compliance with Federal laws, regulations and program compliance requirements. Effective internal controls should include procedures to ensure eligibility criteria are met and documented. Condition The City was unable to obtain documentation from the property manager to confirm that occupants of HOME-assisted units were qualified tenants for eighteen properties, which had a combined outstanding loan balance of $9.3 million as of fiscal year-end. These properties comprised a total of one hundred and fifty-four units, all associated with the same development group. The City could not secure the required records from the property manager to verify household income for each tenant. Consequently, compliance with income eligibility criteria, maximum rent thresholds, and minimum set-aside obligations for units designated for eligible individuals could not be determined. Cause The City’s has been unable to obtain required documents from the developer/owner, including required documents to determine each family's income which is needed for determining income eligibility, compliance with maximum rent requirements or minimum set-aside requirements for units designated for eligible individuals. Effect or potential effect The developer/owner’s withholding of required documents has meant the City is without the information needed to evaluate the properties and their related tenants for compliance with HUD eligibility criteria. Questioned costs None Context The City had eighteen outstanding loans with this development group for Multi Family Construction projects as of the fiscal year end, carrying a balance of $9.3 million. This represents 12% of the 154 HOME Loans and their related $79.5 million outstanding balances. On August 29th, 2025 the City of Long Beach initiated legal action against the developer/owner in Los Angeles County Superior Court. The action concerns Borrower's breach of loan agreements with the City regarding real property for which the City seeks foreclosure and is ongoing as of the issuance of this report. Identification as a repeat finding if applicable 2024-001 Recommendation We recommend the City continue its attempts to obtain the necessary documents from the development group and exercising its rights to enforce compliance through the terms of its contractual arrangement when necessary. Additionally, we recommend the City enhance policies and/or procedure for addressing unresponsiveness among developers to establish a structure for clear communication, expectations, an escalation process, and consistent documentation requirements. Views of responsible officials and planned corrective actions The City has exercised its rights to enforce compliance with the terms of its contractual arrangement for this standalone developer/owner, which has resulted in the highest levels of legal action. Through its established monitoring and review procedures, City staff identified documents submitted by the developer that appeared to be inaccurate or falsified. This discovery prompted a multi-year investigation and subsequent litigation, undertaken in direct collaboration and response to instructions as directed by HUD. Throughout this period, the City’s investigative and litigation activities have not been historically viewed as compliance concerns, particularly given their necessity in preserving the integrity of the legal process. At every stage, the City has acted consistently with HUD’s directives and the requirements of the applicable contractual framework. During the multi‑year investigation, HUD expressly instructed the City to continue normal program operations to avoid alerting the developer and to maintain the integrity of the ongoing inquiry. The City respectfully asserts that the audit finding is inconsistent with HUD’s guidance and the historical practices necessary to ensure effective enforcement. Since the initial identification of the finding, the City has taken all reasonable corrective actions within its authority to address the issue and mitigate associated risks. These actions include following established monitoring procedures to ensure compliance with HOME program requirements, making repeated documented requests for tenant eligibility records from the developer/owner, and escalating efforts through the City Attorney. This issue is isolated to one developer/owner and sampling for other developers/owners has not identified similar concerns. The City has been transparent about the ongoing litigation involving the standalone developer/owner responsible for maintaining the records and remains committed in resolving this matter and in pursuing additional actions available once the legal proceedings have been concluded. Furthermore, the City contends that the conditions described in 2 CFR 200.511(b)(3) apply and support dismissal of the finding, and therefore no further corrective action should be warranted. The City has not received any directives from the federal awarding agency requiring corrective measures beyond those already implemented. The continued reporting of the finding conflicts with necessary historical practice and reflects the unresolved status of litigation as directed by HUD, and not a failure by the City to take appropriate corrective action.

Finding Number: 2025-002 Finding Title: Internal Controls and Compliance over the Timeliness of Housing Choice Voucher Participant Re-examination and Recertification Compliance Requirement(s): Eligibility, Special Tests – Housing Assistance Payment, Reporting, Allowed and Unallowed Costs Classification: Material Weakness Programs: Section 8 Housing Choice Vouchers (HCV) ALN #: 14.871 Pass-through entity: N/A – Direct Award Federal Agency: Department of Housing and Urban Development (HUD) Federal Award Numbers: Multiple – City receives incremental funding throughout the year Federal Award Year: 2025 Criteria or specific requirement (including statutory, regulatory, or other citation) Allowable Costs Principles ; Activities Allowed and Unallowed; Eligibility (§ 982.201 Eligibility and targeting) (1) The annual income (gross income) of an applicant family is used both for determination of income-eligibility under paragraph (b)(1) of this section and for targeting under paragraph (b)(2)(i) of this section. In determining annual income of an applicant family that includes a person with disabilities, the determination must include the disallowance of increase in annual income as provided in 24 CFR 5.617, if applicable. (2) The applicable income limit for issuance of a voucher when a family is selected for the program is the highest income limit (for the family size) for areas in the PHA jurisdiction. The applicable income limit for admission to the program is the income limit for the area where the family is initially assisted in the program. At admission, the family may only use the voucher to rent a unit in an area where the family is income eligible. The PHA must examine family income and composition at least once every 12 months and adjust the tenant rent and housing assistance payment as necessary using the documentation. The Department of Housing and Urban Development (HUD) has provided a grace period of 2 months before they are reported as late. § 5.657 Section 8 project-based assistance programs: Reexamination of family income and composition. (a) Applicability. This section states requirements for reexamination of family income and composition in the Section 8 project-based assistance programs, except for the moderate rehabilitation and the project based voucher programs. (b) Regular reexamination. The owner must conduct a reexamination and redetermination of family income and composition at least annually. (c) Interim reexaminations. (1) Generally. A family may request an interim reexamination of family income because of any changes since the last examination. The owner must conduct any interim reexamination within a reasonable time after the family request or when the owner becomes aware of an increase in family adjusted income under paragraph (c)(3) of this section. What qualifies as a “reasonable time” may vary based on the amount of time it takes to verify information, but such time generally should not exceed 30 days from the date a family reports changes in income to an owner. (2) Decreases in the family's annual adjusted income. The owner may decline to conduct an interim reexamination of family income if the owner estimates that the family's adjusted income will decrease by an amount that is less than ten percent of the family's annual adjusted income (or a lower amount established by HUD through notice), or such lower threshold established by the owner. (3) Increases in the family's annual adjusted income. The owner must conduct an interim reexamination of family income when the owner becomes aware that the family's adjusted income (as defined in § 5.611) has changed by an amount that the owner estimates will result in an increase of ten percent or more in annual adjusted income or such other amount established by HUD through notice, except. (i) The owner may not consider any increase in the earned income of the family when estimating or calculating whether the family's adjusted income has increased, unless the family has previously received an interim reduction under paragraph (c)(1) of this section during the certification period; and(ii) The owner may choose not to conduct an interim reexamination in the last three months of a certification period. (4) Policies on reporting changes in family income or composition. The owner must adopt policies consistent with this paragraph (c), prescribing when and under what conditions the family must report a change in family income or composition. (5) Effective date of rent changes. (i) If the family has reported a change in family income or composition in a timely manner according to the owner's policies, the owner must provide the family with 30 days advance notice of any rent increase, and such rent increase will be effective the first day of the month beginning after the end of that 30-day notice period. Rent decreases will be effective on the first day of the first month after the date of the actual change leading to the interim reexamination of family income. (ii) If the family has failed to report a change in family income or composition in a timely manner according to the owner's policies, owners must implement any resulting rent increases retroactively to the first of the month following the date of the change leading to the interim reexamination of family income. Any resulting rent decrease must be implemented no later than the first rent period following completion of the reexamination. However, rent decreases may be applied retroactively at the discretion of the owner, in accordance with the owner's conditions as established in written policy, and subject to paragraph (c)(5)(iii) of this section. (iii) A retroactive rent decrease may not be applied by the owner prior to the later of the first of the month following: (A) The date of the change leading to the interim reexamination of family income; or (B) The effective date of the family's most recent previous interim or annual reexamination (or initial examination if that was the family's last examination). Housing Authority of the City of Long Beach HCV Admin Plan Failure to Provide Consent [24 CFR §982.552(b)(3)] PHAs must terminate assistance if any family member fails to sign and submit any consent form that is required for a reexamination. See Chapter 7 for a complete discussion of consent requirements. 12-II.F. TERMINATION NOTICE HUD regulations require PHAs to provide written notice of termination of assistance to a family only when the family is entitled to an Informal Hearing. However, since the family’s HAP Contract and lease will also terminate when the family’s assistance terminates, it is a good business practice to provide written notification to both owner and family any time assistance will terminate, whether voluntarily or involuntarily. PHA Policy Whenever a family’s assistance will be terminated, the PHA will send a written notice of termination to the family and to the owner. The PHA will also send a form HUD-5382 and form HUD-5380 to the family with the termination notice. The notice will state the date on which the termination will become effective. This date generally will be at least 30 calendar days following the date of the termination notice, but exceptions will be made whenever HUD rules, other PHA policies, or the circumstances surrounding the termination require. Housing Assistance Payments (e) Effective date of reexamination. (1) The PHA must adopt policies consistent with this section prescribing how to determine the effective date of a change in the housing assistance payment resulting from an interim redetermination. (2) At the effective date of a regular or interim reexamination, the PHA must make appropriate adjustments in the housing assistance payment in accordance with § 982.505. (f) Accuracy of family income data. The PHA must establish procedures that are appropriate and necessary to assure that income data provided by applicant or participant families is complete and accurate. The PHA will not be considered out of compliance with the requirements in this section solely due to de minimis errors in calculating family income but is still obligated to correct errors once the PHA becomes aware of the errors. A de minimis error is an error where the PHA determination of family income deviates from the correct income determination by no more than $30 per month in monthly adjusted income ($360 in annual adjusted income). § 982.552 PHA denial or termination of assistance for family. (b) Requirement to deny admission or terminate assistance. (3) The PHA must deny admission to the program for an applicant, or terminate program assistance for a participant, if any member of the family fails to sign and submit consent forms for obtaining information in accordance with part 5, subparts B and F of this title. Reporting (24CFR982.516(d)) Family reporting of change. The PHA must adopt policies consistent with this section prescribing when and under what conditions the family must report a change in family income or composition.. 24 CFR Part 908 and 24 CFR section 982.158 The HUD-50058, Family Report (OMB No. 2577- 0083) is required to be submitted by the PHA electronically to HUD each time the PHA completes an issuance, admission, annual reexamination, interim reexamination, portability move-in, expiration, or other change of unit for a family. The PHA must also submit the Family Report when a family ends participation in the program or moves out of the PHA’s jurisdiction under portability. 2 CFR 200 SUBPART D – POST FEDERAL AWARD REQUIREMENTS 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designated to reasonably ensure compliance with Federal laws, regulations and program compliance requirements. Effective internal controls should include procedures to ensure eligibility criteria are met and documented. Condition For 35 of 60 participants tested, the annual re-examination of eligible participants or redetermine family income on an annual basis (12 months). Of these 35 eligible participants noted as not completed in the annual period, 4 were completed within the 2-month grace period, before HUD considers the re-examination late for its purposes. The remaining 31 participants were not subject to reexamination until after 14 months. For one additional participant, the documentation needed to complete the income reexamination was not received by the established deadline. HACLB notified the participant in November 2024 of a March 2025 due date, and on April 22, 2025 issued a request for additional documentation, indicating the information was needed by May 9, 2025. After the documentation was not received, there was an extended gap before further follow-up occurred, and HACLB issued a notice regarding the participant's assistance in March 2026. As a result, the annual reexamination was not completed within the required period. Cause The cause of the late reexaminations was due to the volume of participants within the HCV program in relation to the resources available at HACLB to administer the program. Effect or potential effect Failure to review participant eligibility annually may result in noncompliance with HUD regulations. Furthermore, this lapse can allocate program resources to ineligible participants, leading to unallowable costs. When delays occur in the re-examination process and subsequent adjustments require decreased payments, the housing authority may inadvertently make overpayments during the intervening period. Questioned costs Known questioned costs of $29,566; likely questioned costs of $1,128,681. Questioned costs were determined from a sample of 60 participants during fiscal year 2025. For each sampled participant whose reexamination was completed after its required date and who required a HAP (Housing Assistance Payment) reduction upon reexamination, the difference between the two payment amounts, with applicable program safe harbors incorporated, was multiplied by the number of months the reexamination extended beyond its required date, aggregating to known questioned costs of $29,566. The population used in the projection was then bifurcated, isolating late reexaminations resulting in 1,363 of the 7,226 reexaminations due during the year (18.86%) being identified as completed after their required date. Total HAP payments for the year were multiplied by the percentage of late re-examinations and then by the error rate found in late re-examinations during our testing to project likely questioned costs of approximately $1,128,681, an effective error rate of 0.86% for the programs total HAP. Context HACLB has 75 employees who are responsible for the administration of the programs over 7,800 participants, or over 100 re-examinations per employee. Identification as a repeat finding if applicable 2024-003 Recommendation We recommend the City continue with its plan to address delays in the recertification processes through steps taken to address resource constraints. Views of responsible officials and planned corrective actions The Housing Authority of the City of Long Beach (HACLB) acknowledges the finding regarding the untimely completion of annual reexaminations and recognizes the importance of completing annual recertifications within HUD-required timeframes to ensure program compliance and the accurate administration of housing assistance. The delays identified during the audit period occurred while HACLB was addressing a significant backlog of overdue annual reexaminations that had accumulated over several years due to extended vacancies in critical Housing Specialist positions. Recruitment and hiring efforts took longer than anticipated, resulting in staffing levels that were insufficient to address both ongoing workload demands and the existing backlog. HACLB agrees that certain annual reexaminations were completed beyond HUD’s timeliness requirements and has implemented corrective actions to address the backlog and strengthen compliance. To strengthen program operations, HACLB has hired and trained additional Housing Specialists, implemented the MRI housing management system to improve workflow tracking and case management, enhanced supervisory oversight of overdue annual reexaminations, and continued utilizing contracted support services to assist with processing pending cases. HACLB is also developing a Request for Proposals (RFP) to procure additional specialized support services to further reduce the remaining backlog and help ensure ongoing compliance with HUD timeliness requirements. As a result of these efforts, HACLB has made substantial progress in reducing the backlog, improving operational efficiency, and strengthening internal controls over the tracking and completion of annual reexaminations. Historically, findings related to untimely annual reexaminations have generally been addressed as compliance and performance deficiencies rather than as questioned costs. While the audit identified $29,596 in known questioned costs within the sample, the extrapolated questioned costs are not equivalent to actual overpayments during the year. The sampled questioned costs represent only those delayed annual reexaminations that resulted in a reduction in HAP assistance. Delayed annual reexaminations may also result in no change in assistance, an increase in assistance, or adjustments that are mitigated by applicable HUD requirements. The extrapolation assumes that all delayed annual reexaminations produce overpayments at the same rate observed in the sample, which may not accurately represent program-wide experience. Furthermore, the projection assumes that the reduced HAP amount determined during the eventual annual reexamination would have applied throughout the entire period of delay. However, participant income and household composition frequently change over time. The annual reexamination reflects eligibility at a specific point in time and does not necessarily establish that the same reduced subsidy would have been applicable during each month of the delayed period. HACLB recognizes the importance of timely annual reexaminations and remains committed to maintaining full compliance with HUD requirements.

Finding Number: 2025-003 Finding Title: Internal Controls over Compliance of Reinspection’s to Enforce Housing Quality Standards Compliance Requirement(s): Special Tests – Housing Quality Standards Enforcement Classification: Material Weakness Programs: Section 8 Housing Choice Vouchers ALN #: 14.871 Pass-through entity: N/A – Direct Award Federal Agency: Department of Housing and Urban Development (HUD) Federal Award Numbers: Multiple – City receives incremental funding throughout the year Federal Award Year: 2025 Criteria or specific requirement (including statutory, regulatory, or other citation Part 982—Section 8 Tenant-Based Assistance: Housing Choice Voucher Program 24 CFR 982.54(d)(21) Procedural guidelines and performance standards for conducting required HQS inspections, including: (d) The PHA Administrative Plan must cover all the PHA's local policies for administration of the program, including the PHA's policies on the following subjects (see 24 CFR 983.10 for a list of subjects specific to the project-based voucher (PBV) program that also must be included in the Administrative Plan of a PHA that operates a PBV program): (i) Any deficiency that the Public Housing Authority (PHA) has adopted as a life-threatening deficiency that is not a HUD-required life-threatening deficiency (ii) For PHAs that adopt the initial inspection non-life-threatening deficiency option: a. The PHA's policy on whether the provision will apply to all initial inspections or a portion of initial inspections. b. The PHA's policy on whether the provision will be applied to only some inspections and how the units will be selected. c. The PHA's policy on using withheld HAP funds to repay an owner once the unit is in compliance with HQS. (iii) For PHAs that adopt the alternative inspection provision: a. The PHA's policy on how it will apply the provision to initial and periodic inspections. b. The specific alternative inspection method used by the PHA. c. The specific properties or types of properties where the alternative inspection method will be employed. d. For initial inspections, the maximum amount of time the PHA will withhold HAP if the owner does not correct the HQS deficiencies within the cure period, and the period of time after which the PHA will terminate the HAP contract for the owner's failure to correct the deficiencies, which may not exceed 180 days from the effective date of the HAP contract. (iv) The PHA's policy on charging a reinspection fee to owners. 24 CFR 982.54(d)(22) The PHA's policy on withholding HAP for units that do not meet HQS (see § 982.404(d)(1)) 24 CFR 982.406(e)(5) The PHA may commence housing assistance payments to the owner and make housing assistance payments retroactive to the effective date of the HAP contract only after the unit passes the PHA's HQS inspection. If the unit does not pass the HQS inspection, the PHA may not make housing assistance payments to the owner until all the deficiencies have been corrected. If a deficiency is life- threatening, the owner must correct the deficiency within 24 hours of notification from the PHA. For other deficiencies, the owner must correct the deficiency within no more than 30 calendar days (or any PHA- approved extension) of notification from the PHA. If the owner corrects the deficiencies within the required cure period, the PHA makes the housing assistance payments retroactive to the effective date of the HAP contract. PHA Policy 8-Ii.F. Inspection Results And Reinspection’s For Units Under Hap Contract The City of Long Beach PHA Admin Plan requires that each deficiency is identified in the NPSIRE standards as either life-threatening, severe, moderate, or low. Further indicating that units under HAP contract, must correct for life-threatening deficiencies within 24 hours after notice has been provided and all others must be corrected within 30 days (or a PHA-approved extension) after notice has been provided. Life-threatening deficiencies require notifying both parties by telephone or email immediately while Severe or moderate deficiencies will be provided through a written notification within five business days of the inspection. Both will include specifying who is responsible for correcting the violation and the time frame within which the failure must be corrected. If low deficiencies are identified, these deficiencies will only be noted for informational purposes. The notice will inform the party which caused the deficiencies, whether owner or family, that if life-threatening conditions are not corrected within 24 hours, and non-life-threatening conditions are not corrected within the specified time frame (or any PHA-approved extension), the owner’s HAP will be abated in accordance with PHA policy (Section 8-II.G.) or the family’s assistance will be terminated in accordance with PHA policy (Chapter 12). 2 CFR 200 Subpart D – Post Federal Award Requirements 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designated to reasonably ensure compliance with Federal laws, regulations and program compliance requirements. Effective internal controls should include procedures to ensure eligibility criteria are met and documented. Condition The PHA lacked adequate internal controls to ensure the timely reinspection of all initial inspections required for housing quality standards enforcement. Of the 40 sampled cases, 3 re-inspections did not occur as mandated. Consequently, the re-inspections were not conducted within the timeframes established by PHA policy, which aligns with federal requirements. According to policy, a 30-day period for reinspection begins after notification of inspection results, which must be sent within five days of the initial inspection completion, totaling 35 days resulting in noncompliance with PHA policy 8-II.F and 24 CFR 982.406(e)(5). Testing identified that 2 out of 40 units were classified as Life-Threatening conditions under PHA policy, mandating correction within 24 hours. Despite this requirement, the reinspections conducted exceeded the stipulated 24-hour correction and verification period. Additionally, 1 unit which failed inspections November 14, 2024 and November 15, 2024 were subject to attempts from the PHA to reinspect the unit. After 3 attempts in December 2024 and January 2025 the PHA did not issue the Notice of Intended Action Enforcement of Family Obligation timely in March 2025. The unit is still going through the informal hearing process. Cause The delayed reinspection’s and mistakenly closed inspection were due to constraints on resources and a change in the system utilized by HACLB to administer the program during the year. For the inspections classified as life-threatening, the categorization within the system was incorrect due to mistakes during the data entry process. Effect or potential effect The PHA did not perform necessary procedures to enforce owner and/or family obligations to correct deficiencies, which if unresolved, could lead to abated housing assistance payments and impact the quality of housing for tenants. Questioned costs None Context A sample of 40 required re-inspections related to housing quality standards enforcements over failed initial inspections were tested. These failed inspections, which require items to be corrected before being subjected to re-inspection by the PHA until eventually cleared. 1 re-inspection did not occur and remained open as of the time of this audit. This item related to a failed inspection which occurred in January 2025 is over 15 months past its required re-inspection date. The time period for this initial failed inspection occurred shortly after their implementation of enhanced reinspection scheduling process in December 2024, using its MRI housing software to automatically schedule re-inspections within the 30-day remediation period. The new system has lead to reduced instances of late or missed re-inspections in our testing when compared to the prior year. Identification as a repeat finding if applicable 2024-005 Recommendation In alignment with steps already take by HACLB to strengthen compliance and reduce instances of delayed re-inspections, we recommend HACLB continue refining their controls over the timeliness and completeness of its the housing quality standard enforcement scheduling and monitoring. Continuing with its previous corrective actions in this area, HACLB should enhance staff procedures over the monitoring of the system and related scheduling reports to ensure that every required re-inspection is scheduled and has taken place in compliance with program requirements. Views of responsible officials and planned corrective actions HACLB recognizes the importance of conducting timely re-inspections to ensure compliance with HUD National Standards for the Physical Inspections of Real Estate (NSPIRE) enforcement requirements, formerly known as Housing Quality Standards (HQS). HACLB has reviewed the circumstances surrounding the single delayed reinspection, although attempts were made to reinspect the unit, and has evaluated opportunities to strengthen internal controls over reinspection scheduling and monitoring. Beginning in December 2024, HACLB implemented enhancements to its MRI housing management system to strengthen oversight of inspection enforcement activities by scheduling re-inspections in advance of the required 30-day correction period, reducing the risk of missed or delayed re-inspections. To further strengthen internal controls, HACLB centralized the process for non-compliance. Inspection staff will regularly review open enforcement cases and reports to identify and promptly address any overdue or pending re-inspections. HACLB will also continue providing staff guidance and training regarding re-inspection scheduling, case monitoring, and NSPIRE enforcement requirements. These measures are intended to improve accountability, strengthen monitoring controls, and reduce the risk of missed or delayed re-inspections. HACLB remains committed to continuous improvement and maintaining compliance with HUD requirements governing enforcement.

Finding Number: 2025-004 Finding Title: Internal Controls Over Participants Reexaminations Compliance Requirement(s): Eligibility, Special Tests – HAP Payment Classification: Significant Deficiency Programs: Section 8 Housing Choice Vouchers ALN #: 14.871 Pass-through entity: N/A – Direct Award Federal Agency: Department of Housing and Urban Development (HUD) Federal Award Numbers: Multiple – City receives incremental funding throughout the year Federal Award Year: 2025 Criteria or specific requirement (including statutory, regulatory, or other citation 24 CFR 985.1 Purpose and applicability. PHA's quality control sample means an annual sample of files or records drawn in an unbiased manner and reviewed by an PHA supervisor (or by another qualified person other than the person who performed the original work) to determine if the work documented in the files or records conforms to program requirements. The minimum size of the PHA's quality control sample is as follows: Universe Minimum number of files or records to be sampled 50 or less 5. 51-600 5 plus 1 for each 50 (or part of 50) over 50. 601-2000 16 plus 1 for each 100 (or part of 100) over 600. Over 2000 30 plus 1 for each 200 (or part of 200) over 2000. Where the universe is: the number of admissions in the last year for each of the two quality control samples under the SEMAP indicator at § 985.3(a) Selection from the Waiting List; the number of families assisted for the SEMAP indicators at § 985.3(b) Reasonable Rent, and 985.3(c) Determination of Adjusted Income; the number of units under HAP contract during the last completed PHA fiscal year for the SEMAP indicator at § 985.3(e) HQS Quality Control Inspections; and the number of failed HQS inspections in the last year for the SEMAP indicator at § 985.3(f) HQS Enforcement. § 985.3 Indicators, HUD verification methods and ratings (b) Reasonable rent. (1) This indicator shows whether the PHA has and implements a reasonable written method to determine and document for each unit leased that the rent to owner is reasonable based on current rents for comparable unassisted units: At the time of initial leasing; if there is any increase in the rent to owner; at the HAP contract anniversary if there is a 10 percent decrease in the published fair market rent (FMR) in effect 60 days before the HAP contract anniversary. The PHA's method must take into consideration the location, size, type, quality and age of the units, and the amenities, housing services, and maintenance and utilities provided by the owners in determining comparability and the reasonable rent. (24 CFR 982.4, 24 CFR 982.54(d)(15), 982.158(f)(7), 982.507, and 983.303) (2) HUD verification method: The IA annual audit report covering the PHA fiscal year entered on the SEMAP certification and on-site confirmatory review if performed. (3) Rating: (i) The PHA's SEMAP certification states that: (A) The PHA has a reasonable written method to determine reasonable rent which considers location, size, type, quality and age of the units and the amenities, housing services, and maintenance and utilities provided by the owners; and (B) Based on the PHA's quality control sample of tenant files, the PHA follows its written method to determine reasonable rent and has documented its determination that the rent to owner is reasonable in accordance with §§ 982.507 and 983.303 of this chapter, as applicable for at least 98 percent of units sampled at the time of initial leasing, if there is any increase in the rent to owner, and at the HAP contract anniversary if there is a 10 percent decrease in the published FMR in effect 60 days before the HAP contract anniversary. 20 points. (ii) The PHA's SEMAP certification includes the statements in paragraph (b)(3)(i) of this section, except that the PHA documents its determination of reasonable rent for only 80 to 97 percent of units sampled at initial leasing, if there is any increase in the rent to owner, and at the HAP contract anniversary if there is a 10 percent decrease in the published FMR in effect 60 days before the HAP contract anniversary. 15 points. (iii) The PHA's SEMAP certification does not support the statements in either paragraph (b)(3)(i) or (b)(3)(ii) of this section. 0 points. (c) Determination of adjusted income. (1) This indicator shows whether, at the time of admission and annual reexamination, the PHA verifies and correctly determines adjusted annual income for each assisted family and, where the family is responsible for utilities under the lease, the PHA uses the appropriate utility allowances for the unit leased in determining the gross rent. (24 CFR part 5, subpart F and 24 CFR 982.516) (2) HUD verification method: The IA annual audit report covering the PHA fiscal year entered on the SEMAP certification and on-site confirmatory review if performed. (3) Rating: (i) The PHA's SEMAP certification states that, based on the PHA's quality control sample of tenant files, for at least 90 percent of families: (A) The PHA obtains third party verification, as appropriate, of reported family annual income, the value of assets, expenses related to deductions from annual income, and other factors that affect the determination of adjusted income, and uses the verified information in determining adjusted income, and/or documents tenant files to show why third party verification was not available; (B) The PHA properly attributes and calculates allowances for any medical, child care, and/or disability assistance expenses; and (C) The PHA uses the appropriate utility allowances to determine gross rent for the unit leased. 20 points. (ii) The PHA's SEMAP certification includes the statements in paragraph (c)(3)(i) of this section, except that the PHA obtains and uses independent verification of income, properly attributes allowances, and uses the appropriate utility allowances for only 80 to 89 percent of families. 15 points. (iii) The PHA's SEMAP certification does not support the statements in either paragraph (c)(3)(i) or (c)(3)(ii) of this section. 0 points. CFR 200 SUBPART D – POST FEDERAL AWARD REQUIREMENTS 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designated to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure eligibility criteria are met and documented. Condition HACLB utilizes quality control samples from their SEMAP certification process over files documenting selections from the waiting list and income determinations to ensure compliance with requirements for HAP payments. HUD sets requirements for the minimum number of samples required for these indicators with instructions on the universe (population) to sample from and minimum samples based on that universe. HACLB utilized an incorrect universe for their sampling of the universe for determinations of adjusted income. As a result, quality control samples did not meet minimum requirements set by HUD for SEMAP. Cause HACLB calculated the minimum required quality control sample size for SEMAP Indicator 3 using the universe of rent reasonableness determinations, rather than the number of families assisted, which is the relevant population under SEMAP guidelines. Consequently, the sample-size calculation did not reflect the appropriate population. Effect or potential effect Insufficient controls over the reexamination process could lead to ineligible participants in the program, housing assistance payments that are either incorrect or to ineligible participants, and inaccurate reporting to HUD. Questioned costs None Context It was noted that HACLB calculated the minimum required quality control sample size for SEMAP Indicator 3 based on the universe of rent reasonableness determinations, rather than utilizing the number of families assisted as specified by SEMAP guidelines. As a result, the sample-size calculation did not accurately reflect the appropriate population. During the audit period, HACLB provided assistance to 7,309 families. According to SEMAP quality control sample size requirements, the minimum sample size for Indicator 3 should have been 57 files. However, HACLB used a universe of 2,665 rent reasonableness determinations and subsequently selected 34 files for review. Despite employing an incorrect population for the sample-size calculation, the files reviewed were ultimately drawn from the correct population of assisted families. Identification as a repeat finding if applicable 2024-007 Recommendation We recommend HACLB update policies and procedures to align the selection of quality control samples with federal requirements accordance with federal requirements. Views of responsible officials and planned corrective actions HACLB acknowledges the finding regarding the methodology used to calculate the SEMAP Indicator 3 sample size. To address this finding, HACLB reviewed HUD's SEMAP sampling requirements and will update its sample size worksheet to ensure future quality control sample sizes are calculated using the appropriate population in accordance with federal requirements. Staff responsible for SEMAP reporting and quality control reviews will receive additional guidance, training, and stay updated with regulations to ensure compliance.

SCHEDULE OF FINDINGS AND QUESTIONED COSTS AND CORRECTIVE ACTION PLAN Federal Award Findings and Questioned Costs September 30, 2025 Comment #2025-001 COMPENSATION METHODOLOGY SHOULD BE REVIEWED FOR INCENTIVE PAYMENTS COMMUNITY SERVICES BLOCK GRANT AND LOW INCOME HOME ENERGY ASSISTANCE PROGRAM FAL #93.569 and 93.568 (Questioned Costs - Undetermined) Condition: During our testing of payroll, we reviewed controls over the calculation and recording of payroll per the general ledger. For two selected employees, we compared annual wages for the calendar years 2024 and 2025 to approved wages per the Personnel Action Forms (PAF). We noted that there were significant variances between the annual wages reported on their Forms W-2 and the annual salary amounts documented on their Personnel Action Forms (PAFs). The differences appear to relate to additional wage payments paid during the year. Per discussion with management these funds are based on availability of grant funds and staff performance, and generally provided to all employees. 2 CFR 200.430(f) requires that incentive compensation is allowable only when the overall compensation is reasonable, and payments are made according to an agreement entered into in good faith before services are rendered, or payments follow an established plan that is consistently applied. While incentive payments are allowable, we did not see any evidence of staff or performance evaluations, and the payments seem to be more related to the availability of funds this practice affects the accuracy and reliability of the Agency’s budgeting process. Because incentive payments are not documented, pre-authorized, or tied to a formal plan, management cannot reliably estimate personnel costs during grant budgeting. This increases the risk that budgets submitted to funders do not reflect actual compensation practices, may misstate projected personnel expenditures, and may not comply with the internal control requirements of 2 CFR 200.303, which require effective controls over budgeting, financial management, and compliance with federal award terms. Context: Review of the internal controls related to payroll charges made to LIHEAP, CSBG, and the administrative cost pool in accordance with Government Auditing Standards, COSO, Greenbook, and Uniform Guidance. Criteria: Incentive compensation to employees based on cost reduction, efficient performance, suggestion awards, or safety awards is allowable to the extent that the overall compensation is determined to be reasonable and such costs are paid or accrued according to an agreement entered into in good faith between the recipient or subrecipient and the employees before the services were rendered, or according to an established plan followed by the recipient or subrecipient so consistently as to imply, in effect, an agreement to make such payment. [2 CFR 200.430(f)] The recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). [2 CFR 200.303(a)] Effect: The agency provides incentive-type payments based on available grant funds and general staff performance; however, there is no written incentive policy, no documented performance evaluations, and no consistent method for authorizing or calculating these payments. Cause: Implemented and approved policies governing incentive compensation appear not to have been updated or maintained. Recommendation: We recommend that management establish and document a formal incentive compensation policy that complies with 2 CFR 200.430(a) and the internal control requirements of 2 CFR 200.303. Specifically, the policy should define the criteria for awarding incentive payments, establish a written incentive plan, and document performance evaluations, and reflect compensation arrangement in personnel records, such as the PAF. Alternatively, with increased workflow and activity, an addendum to the PAF based on the contract amendment can be documented and authorized for the contract period based on established policy in lieu of a performance based pay arrangement. The administrative pool should also be reviewed to determine if costs and the rate should increase based on actual trends. Implementing these steps will help ensure that compensation arrangements are allowable, properly authorized, consistently applied, and supported by adequate internal controls, in accordance with 2 CFR 200.430, 2 CFR 200.303, and the COSO/Green Book principles governing payroll authorization and compensation practices. Views of Responsible Officials and Planned Corrective Actions: Management concurs with the recommendation. FACAA updated its Incentive Compensation Policy, which was approved by the Board of Directors, in accordance with 2 CFR 200.430 and 2 CFR 200.303. The policy establishes the methodology for incentive payments, and all incentive payments have been documented and supported by appropriate records to ensure compliance with applicable federal requirements.

2025 – 002 Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: HIV Emergency Relief Project Grants HIV Care Formula Grants ALN: 93.914 93.917 Pass-Through Agency: Texas Department of State Health Services Pass-Through Number(s): N/A Award Number and Period: HIV Emergency Relief Project Grants H89HA00014-34, H89HA00014-35 March 1, 2024 – February 28, 2025, March 1, 2025 – February 28, 2026 HIV Care Formula Grants HHS001122200003 April 1, 2022 – March 31, 2026 Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Section III – Findings and Questioned Costs – Major Federal Programs (Continued) 2025 – 002 Subrecipient Monitoring – Missing Contract Elements (Continued) Criteria or specific requirement: Per 2 CFR 200.303(a), Dallas County must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), federal award identification number (FAIN), federal award date of award to the recipient by the granting agency, and the name of federal awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: HIV Emergency Relief Project Grants – The UEI was not included in any of the five subaward agreements selected for testing. The start and end dates for the agreements were March 1, 2024 – February 28, 2025. HIV Care Formula Grants – The UEI, FAIN, federal award date of award to the recipient by the granting agency, and the name of federal awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity were not included in any of the five subaward agreements selected for testing. The start and end dates for the agreements were March 1, 2024 – February 28, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR 200 §200.332 prior to execution is not at the correct precision level. Effect: As required subaward information was left out of contracts, Dallas County increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing contract elements may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) 2025 – 002 Subrecipient Monitoring – Missing Contract Elements (Continued) Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: See corrective action plan.

2025 – 003 Eligibility Federal Agency: Department of Housing and Urban Development Federal Program Title: Housing Voucher Cluster ALN: 14.871 14.879 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: October 1, 2024 – September 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Dallas County must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 24 CFR 5.233, Dallas County must use HUD's Enterprise Income Verification (EIV) system in its entirety: • As a third-party source to verify tenant employment and income information during annual and streamlined reexaminations of family composition and income, in accordance with 24 CFR 5.236 and administrative guidance issued by HUD; and • To reduce administrative and subsidy payment errors in accordance with HUD administrative guidance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) 2025 – 003 Eligibility (Continued) Condition: Audit procedures included a review of 40 participants. For three of 40, the EIV system was not used to verify tenant employment and income information during interim and annual reexaminations. Questioned costs: None. Context: See “Condition.” Cause: The issue appears to be due to inadequate internal controls, including lack of formalized procedures, insufficient staff training, and/or lack of supervisory review to ensure consistent use of the EIV system. Effect: Failure to utilize the EIV system constitutes noncompliance with federal regulations and HUD administrative guidance. The system provides independent, third-party income data that is critical for accurate verification. Without its use, Dallas County must rely more heavily on tenant self-certifications and third-party verifications, which may be incomplete or delayed. As a result, income may be either underreported or overreported, leading to inaccurate rent determinations. This can result in financial losses to the program or tenant grievances due to overcharges. Repeat Finding: No Recommendation: Dallas County should strengthen internal controls to ensure full compliance with HUD requirements by utilizing the EIV system in all required reexaminations. Specifically, the County should: • Develop and implement formal policies mandating EIV use • Provide staff training on proper EIV procedures and discrepancy resolution • Establish supervisory review controls to ensure EIV reports are obtained, reviewed, and retained • Conduct periodic internal monitoring to ensure ongoing compliance Views of responsible officials: See corrective action plan.

2025 – 004 Special Tests and Provisions: National Standards for the Physical Inspection of Real Estate (NSPIRE) / Housing Quality Standards Inspections Federal Agency: Department of Housing and Urban Development Federal Program Title: Housing Voucher Cluster ALN: 14.871 14.879 Section III – Findings and Questioned Costs – Major Federal Programs (Continued) 2025 – 004 Special Tests and Provisions: National Standards for the Physical Inspection of Real Estate (NSPIRE) / Housing Quality Standards Inspections (Continued) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: October 1, 2024 – September 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Dallas County must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 24 CFR § 982.405(a) requires Dallas County to inspect each unit leased to a family prior to the commencement of the initial lease term to ensure the unit meets Housing Quality Standards (HQS). Additionally, the Dallas County Housing Choice Voucher Program (HCVP) Administrative Plan requires that inspections be conducted as promptly as possible, but no later than 15 business days after the unit’s ready date. 24 CFR § 982.405(b) requires Dallas County to inspect each unit at least biennially during the period of assisted occupancy to ensure the unit continues to meet HQS. Condition: Audit procedures included review of 40 rental unit inspections resulting in the following: • For one sampled unit, the initial inspection was not completed within 15 business days after the unit’s ready date. • For two sampled units, the most recent inspection performed during the fiscal year was not completed within two years of the previous inspection. Questioned costs: None. Context: See “Condition.” Cause: The delayed inspections were attributable to staffing shortages among housing inspectors, which created scheduling constraints. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) 2025 – 004 Special Tests and Provisions: National Standards for the Physical Inspection of Real Estate (NSPIRE) / Housing Quality Standards Inspections (Continued) Effect: Late inspections that do not comply with 24 CFR § 982.405(a) and (b), as well as the Dallas County HCVP Administrative Plan, constitute noncompliance with HUD requirements governing HQS. Specifically, units may be occupied or remain under assistance without confirmation that they meet HQS, thereby increasing the risk that families reside in substandard or unsafe housing conditions. Additionally, Housing Assistance Payments (HAP) may be issued for units that have not been timely inspected or verified as compliant, resulting in potentially ineligible or improper payments. Repeat Finding: No Recommendation: Dallas County should strengthen controls over the inspection process to ensure compliance with 24 CFR § 982.405(a) and (b) and the HCVP Administrative Plan. Specifically, Dallas County should: • Address staffing constraints by evaluating current inspector capacity and hiring additional qualified inspectors or utilizing contracted inspection services, as necessary, to meet required timeframes • Implement scheduling and tracking controls to monitor inspection due dates (initial and biennial) and ensure inspections are completed within required timeframes • Establish supervisory review procedures to regularly monitor inspection timeliness and follow up on overdue inspections • Develop or enhance written procedures requiring timely completion of inspections, including escalation protocols for delays • Perform periodic internal quality control reviews to verify compliance with HUD requirements and the Administrative Plan Views of responsible officials: See corrective action plan.

2025 – 005 Special Tests and Provisions – HQS Enforcement Federal Agency: Department of Housing and Urban Development Federal Program Title: Housing Voucher Cluster ALN: 14.871 14.879 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: October 1, 2024 – September 31, 2025 Section III – Findings and Questioned Costs – Major Federal Programs (Continued) 2025 – 005 Special Tests and Provisions – HQS Enforcement (Continued) Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Dallas County must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 24 CFR 982.405(d)(2), when a participant family or government official notifies Dallas County of a potential deficiency, the following conditions apply: Non-Life-Threatening. If the reported deficiency is non-life-threatening, Dallas County must, within 15 days of notification, both inspect the unit and notify the owner if the deficiency is confirmed. The owner must then make the repairs within 30 days of notification from Dallas County or within any approved extension. Condition: Audit procedures included a review of 40 inspections (failed). For 20 out of 40 selected, the owner of the rental unit failed to make the repairs within 30 days of notification from Dallas County. Questioned costs: None. Context: See “Condition.” Cause: Dallas County’s automated system appears to have limitations to flag upcoming or overdue repair deadlines which may result in missed enforcement actions or delayed responses by program staff. In addition, the County has been experiencing staff shortages among inspectors which is limiting Dallas County’s ability to timely track, verify, and enforce repair deadlines, leading to delays in ensuring compliance. Effect: As a result of system limitations and staffing shortages, Dallas County did not timely enforce repair deadlines, leading to noncompliance with federal HQS requirements, increased risk of potential payment of housing assistance for noncompliant units, increased risk to tenant health and safety, and weakened internal controls over program compliance. Repeat Finding: No Recommendation: Dallas County should enhance its internal control processes by improving automated tracking of repair deadlines, strengthening enforcement procedures, addressing staffing limitations, and implementing supervisory review to ensure timely correction of HQS deficiencies and compliance with federal requirements. Views of responsible officials: See corrective action plan.

Finding 2025-001- Allowable Activities/Costs and Period of Performance Significant Deficiency in Internal Control over Compliance Federal Assistance Listing Number: 97.036 – COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Identification Number: 4528DR-MS (2020) Federal Agency: U.S. Department of Homeland Security Pass-through Entity: Mississippi Emergency Management Agency Criteria: Per 2 CFR 200.430(i), personnel costs charged to federal grants are required to be supported by documentation including time records. Per 2 CFR 200.303, a non-federal entity must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and terms and conditions of the Federal award. Condition: Our audit procedures over contracted personnel services disclosed that timesheets supporting the invoices from independent contractors were not reviewed and approved by a supervisor at the Hospital. Cause: The absence of proper approval for the timesheets tested appears to be lack of management oversight. Effect: Since the timesheet is the support for the invoices charged by the independent contractors, unauthorized charges can result from undocumented reviews and approvals. Questioned Costs: No questioned costs were identified due to finding only being a deficiency in internal control with no noncompliance. Perspective: Four timesheets in a sample of fifty-nine timesheets were not approved by management. The sample was not a statistically valid sample. Repeat Finding: This is not a repeat finding. Recommendation: We recommend the Hospital enforce their policy requiring supervisory review and approval for timesheets to ensure time recorded by independent contractors is valid and accurate for work performed. View of Responsible Officials: See management’s response to the finding in the accompanying Corrective Action Plan.

Finding 2025-002 Agency: U.S. Department of Health and Human Services (CSBG) Program: Community Service Block Grant (AL No. 93.569) Significant Deficiency and Noncompliance over Eligibility Repeat Finding: No Condition: During our testing of participant eligibility for the CSBG program, we noted the following exceptions out of a sample size of 40: (1) for one participant, the CSBG eligibility form was not signed by the case manager; and (2) for two participants, we were unable to obtain documentation to support proof of residence. Criteria: As provided in 2 CFR section 200.303: An entity must establish internal controls to ensure compliance with federal statutes and program requirements, including eligibility. Additionally, 2 CFR section 200.403 requires that costs must be adequately documented to be allowable. Cause: The Organization did not follow its policies and procedures to ensure all eligibility documents are properly completed, authorized, and retained. Effect: The Organization was unable to provide adequate documentation that eligibility criteria were met prior to providing services. Questioned Costs: Unknown Recommendation: We recommend that management strengthen internal controls over eligibility determination and documentation to ensure compliance with federal program requirements. Management should establish procedures to require complete and signed eligibility forms prior to approving or providing program benefits and consider implementing a standardized eligibility checklist to ensure all required supporting documentation (e.g., income verification, residency, other criteria) is obtained and retained. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the schedule of corrective action plans.

Finding Number: 2025-001 Prior Year Finding Number: 2024-002 Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/ Department of Health Care Finance (DHCF) DC Access System (DCAS) Program Management Administration Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 272.10(a), “All State agencies are required to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP.” Per 7 CFR Section 272.10(b), “In order to meet the requirements of the Act and ensure the efficient and effective administration of the program, a SNAP system, at a minimum, shall be automated in each of the following program areas (1) Certification and (2) Issuance Reconciliation and Reporting. Under Certification – States agencies must determine eligibility and calculate benefits or validate the eligibility worker’s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members’ names, addresses, dates of birth, social security numbers, individual household members’ earned and unearned income by source, deductions, resources and household size). Also, State agencies must redetermine or revalidate eligibility and benefits based on notices of change in households’ circumstances.” Condition – The District is self-reporting findings it noted from its ongoing efforts to resolve issues with the ADP system for SNAP. The issues identified and the estimated impact follows: 1. Failure to Send Correct and Timely Notices to SNAP Households - Notices pertaining to SNAP eligibility contain incorrect information, and/or SNAP applicants and recipients fail to receive proper notices. For example, in the Federal Fiscal Year (FFY) 2018 Local Program Access Review (PAR), Food and Nutrition Service (FNS) cited that SNAP applicants did not receive a Notice of Eligibility or notice contained incorrect information, no notice of required verification, and the notice of adverse action was incorrect. 2. Untimely Processing of SNAP Applications and Periodic Reports - On October 23, 2017, FNS advised DHS that its application processing timeliness (APT) rate between October 2016 and March 2017 was 88.45%, which triggered corrective action per FNS policy. Moreover, between that last APT report and now, DHS has disclosed that it has experienced processing backlogs of varying severity and persistence to FNS via ongoing communications and as part of waiver requests. DHS also provided a report to FNS in August 2022 that indicated significant application processing backlogs. 3. Establishment of Duplicate Accounts - DHS discovered that duplicate Product Delivery Cases (PDC) were being created in DCAS. One PDC was active and the other closed, but the closed PDC was still receiving benefits. 4. Issuance of Duplicate Payment - As a result of duplicate accounts in Deficiency 3, duplicate payments may have been issued to the same household when a caseworker reactivated a closed case. There is also a possibility that customers who received duplicate electronic benefits transfer (EBT) cards from different EBT vendors may have received duplicate payments. 5. Failure to Implement Computer Matching System - Based on the FFY18 Program Integrity Management Evaluation (ME) review, DHS failed to process Prisoner Verification System (PVS) matches, deceased matches, and National Directory of New Hires (NDNH) matches in accordance with federal requirements. 6. Failure to Produce System Computations to Support Recipient Claims - DCAS does not have the ability to calculate overpayments or send a demand letter. FNS correspondence letters dated October 18, 2017, and September 20, 2018, advised DHS to suspend the establishment of DCAS claims but allowed DHS to continue servicing ACEDS claims. 7. Treasury Offset Program (TOP) Reporting and Maintenance Decertified - FNS conducted a TOP Technical Review in June 2021 and DHS was decertified from TOP due to the following: • Referral of customers to TOP that are undergoing recoupment. • Incorrect determination of the date of delinquency. • Incorrect debt balance and debt status in TOP. 8. Failure to Initiate Recoupment on Active Households - When DCAS launched in October 2016, more than 3,000 claim cases with outstanding balances originating from SNAP overpayments were converted from ACEDS to DCAS. Some claims were not properly converted or activated in DCAS. As a result, DHS failed to take the required recovery actions, including TOP recovery or activation of the recoupment process through EBT cards. 9. Recipient and Benefit Integrity Report Update Required - DHS must provide an update on the target completion dates for system generation of all SNAP-related reports currently being created through manual intervention. The plan must include the procedures for reviewing and ensuring the accuracy of the data being submitted to Food Programs Reporting System (FPRS) with particular emphasis on the FNS-209 and the FNS-366B reports. DHS experienced some technical challenges in processing and retrieving claim and recoupment information accurately since the launch of DCAS in October 2016, which affected the FNS-209 quarterly reports. The Payment and Collections Division (PCD) and the DCAS report development team have made concerted efforts to improve the ability to generate data for the reports but continue to have difficulties in verifying the accuracy of data due in part to the laborious manual processes involved. Based on the FFY 2018 Program Integrity ME review, lines 3b, 10, and 14 of the FNS-209 failed to reconcile with the detailed documentation. 10. Work Requirements Have Not Been Properly Implemented - DHS is not in compliance with the requirement to accurately report on the FNS 583. DHS is unprepared to implement the work requirement and time limit for able-bodied adults without dependents when the current suspension mandated by the Families First Coronavirus Response Act ends and/or its waiver ends. Additionally, the District is not prepared to apply the Able-Bodied Adults Without Dependents (ABAWD) time limits when their ABAWD waiver expires. 11. Failure to Analyze Client Complaints and Include in the State’s Corrective Action Plans (CAP) Where Appropriate - DHS is failing to analyze client complaints and include in the State’s CAP where appropriate, per 7 CFR 271.6(a)(3) and 275.16. 12. The SNAP Application Does Not Clearly Explain Which Questions Are Required for SNAP - FNS reviewers found that the District’s SNAP application does not provide clear directions about which questions are required for SNAP, versus Cash or Medical Assistance. For example, Step 5 of the application asks “Does anyone in your household (including non-applicants) have any income? Yes – complete below; No – skip to step 6 (Complete if you are applying for Food, Medical, or Cash Assistance).” The directions are confusing and may be difficult to understand. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements resulting from a system implementation. Effect – Without an effectively designed and operated system in place, ineligible beneficiaries may receive benefits under the SNAP grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Inaccurate beneficiary allotment payments could result in participants receiving benefits that they are not entitled to receive under the program. Cause – DHS did not effectively design and operate the ADP system for SNAP which resulted to inaccurate benefit payments. Recommendation – We recommend that DHS continue to evaluate and improve the new ADP system for SNAP to ensure that it addresses all the administration requirements of the SNAP program. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS and DHCF DCAS team agree with the findings noted in this report. DHS self-reported these findings as part of the agency’s ongoing effort to maintain integrity with all eligibility determinations. The root cause of each of the twelve (12) case issues with the ADP system for SNAP varied. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-002 Prior Year Finding Number: 2024-003 Compliance Requirement: Special Tests and Provisions – EBT Card Security Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/ Office of the Chief Financial Officer/Office of Finance and Treasury (OCFO/OFT) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 274.8(b)(3), As an addition to or component of the Security Program required of Automated Data Processing (ADP) systems, the State agency shall ensure that the following electronic benefits transfer (EBT) security requirements are established: (i) Storage and control measures to control blank unissued EBT cards and PINs, and unused or spare POS devices; (ii) Measures to ensure communication access control. Communication controls shall include the transmission of transaction data and issuance information from POS terminals to work-stations and terminals at the data processing center; (iii) Message validation; (iv) Administrative and operational procedures; (v) A separate EBT security component shall be incorporated into the State agency Security Program for ADP systems. The periodic risk analyses required by the Security Program shall address the following items specific to an EBT system – (B) Completeness and timeliness of the reconciliation system; and (vi) The State agency shall incorporate the contingency plan approved by FNS into the Security Program. Condition – OCFO/OFT for DHS are required to maintain adequate security over, and documentation/records for EBT cards, to prevent their theft, embezzlement, loss damage, destruction, unauthorized transfer, negotiation, or use. OCFO/OFT have contracted with Fidelity National Information Service (FIS) for the issuance and security of the EBT cards; however, it is OCFO/OFT’s ultimate responsibility to ensure the contractor has controls in place to maintain adequate security over, and documentation/records of EBT cards in accordance with 7 CFR Section 274.8(b)(3). During our tests of the design and implementation of internal controls and compliance requirements in accordance with 7 CFR Section 274.8(b)(3), we noted the following issues: • For sixteen (16) out of the sixty (60) samples, out of a population of 496 days from two EBT card centers, although both EBT Balance Sheets reconciled with the EBT Card Issuance Logs included in the package, we noted the following deficiencies: o For eleven (11) out of the samples, we noted various issues including (a) the ID type for identification purposes was missing or incorrect, (b) the customer case number was missing, (c) the Photo ID Program Referral Form was missing, (d) the identification type was noted as referral on the EBT Intake Form, but no referral form was attached, (e) the UPO EBT Center Intake Form was not signed by staff who created the card, and (f) the EBT Card Referral Form for the EBT Summer Program was missing the eligibility staff name and signature verification although e-signed by the supervisor. o For five (5) out of the samples, we noted various issues including (a) illegible information on the UPO EBT Training Center Intake Form, (b) the customer name on the UPO EBT Training Center Intake Form did not agree with the name on the EBT Card Issuance Log and a nominee name was not indicated (we were therefore unable to trace and agree the beneficiary names on the UPO EBT Center Intake Forms in the reconciliation package to the EBT Card Issuance Log for (a) or (b)), (c) summary reconciliation sheet (an EBT Balance Sheet) was prepared and agreed to the EBT Card Issuance Log for the day selected for each workstation but the EBT Card Issuance Log was only initialed by the CPS and none initialed by the Witness, and (d) the EBT Card Issuance Log had incorrect page numbers and at least one customer documented on different page and line numbers when we compared the EBT Card Issuance Log to the UPO EBT Training Center Intake Form. • In addition, for one (1) out of the sixty (60) samples, we noted that the information on the summary reconciliation sheet did not agree to the Card Issuance Log. The summary reconciliation sheet shows 121 cards issued while the Card Issuance Log shows a total of 111 cards issued. These exceptions resulted in the Agency not being in compliance with 7 CFR Section 274.8(b)(3). Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without adequate internal controls to ensure compliance with EBT Card Security requirements, there is an increased risk that the inventory of EBT cards will not be properly maintained and accounted for, or that the program will not be in compliance with program requirements. Cause – OCFO/OFT for DHS does not have adequate policies and procedures in place to ensure adequate safeguarding, documentation over issuance and monitoring of EBT cards. Recommendation - We recommend that OCFO/OFT for DHS strengthen formal policies and procedures to maintain adequate security over, and documentation/records for EBT Cards. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The OCFO/OFT for DHS concurs with this finding. The process to manage card distribution is supported by established policies and procedures documented within the EBT Program Manual. While these controls have been formalized, recent audit results indicate that opportunities for improvement remain, particularly in consistent adherence to defined processes. Accordingly, the focus for the current period is on strengthening compliance with existing policy and procedures rather than further policy development. Emphasis will be placed on reinforcing expectations, enhancing oversight, and ensuring accountability for adherence among staff. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-003 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Agriculture Child Nutrition Cluster ALN: 10.553, 10.555, 10.559 and 10.582 Award #: 11131-028 Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Office of the State Superintendent of Education (OSSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal Funding Accountability and Transparency Act (FFATA) Reporting Compliance: In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. FFATA reports are submitted no later than the month following the month in which this Federal award is made, and annually after that. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, 2 CFR Section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – For one (1) subaward sample selected for FFATA testing, we noted that OSSE failed to submit the FFATA report within the required timeframe. Transactions tested - 8 Subaward not reported - 0 Report not timely - 1 Subaward amount incorrect - Not applicable – subaward amount was correct. Subaward missing key elements - Not applicable – no missing key elements. Dollar amount of tested 2025 subawards - $8,900,559 Subaward not reported - $ - Report not timely - $ 38,487 Subaward amount incorrect - Not applicable – subaward amount was correct. Subaward missing key elements - Not applicable – no missing key elements. Additionally, during our testing of the SEFA, we noted that OSSE incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2025, OSSE incurred $25.7 million in subrecipient expenditures for this program and incorrectly reported that there were no subrecipient expenditures on the preliminary SEFA. While the subrecipient expenditure amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of OSSE’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report and failure to properly review and present expenditure can result in noncompliance with reporting requirements. Cause – OSSE did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. In addition, OCFO did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that OSSE evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report to be submitted timely. In addition, we recommend that OCFO adhere to instituted policies and procedures to ensure accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – OSSE concurs with the auditor’s finding and recommendations related to this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-004 Prior Year Finding Number: N/A Compliance Requirement: Cash Management; Reporting Program: U.S. Department of Defense National Guard Military Operations and Maintenance (O&M) Projects ALN: 12.401 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: District of Columbia National Guard (DCNG) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Uniform Guidance at 2 CFR Section 200.305 requires payment methods to align with actual, immediate cash requirements and support allowability of costs. Additionally, 2 CFR Section 200.305(b) requires non-Federal entities to minimize the time elapsing between the transfer of funds from the Federal government and the disbursement of those funds for program purposes. 2 CFR Section 200.302(b)(6) requires financial management systems to provide accurate, current, and complete disclosure of financial results, including proper recording of cash transactions. When entities are funded on a reimbursement basis, program costs must be incurred prior to the date of the reimbursement request (2 CFR Section 200.305(b)(3)). Federal awarding agency regulations and grant award terms require recipients to submit the Request for Advance or Reimbursement (SF-270) timely to support reimbursement requests and proper cash management under the award. Condition – BDO selected four (4) out of twelve (12) months for cash management testing and identified a total of 44 drawdowns within the sampled period. The following findings were noted during testing: • Twenty-four (24) out of forty-four (44) sampled drawdowns were not submitted on a timely or regular basis, occurring beyond the grant period and inconsistent with prescribed monthly timelines. • In three (3) out of forty-four (44) instances, no drawdowns were submitted for the Facility Sustainment Restoration Modernization project (main Federal grant), indicating incomplete initiation of reimbursement requests. • In twenty-three (23) out of forty-four (44) instances, no evidence of submission of reimbursement requests (SF-270) to the Federal officers was available, and forms lacked DCNG Director approval. In addition, in 2 instances (out of 3 noted), although DCNG Director approval existed, no evidence of submission was available. • In three (3) instances, amounts in billing authorization did not match the amounts requested on SF-270, indicating lack of reconciliation control. • In one (1) instance, a grant award was excluded from the billing authorization worksheet, but a corresponding SF-270 existed, which was neither Director-approved nor supported by submission evidence, indicating drawdowns processed outside the established authorization framework. • Evidence of cash receipt was available for only six (6) out of forty-four (44) instances; for the remaining instances, no supporting documentation was provided, and funds were reportedly not received. Questioned Costs – Not determinable. Context – These deficiencies were identified during testing of forty-four (44) cash drawdown and reimbursement transactions performed as part of the audit of internal control over compliance and compliance with Federal cash management requirements. Effect – The identified deficiencies result in noncompliance with Federal cash management requirements and increase the risk of delayed reimbursements. They also create a heightened risk of unsupported, inaccurate, or unauthorized drawdowns being processed. Furthermore, the lack of adequate documentation and controls over cash receipts and grant activity weakens tracking mechanisms, thereby impacting the reliability and accuracy of financial reporting. Cause – These issues are primarily due to a lack of adherence to established controls over the review and approval of drawdowns, along with inadequate monitoring of timelines and completeness across grants. Additionally, the absence of effective reconciliation controls between billing authorizations, SF-270 forms, and cash receipts contributes to inconsistencies. Weak implementation of approval workflows and insufficient documentation retention practices further exacerbate the control deficiencies. Recommendation – We recommend that DCNG strengthen internal controls over Federal reporting compliance by: • Establishing and enforcing a formal drawdown schedule aligned with actual cash needs. • Ensuring all eligible expenditures are included in billing authorizations and drawdowns. • Requiring documented supervisory review and certification of SF-270 prior to submission. • Strengthening approval workflows (e.g., BOX routing) with complete audit trails. • Performing routine reconciliations between billing authorizations, drawdowns, and recorded receipts. • Implementing procedures to track and document receipt of funds for all submitted drawdowns. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DC Government Operations concurs with this finding and acknowledges the deficiencies identified during the audit period. We want to provide important operational context that speaks to the shared nature of the SF-270 drawdown process and how corrective actions will be distributed across responsible parties. The SF-270 reimbursement cycle is a multi-agency process. The Office of the Chief Financial Officer is responsible for generating the drawdown reports that serve as the prerequisite data source for DC Government Operations’ Grants Management Specialist to develop and route SF-270 forms for Director approval and submission to the Grants Officer Representative and U.S. Property and Fiscal Officer. Deficiencies identified in this finding reflect breakdowns at multiple points across that workflow. The corrective action plan assigns responsibility accordingly and includes a designated section for OCFO’s response. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-005 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Defense National Guard Military Operations and Maintenance (O&M) Projects ALN: 12.401 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: District of Columbia National Guard (DCNG) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, 2 CFR Section 200.302(a) requires that the financial management system of each non-Federal entity be sufficient to permit the preparation and timely submission of required financial reports, including those required by program-specific terms and conditions. Federal awarding agency regulations and the terms of the award require recipients to accurately prepare and timely submit required financial reports, including the Federal Financial Report (SF-425). Condition – Management did not submit the annually required SF-425 Federal Financial Report for the National Guard Military Operations and Maintenance (O&M) Projects grant within the reporting periods required by the terms and conditions of the award. Questioned Costs – Not determinable. Context – This deficiency was identified during the audit as part of our review of DCNG’s internal control over compliance and compliance with Federal reporting requirements, including the submission of required financial reports under the program. Effect – Failure to properly review and present expenditures can result in noncompliance with Federal reporting requirements. Cause – DCNG did not adhere to established policies and procedures designed to ensure the timely preparation, supervisory review, and submission of required Federal financial reports. Specifically, controls to monitor reporting deadlines and ensure accountability for report submission were not operating as designed. Recommendation – We recommend that DCNG strengthen internal controls over Federal reporting compliance by: • Assigning responsibility for the preparation and submission of all required Federal reports. • Ensuring required reports, including the SF-425, are reviewed and submitted timely in accordance with grant requirements. • Implementing documented supervisory review procedures and a formal reporting calendar to monitor compliance with reporting deadlines. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DC Government Operations concurs with the finding. We acknowledge that the SF-425 Federal Financial Report is required and that it was not completed. While we do not contest the finding, we offer the following context. The Capital Guardian Youth ChalleNGe Academy (Appendix 4001) agreement has been subject to multiple formal inspections and audits conducted by the National Guard Bureau, the federal oversight authority for DC Government Operations’ thirteen appendices. These inspections were comprehensive and detailed, including a review of grant compliance and financial management practices. At no point during any of these reviews did the National Guard Bureau, the Grants Officer Representative, or the U.S. Property and Fiscal Officer identify SF-425 submission as a deficiency, issue a recommendation for corrective action, or communicate to DC Government Operations that this report was an outstanding requirement under the award. This context does not change the compliance obligation. It is offered because it directly informs the corrective actions below, which are designed to ensure this requirement is memorialized in our internal controls and reporting calendar rather than dependent on external notifications from our federal partners. DC Government Operations is committed to full compliance going forward and has developed corrective action plan in coordination with the Office of the Chief Financial Officer. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-006 Prior Year Finding Number: 2024-009 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: Office of the Deputy Mayor for Planning and Economic Development (DMPED) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.403, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented.” In addition, the U.S. Department of Treasury, Guidance for the Coronavirus Capital Projects Fund For States, Territories & Freely Associated States (CPF), Section D. Eligible and Ineligible Cost: states that “Allowable costs are determined in accordance with the cost principles identified in 2 CFR Part 200, Subpart E. Federal funds committed to an award may only be used to cover allowable costs incurred during the period of performance and for allowable closeout costs incurred during the grant closeout process. Cost sharing is not a requirement for the use of these funds” Section C. Project Eligibility: also states the following, “Capital Project or Project means the construction, purchase, and installation of, and/or improvements to capital assets where the costs of such assets are capitalized or depreciated, including ancillary costs necessary to put the capital asset to use. Examples of capital assets include buildings, towers, digital devices and equipment, fiber-optic lines, and broadband networks. Examples of ancillary costs include project costs related to project planning and feasibility, broadband installation, and community engagement, broadband adoption, digital literacy, and training associated with a planned or completed Project funded by the Capital Projects Fund program.” Condition – During our examination of Activities Allowed or Unallowed and Allowable Costs/Cost Principles, we observed that the agency used federal funds to reimburse their subrecipient for $4,100,000 in improvement allowances paid to subtenants at the Max Robinson Center facility in connection with their leases of the space. The subtenant improvement allowances do not appear to align with the definition of ancillary costs as outlined by the CPF guidance mentioned earlier, which describes ancillary costs as project costs related to project planning and feasibility, community engagement, and training associated with a planned or completed Project. BDO deemed this a recurrence of the same substantive issue identified in prior year Finding 2024-009 where the agency charged rent payments to the program reported as ancillary costs, which was identified as questioned cost and was later on disallowed by Treasury in its management decision letter dated December 22, 2025. The prior-year rent payments and the current-year subtenant improvement allowances are both lease and occupancy-related costs charged to the program intended to fund capital project costs, both of which do not appear to meet the definition of ancillary cost. Additionally, the U.S. Department of the Treasury issued an Information Document Request (IDR) that included a request for a detailed explanation of the $4,100,000 in ancillary costs charged to the program. On May 28, 2026, Treasury notified the agency that the IDR was closed based on the agency’s response, however, did not include an affirmative determination that the $4,100,000 in subtenant improvement allowances are allowable as charged under the program. Further response from Treasury on June 1, 2026, noted “no additional questions or concerns about these issues” with regards the Agency asking for Treasury to approve the $4,100,000 to be used as ancillary costs. This further response from Treasury does not give an affirmative determination regarding the allowability of the subtenant improvement allowances charged to the program. Based on the procedures performed and review of relevant guidance, BDO notes that these costs do not meet the requirements to be considered allowable under the program. Questioned Costs – Known amount $4,100,000. Context – This is a condition identified per review of DMPED’s compliance with specified requirements using a statistically valid sample. Total subrecipient expenditures reported as allowable costs were $8,100,000. Effect – DMPED was unable to demonstrate that the subtenant improvement allowance charged was approved by the Department of Treasury and was an allowable cost under the guidance. Cause – DMPED did not have proper internal controls and policies and procedures in place to identify allowable costs and activities. Recommendation – We recommend that DMPED evaluate its procedures to ensure only allowable expenses are charged to the program as required under 2 CFR Section 200.403. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DMPED does not concur with the auditor’s finding regarding the allowability of subtenant improvement allowance per the CPF guidance. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section. BDO’s Response – We have reviewed management’s response, and our finding remains as indicated.

Finding Number: 2025-007 Prior Year Finding Number: N/A Compliance Requirement: Procurement and Suspension and Debarment Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: Department of General Services (DGS), on behalf of the Department of Parks and Recreation (DPR) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Section 180.300, Suspension and Debarment, non-federal entities cannot enter into awards, subawards, or contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Non-federal entities must either check for exclusions in the System for Award Management (SAM); collect a certification from the entity, or add a clause or condition to the covered transaction with the entity prior to entering into a covered transaction with a non-federal entity. In addition, in accordance with 2 CFR Section 180.415(b), non-federal entities cannot renew or extend covered transactions (other than no-cost time extension) with any excluded person, or under which an excluded person is a principal, unless the non-federal entity obtains an exception under 2 CFR Section 180.135. Condition – During our testing of procurement and suspension and debarment requirements, we examined seven (7) procurement contracts, valued at $24,796,728, out of a total population of eleven (11), valued at $25,329,758. We noted that DGS did not maintain documentation evidencing the suspension and debarment check for two (2) separate procurement contracts, valued at $97,508, involving the same contractor, hence, performance of the required suspension and debarment check could not be verified. Questioned Costs – Not determinable. Context – DPR owns and maintains budget authority over the project property, while DGS is responsible for managing construction and conducting all procurement activities for the project on DPR’s behalf. As such, DGS performs all required suspension and debarment checks for the project’s procurement transactions. This is a condition identified per review of DGS’s compliance, on behalf of DPR, with the specified procurement and suspension and debarment requirements using a statistically valid sample. Effect – Failure to adhere to the procurement procedures specified in the Uniform Administrative Requirements may lead to the Federal agency disallowing the procurement and associated costs. Cause – DGS did not maintain documentation of the suspension and debarment check as required by 2 CFR Section 180.300 and 2 CFR Section 200.318(i) listed above, preventing verification that the required check was performed prior to accepting the contractor. Recommendation – We recommend that management ensure consistent adherence to federal procurement requirements (2 CFR Section 180.300 and 2 CFR Section 200.318(i)) to perform the suspension and debarment verification for all covered transactions and to retain documentation evidencing the verification in the procurement file. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DGS and DPR management concur with the finding. DGS acknowledges that documentation of the required suspension and debarment checks was not retained in two procurement files. While the checks were performed, the absence of supporting documentation does not meet federal record-retention standards. DGS and DPR remain committed to full compliance with 2 CFR Section 180.300 and 2 CFR Section 200.318(i) and will strengthen internal controls to ensure complete and consistent documentation of all verification activities. The hard copies of the tax compliance documentation may have been filed in the paper records, which are currently unavailable for review. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-008 Prior Year Finding Number: 2024-011 Compliance Requirement: Reporting Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: Office of the Deputy Mayor for Planning and Economic Development (DMPED) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025, onwards. FFATA reports are submitted no later than the month following the month in which this Federal award is made, and annually after that. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – DMPED had a single subrecipient through which $8.1 million in grant funds was expended. During our audit, we noted that DMPED did not submit the required FFATA report for its subrecipient through the FSRS or the sam.gov website for the one subaward issued in fiscal year 2025. Questioned Costs – None. Context – This is a condition identified per review of DMPED’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report results in noncompliance for the Coronavirus Capital Projects Fund program. Cause – DMPED did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that DMPED evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DMPED concurs with the auditor’s findings and recommendations. DMPED will take steps to ensure full reporting compliance with federal awards. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-009 Prior Year Finding Number: N/A Compliance Requirement: Reporting – Common Origination and Disbursement System Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal Register, Volume 86, Number 119 and 34 CFR 690.83; FSA Handbook, technical references on Common Origination and Disbursement (COD) Reports can be found in the 2024-2025 COD Technical Reference in Volume VI, Section 6 outlines the following compliance requirements for originations records and disbursement records reporting to Common Origination and Disbursement (COD) System: Institutions submit Federal Direct Loan Program, Federal Pell Grant Program, and TEACH Grant origination records and disbursement records to the COD system. Origination records can be sent well in advance of any disbursements, as early as the institution chooses to submit them for any student the institution reasonably believes will be eligible for a payment. An institution follows up with a disbursement record for that student no earlier than (1) seven calendar days prior to the disbursement date under the Advance or Heightened Cash Monitoring 1 payment methods, or (2) the date of the disbursement under the Reimbursement or Heightened Cash Monitoring 2 Payment Method. The disbursement record reports the actual disbursement date and the amount of the disbursement. The U.S. Department of Education (the “ED”) processes origination and/or disbursement records and returns acknowledgments to the institution. The acknowledgments identify the processing status of each record: Rejected, Accepted with Corrections, or Accepted. Institutions must report student disbursement data within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data. Institutions may do this by reporting once every 15 calendar days, bi-weekly or weekly, or may set up their own system to ensure that changes are reported in a timely manner. Key items to test on origination records for the fiscal year are: award amount, enrollment date, verification status code (when the applicant is selected for verification), transaction number, cost of attendance, and the “Academic Start Date” and “Academic End Date”. Key items to test on disbursement records are disbursement date and amount. The information may be accessed by the institution for the auditor. Condition – During our testing, we noted the following issues: • For fourteen (14) of twenty-five (25) COD origination records tested, we identified certain instances in which key items (cost of attendance) for origination records were not correctly reported. • For six (6) of twenty-five (25) COD disbursement records tested, UDC did not report the disbursement to COD within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over COD disbursement and origination reporting from student financial assistance program. Cause – Insufficient internal control and administrative oversight with respect to COD disbursement and origination reporting. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that COD disbursement and origination reporting is performed accurately and timely. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-010 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Notification of Disbursement) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.165(a)(1)(2)(3) outlines the following compliance requirements for award disbursement notifications: (a) Notices. (1) Before an institution disburses title IV, HEA program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans. (2) Except in the case of a post-withdrawal disbursement made in accordance with Section 668.22(a)(5), if an institution credits a student ledger account with Direct Loan, Federal Perkins Loan, or TEACH Grant program funds, the institution must notify the student or parent of— (i) The anticipated date and amount of the disbursement; (ii) The student's or parent's right to cancel all or a portion of that loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Secretary; and (iii) The procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. (3) The institution must provide the notice described in paragraph (a)(2) of this section in writing— (i) No earlier than 30 days before, and no later than 30 days after, crediting the student's ledger account at the institution, if the institution obtains affirmative confirmation from the student under paragraph (a)(6)(i) of this section; or (ii) No earlier than 30 days before, and no later than seven days after, crediting the student's ledger account at the institution, if the institution does not obtain affirmative confirmation from the student under paragraph (a)(6)(i) of this section. Condition – During our testing, we noted the following issues: • For twenty-three (23) of twenty-five (25) Title IV disbursements tested, UDC did not provide evidence of award letter communication to the students of the amount and type of Title IV funds the student could expect to receive, including how and when disbursements would be made, prior to making a disbursement of funds. • For eleven (11) out of twenty-five (25) direct loan disbursements tested, UDC did not send disbursement notification to the students/parents. • For two (2) out of twenty-five (25) direct loan disbursements tested, the disbursement notification sent to the students/parents was not performed within allowable timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over notification of disbursements compliance requirement. Cause – Insufficient administrative oversight with respect to the notification of disbursements compliance requirement. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures surrounding the disbursement of federal student aid to ensure compliance with the notification of disbursements requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-011 Prior Year Finding Number: 2024-012 Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Credit Balances) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.164(c)(3)(i) and (h)(1)(2) outlines the following compliance requirements for Title IV credit balances: (c) Crediting a student’s ledger account. (i) An institution may include in one or more payment periods for the current year, prior year charges of not more than $200 for— (A) Tuition, fees, and institutionally provided room and board, as provided under paragraph (c)(1)(i) of this section, without obtaining the student's or parent's authorization; and (B) Educationally related goods and services provided by the institution, as described in paragraph (c)(1)(ii) of this section, if the institution obtains the student's or parent's authorization under Section 668.165(b). (h) Title IV, Higher Education Act (HEA) credit balances. (1) A title IV, HEA credit balance occurs whenever the amount of title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period as provided under paragraph (c) of this section. (2) A title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than— (i) Fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (ii) Fourteen (14) days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition – During our testing, we noted the following issues: • For six (6) of forty (40) credit balances selected for testing, the credit balance created by the disbursement of Title IV awards was not refunded to the student within the required 14-day timeframe. • For one (1) of forty (40) credit balances selected for testing, a prior year charge in excess of $200 was resolved using federal funds disbursed in current year. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over credit balances from student financial assistance. Cause – Insufficient internal control and administrative oversight with respect to the disbursement of federal awards. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that Title IV credit balances are paid timely to students. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-012 Prior Year Finding Number: 2024-013 Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.173(b)(1) outlines the following compliance requirements for Title IV refunds. (b) Timely return of title IV, Higher Education Act (HEA) program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if— (1) The institution deposits or transfers the funds into the bank account it maintains under Section 668.163 no later than 45 days after the date it determines that the student withdrew. Condition – During our testing, we noted the following exception: • For one (1) of seven (7) students selected for Title IV refund calculation testing, the required Title IV refund was not adjusted in the U.S. Department of Education's Common Origination and Disbursement (COD) system within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not compliant with the Return of Title IV Funds compliance requirements. Cause – Insufficient administrative oversight with respect to Return of Title IV Funds requirements. Recommendation – We recommend that UDC enhance its process surrounding the disbursement of federal student aid to ensure compliance with the Return of Title IV Funds requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-013 Prior Year Finding Number: 2024-014 Compliance Requirement: Special Tests and Provisions – NSLDS Reporting Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Institutions are required to report enrollment information under the Pell grant and the Direct and Federal Family Education Loan (“FFEL”) loan programs via the National Student Loan Data System (“NSLDS”) (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the Student Financial Assistance Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309; Perkins 34 CFR 674.19(f)). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (“NSLDSFAP”) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • Office of Postsecondary Education Identification (OPEID) Number – This is the OPEID for the location that the student is actually attending. • Enrollment Effective Date – The date that the current enrollment status reported for a student was first effective. (See 4.4.2 of the NSLDS Enrollment Reporting Guide for the specific requirements for reporting the Enrollment Effective Date. Also see 4.4.3 of the NSLDS Enrollment Reporting Guide for additional guidance on effective dates for Withdrawal versus Graduation and Electronic Announcement titled – NSLDS Enrollment Reporting – Submission Dates, Effective Dates and Certification Dates, dated April 20, 2017, for additional information and examples at https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2017-04-20/general-subject-nslds¬enrollment-reporting-submission-dates-effective-dates-and-certification-dates.) • Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Certification Date – The Date enrollment certified by institution. At a minimum, institutions are required to certify enrollment every 60 days or every other month. Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • CIP Code – The Classification of Instructional Programs (CIP) is a set of codes that define fields of study. CIP Codes are maintained by ED's National Center for Education Statistics (NCES). They were most recently updated in 2020 and are usually updated every ten years. A listing of current CIP codes is available at: https://nces.ed.gov/ipeds/cipcode/resources.aspx?y=56. • CIP Year – Year for the corresponding CIP code. The CIP Year for the codes currently used by NSLDS is 2020. • Credential Level – Indicates the level of a credential the student will receive for the program the student is attending, for example undergraduate certificate, associate degree, or bachelor’s degree. (See 4.4.7 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting the Credential Level.) • Published Program Length Measurement – The institution identifies whether the Published Program Length is in days, weeks, or years. • Published Program Length - Published Program Length should be reported based on the definition of “normal time” to completion in the regulations at 34 CFR 668.41(a), • Program Begin Date – The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. (See 4.4.8 of the NSLDS Enrollment Reporting Guide for additional guidance.) • Program Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Program Enrollment Effective Date – The date when the student's current program status first took effect. Condition – UDC did not submit an accurate status change notification or failed to submit timely notification to the NSLDS website for certain students who graduated, withdrew or had a change in their enrollment status (full time, half time or less than half time) during the year. BDO selected a random sample of forty (40) students used to evaluate both campus and program level enrollment reporting compliance requirements. For campus level enrollment, we noted the following exceptions: • For five (5) of forty (40) campus level records tested, UDC did not certify the students’ enrollment data within 60 days. • For four (4) of forty (40) campus level records tested, UDC did not accurately report the students’ enrollment effective date. • For three (3) of forty (40) campus level records tested, UDC did not correctly report the students’ enrollment status. For program level enrollment, we noted the following exceptions: • For four (4) of forty (40) program level records tested, UDC did not accurately report the program begin date. • For eleven (11) of forty (40) program level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of forty (40) program level records tested, UDC did not accurately report the students’ enrollment status. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified enrollment requirements using a statistically valid sample. Effect – UDC is not in compliance with enrollment reporting requirements. Failure to promptly report accurate and timely changes in enrollment status may adversely impact the repayment status for student loan borrowers. Cause – Insufficient internal controls and administrative oversight with respect to enrollment reporting requirements. Recommendation – We recommend that UDC enhance its procedures and internal controls over enrollment reporting to ensure that significant data elements under both campus-level and program-level records are reported accurately and timely to NSLDS. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-014 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Immunization Cooperative Agreements ALN: 93.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Health (DC Health) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.403, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented.” Condition – During our testwork over nonpayroll transactions for the Activities Allowed or Unallowed and Allowable Costs/Cost Principles, we noted that for one (1) out of forty-two (42) samples, the transaction was charged twice to the program. Total amount of nonpayroll transactions is $11,925,998, and the amount of exception is $95,827. Questioned Costs – Known amount is $95,827. Context – This is a condition identified per review of DC Health’s compliance with specified requirements using a statistically valid sample. Total amount of samples selected for testing amounted to $6,817,550. Effect – Lack of proper review of expenditures could result to unallowable costs charged to the program. Cause – DC Health does not have adequate controls in place to ensure that only allowable costs are charged to the program. Recommendation – We recommend that DC Health strengthen internal control procedures to ensure that expenditures are allowable, and that sufficient documentation is retained to support that allowability. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DC Health concurs with the finding. The expenditure in question was an allowable cost journalized to the grant. The error occurred when the journal was duplicated. To correct the issue, other allowable expenditures were journalized from the grant to local and therefore prevented a duplicate drawdown in PMS. Also note that the vendor did not receive duplicate payment. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-015 Prior Year Finding Number: 2024-016 Compliance Requirement: Eligibility; Special Tests and Provisions – Income Eligibility and Verification Sytem Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. For TANF, per 45 CFR Section 205.60 (a), “The State agency will maintain or supervise the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of financial assistance, and the use of any information obtained under Section 205.55, with respect to individual applications denied, recipients whose benefits have been terminated, recipients whose benefits have been modified, and the dollar value of these denials, terminations and modifications. Under this requirement, the agency will keep individual records which contain pertinent facts about each applicant and recipient. The records will include information concerning the date of application and the date and basis of its disposition; facts essential to the determination of initial and continuing eligibility (including the individual's social security number, need for, and provision of financial assistance); and the basis for discontinuing assistance.” Per 45 CFR Section 205.56(a)(1)(i), “The State agency shall review and compare the information obtained from each data exchange against information contained in the case record to determine whether it affects the applicant’s or the recipient’s eligibility or the amount of assistance.” Per 45 CFR Section 205.60 (a), “The State agency will maintain or supervise the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of financial assistance, and the use of any information obtained under Section 205.55, with respect to individual applications denied, recipients whose benefits have been terminated, recipients whose benefits have been modified, and the dollar value of these denials, terminations and modifications. Under this requirement, the agency will keep individual records which contain pertinent facts about each applicant and recipient. The records will include information concerning the date of application and the date and basis of its disposition; facts essential to the determination of initial and continuing eligibility (including the individual's social security number, need for, and provision of financial assistance); and the basis for discontinuing assistance.” Condition – During our testing over beneficiary eligibility compliance requirements of the Temporary Assistance for Needy Families (TANF) program, we selected a sample of sixty (60) beneficiaries in fiscal year 2025 to test DHS’ compliance with TANF eligibility requirements. There were a total of 56,211 payments in the population, with a total dollar amount of $43,036,388. We noted the following: • For three (3) out of sixty (60) samples, DHS was unable to provide support that would allow us to test that cash assistance was not provided to an individual during the 10-year period that began on the date the individual was convicted in Federal or State court of having made a fraudulent statement or representation with respect to place of residence. In addition, for these three (3) samples, DHS was unable to locate the customer's application that was submitted prior to the sample month tested. • For three (3) out of sixty (60) samples, DHS was unable to provide the most recent application form that was submitted by the customer prior to the month tested. We were therefore unable to determine whether cash assistance was provided to an individual who was deemed eligible to receive TANF benefits prior to the approval of the application by the Social Service Representatives (SSR). • For all six (6) of these samples above, we noted that the SSR did not ensure that all required information was received prior to approving the application. These exceptions happened due to inadequate review of the application for cash assistance by the SSR. The questioned costs for the above issues amounted to $44,618, which represents 10.50% of the total TANF federal benefits paid to the 60 sampled items of $425,045. In addition, while testing the same sixty (60) samples for the Special Tests and Provisions – Income Eligibility and Verification System compliance requirement, although all evidence provided supported the use of the Bendex system during the eligibility process, for one (1) of sixty (60) the application, which included an adult in the case, was not provided. Questioned Costs – Known amount is $44,618. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support eligibility determinations, ineligible beneficiaries may receive benefits under the TANF grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation supporting participant eligibility. Recommendation - We recommend that DHS strengthen its existing policies and procedures over the review and maintenance of appropriate documentation to ensure compliance with eligibility requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The Division of Program Operations (DPO) of DHS acknowledges and agrees with the audit findings and related observations. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-016 Prior Year Finding Number: 2024-017 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. According to Title IV-A, Section 411 of the Social Security Act (the Act), 45 CFR 265.3, and the American Recovery and Reinvestment Act (ARRA) of 2009, (Public Law 111-5), each State must file an annual report containing information on the TANF program and the State’s maintenance-of-effort (MOE) program(s) for that year, including strategies to implement the Family Violence Option, State diversion programs, and other program characteristics. States are required to submit the ACF-196R report quarterly, beginning in Federal Fiscal Year (FFY) 2015, in lieu of the SF-425, Federal Financial Report (financial status). Each State files quarterly expenditure data on the State’s use of Federal TANF funds, State TANF MOE expenditures, and State expenditures of MOE funds in separate State programs. If a State is expending Federal TANF funds received in prior fiscal years, it must file a separate quarterly TANF Financial Report for each fiscal year that provides information on the expenditures of that year’s TANF funds. This form must be used for reporting regular TANF grant funds, Contingency Funds, and ARRA-Emergency Fund for TANF State Programs funds. See TANF-ACF-PI-2014-02, available at http://www.acf.hhs.gov/programs/ofa/resource/tanf-acf-pi-2014-02, for more information. Condition – During our test work over the quarterly ACF-196R report, we noted for Grant Identifying number 2501DCTANF/2501DCTAN3, the ACF-196R filed for the 4th quarter in fiscal year 2025 showed a variance of $164,659, between the cumulative amount reported on the ACF-196R amounting to $67,867,001, and the sum of federal and contingency funds as reported in the SEFA detail amounting to $67,702,342. DHS was unable to provide support for the variance. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure that correct amounts were reported and were properly reviewed, DHS may report incorrect amounts on the quarterly ACF-196R reports. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that the amounts on the ACF-196R were properly reported, and the reports were properly reviewed and approved. Recommendation - We recommend that DHS implement policies, procedures and controls that will enable accurate reconciliation between the data sources used in the preparation of the ACF-196R reports to ensure proper reporting of TANF expenditures. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS concurs with the finding. The SEFA submitted was correct, but the amount reported on the ACR-196 was incorrect because there was an undetected change in a formula in the workbook. This resulted in an error not being detected. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-017 Prior Year Finding Number: 2024-018 Compliance Requirement: Reporting; Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/ Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 261.60 (a), “A State must report the actual hours that an individual participates in an activity, subject to the qualifications in paragraphs (b) and (c) of this section and Section 261.61(c). It is not sufficient to report the hours an individual is scheduled to participate in an activity. (b) For the purposes of calculating the work participation rates for a month, actual hours may include the hours for which an individual was paid, including paid holidays and sick leave. For participation in unpaid work activities, it may include excused absences for hours missed due to a maximum of 10 holidays in the preceding 12-month period and up to 80 hours of additional excused absences in the preceding 12-month period, no more than 16 of which may occur in a month, for each work-eligible individual. Each State must designate the days that it wishes to count as holidays for those in unpaid activities in its Work Verification Plan. It may designate no more than 10 such days. In order to count an excused absence as actual hours of participation, the individual must have been scheduled to participate in a countable work activity for the period of the absence that the State reports as participation. A State must describe its excused absence policies and definitions as part of its Work Verification Plan, specified at Section 261.62. (c) For unsubsidized employment, subsidized employment, and OJT, a State may report projected actual hours of employment participation for up to six months based on current, documented actual hours of work. Any time a State receives information that the client's actual hours of work have changed, or no later than the end of any six-month period, the State must re-verify the client's current actual average hours of work, and may report these projected actual hours of participation for another six-month period. (d) A State may not count more hours toward the participation rate for a self-employed individual than the number derived by dividing the individual's self-employment income (gross income less business expenses) by the Federal minimum wage. A State may propose an alternative method of determining self-employment hours as part of its Work Verification Plan. (e) A State may count supervised homework time and up to one hour of unsupervised homework time for each hour of class time. Total homework time counted for participation cannot exceed the hours required or advised by a particular educational program.” Per 45 CFR Section 261.61 (a), “A State must support each individual’s hours of participation with documentation in the case file. In accordance with Section 261.62, a State must describe in its Work Verification Plan the documentation it uses to verify hours of participation in each activity.” According to the DC State Verification Plan, the D.C. Department of Human Services (DHS), Department of Human Services Monitoring Unit reviews and audits all documentation submitted by vendors reflecting the activities of recipients in TANF Employment program. This documentation includes time sheets, activity logs, school records, pay stubs, and verification of employment, work experience and on-the-job training. The Monitoring Unit completes this audit process to determine if sufficient documentation exists to substantiate reported time and attendance data, to warrant a payment to TANF Employment program vendors, and submission of countable hours for federal reporting purposes. The District projects hours of participation in unsubsidized, self-employment for six months or until the recipient's next scheduled recertification, whichever is sooner. Per 45 CFR Section 265.7 (a)-(c), “Each State’s quarterly reports (the TANF Data Report, the TANF Financial Report (or Territorial Financial Report), and the SSP-MOE Data Report) must be complete and accurate and filed by the due date.” For disaggregated data report, ‘a complete and accurate report’ means that: (1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems, and include correction of the quarterly data by the end of the fiscal year reporting period; (2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so); (3) The State reports data for all required elements (i.e., no data are missing); (4)(i) The State provides data on all families; or (ii) if the State opts to use sampling, the State reports data on all families selected in a sample that meets the specification and procedures in the TANF Sampling Manual (except for families listed in error); and (5) Where estimates are necessary (e.g., some types of assistance may require cost estimates), the State uses reasonable methods to develop these estimates. For an aggregated data report, “a complete and accurate report” means that: (1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems; (2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so); (3) The State reports data on all applicable elements; and (4) Monthly totals are unduplicated counts for all families (e.g., the number of families and the number of out-of-wedlock births are unduplicated counts).” 45 CFR Section 265.7 (g) states that “States must maintain records to adequately support any report, in accordance with 2 CFR Section 200.334 through 200.338.” Condition – During our test work over a sample of sixty (60) out of 5,549 participants for Special Tests and Provisions - Penalty for Failure to Comply with Work Verification Plan and Reporting, we noted: • For seven (7) instances, we noted that although the hours reported on the ACF-199 report met or exceeded the required hours, the hours reported did not agree with the average hours reported in CATCH, or were not supported by documentation (audited timesheets or work documentation). In addition, for three (3) of these instances, the supported hours did not meet the required hours. • For four (4) instances, we noted that the hours reported in the ACF-199 were less than the hours required; however, we noted that the customer was not sanctioned for work requirement non-compliance. In addition, for one (1) of these instances, the hours reported were not supported. • For thirteen (13) instances, we noted that the average hours reported in the ACF-199 were not properly supported. In addition, for eight (8) of these instances, the customer was not sanctioned for work requirement non-compliance. We further noted that for one (1) of these instances, additional support was provided but it was related to four (4) months after the sample selected and was not valid for the month being tested. • For two (2) instances, we noted that although participant work activity was adequately documented and properly supported by audited timesheets or work documentation support, the participant did not meet the work participation weekly hours requirement. In addition, for these samples, we noted that the hours reported on the ACF-199 report do not agree with the average hours in CATCH. • For four (4) instances, we noted that for a customer with unsubsidized employment, although the reported hours and the support met or exceeded the required hours, the reported hours on the ACF-199 report do not agree with the documentation provided (hours reported were less than actual support). • For one (1) instance, this customer was not found in CATCH, therefore there were no required hours included in CATCH. We reviewed the timesheet provided for one week during the month tested. We noted that the reported hours were not supported. • For one (1) instance, the hours reported for the Week 1 timesheet covered a two-week period that crossed two months. However, all the hours on the timesheet were improperly allocated to Week 1 of the month being tested instead of being allocated to the two weeks. We noted that the average hours reported on the ACF-199 report do not agree with the hours approved in CATCH, however, the average hours calculated using the correct hours agree with what was reported on the ACF-199 report. BDO noted that the approved hours for Week 1 in CATCH appear to be incorrect but the reported hours for the month appear to be correct. • For one (1) instance, the hours reported for one week did not agree with the hours on the approved hardcopy timesheet. As a result of the variance in the hours for that week, the hours reported did not agree with the recalculated hours, and the required hours were not met. The information tested in our sample represents the underlying data used in Reporting for the 1st and 4th quarters of fiscal year 2025. Consequently, DHS incorrectly reported data in the ACF-199 report for the 1st and 4th quarters of fiscal year 2025. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Data within the ACF-199 report may not be complete and accurate. Specifically, if the work participation data is not substantiated, or inconsistencies are noted, it may result in inaccurate data being reported and may lead to an incorrect ACF-199 report and could result in an incorrect allocation of Federal Funds to the state. Cause – Controls are not operating effectively over the documentation of work participation data to ensure that adequate evidence of the work participation is maintained. Recommendation - We recommend that DHS enforce existing policies and procedures and implement additional controls to ensure that adequate documentation is maintained to substantiate the work participation data reported in the ACF-199 report in accordance with the District of Columbia Work Verification Plan. We also recommend that DHS implement policies, procedures and controls that will enable an accurate reconciliation between the data sources used in the preparation of the ACF-199 report to ensure proper reporting of data elements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS agrees with the findings and will work with the DC Access System (DCAS) and Division of Innovation and Change Management (DICM) teams to mitigate the causes of the findings. These findings are mostly residual issues with the tables in DHS/ESA DCAS system. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-018 Prior Year Finding Number: 2024-019 Compliance Requirement: Special Tests and Provisions – Child Support Non-Cooperation Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 264.30 (a) (1) The State agency must refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency (i.e., the IV-D agency). (2) Referred individuals must cooperate in establishing paternity and in establishing, modifying, or enforcing a support order with respect to the child. Per 45 CFR Section 264.30 (c) The IV-A agency must then take appropriate action by: (1) Deducting from the assistance that would otherwise be provided to the family of the individual an amount equal to not less than 25 percent of the amount of such assistance; or (2) Denying the family any assistance under the program. Per the Code of the District of Columbia - Section 4–205.55. (a) The Mayor shall give timely and adequate notice in cases of intended action to discontinue, withhold, terminate, suspend, reduce assistance, or make assistance subject to additional conditions, or to change the manner or form of payment to a protective, vendor, or 2-party payment. (1) “Timely” means that the notice is postmarked at least 15 days before the date upon which the action would become effective, except as provided in Section 4-205.54(d). (2) “Adequate” means that the written notice includes a statement of what action the Mayor intends to take, the reasons for the intended action, the specific law and regulations supporting the action, an explanation of the individual’s right to request a hearing, and the circumstances under which assistance will be continued if a hearing is requested. Condition – During our compliance test work for the Special Tests and Provisions – Child Support Non-Cooperation compliance requirement, we tested sixty (60) out of a population of 534 child support cases referred by the Child Support Enforcement Division (CSED) within the DC Office of the Attorney General to the TANF program as having not cooperated with Child Support. We noted the following: • For ten (10) cases, we reviewed the customer's file noting that the customer was not sanctioned although requested by the DC Office of the Attorney General. We reviewed the customer's file and noted insufficient documentation explaining why customer was not sanctioned. DHS was unable to provide support to explain why the individual was not sanctioned. • For two (2) cases, we reviewed the District of Columbia Access System (DCAS) noting the amount the customer was sanctioned was 25% of the eligible amount. However, the letter sent to the customer in September 2025 did not reflect the upcoming Cost of Living Adjustment for the period starting October 2025; therefore, the benefit amount that was included in the letter was incorrect. • For one (1) case, we reviewed DCAS noting the amount the customer was sanctioned was 25% of the eligible amount. However, the letter sent to the customer did not reflect the correct sanction amount. • For one (1) case, we reviewed the sanction letter in DCAS noting that the action taken was accurate but not timely, by comparing the date the notice was printed and the date the sanction was effective to the Case Action Date submitted by CSED. We noted that the customer was sanctioned as requested by the DC Office of the Attorney General, but DHS - ESA was unable to locate documentation to explain why the customer was not sanctioned for the month of May 2025. The sanction started in June 2025. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support not imposing sanctions to individuals may result to noncompliance with TANF Child Support Non-Cooperation compliance requirements. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation supporting compliance with TANF Child Support Non-Cooperation compliance requirements. Recommendation - We recommend that DHS strengthen its existing policies and procedures over enforcement of sanctions and maintenance of appropriate documentation to ensure compliance with TANF Child Support Non-Cooperation compliance requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS/ESA agree with the auditor’s findings regarding the lack of completion of requests from the Child Support Enforcement (CSE) to the TANF program to impose a child support on parents who have not cooperated with child support compliance requirements. The incomplete work was due to staff transitions occurring during the review period which impacted the oversight and productivity of DHS/ESA staff working on the child support sanction process. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-019 Prior Year Finding Number: 2024-020 Compliance Requirement: Special Tests and Provisions – Penalty for Refusal to Work Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 261.14 (a) and (b) “(a) If an individual refuses to engage in work required under section 407 of the Act, the State must reduce or terminate the amount of assistance payable to the family, subject to any good cause or other exceptions the State may establish. Such a reduction is governed by the provisions of Section 261.16. The State must, at a minimum, reduce the amount of assistance otherwise payable to the family pro rata with respect to any period during the month in which the individual refuses to work. The State may impose a greater reduction, including terminating assistance.” Condition – During our testing of Special Tests and Provisions – Penalty for Refusal to Work, we selected a sample of sixty (60) cases in fiscal year 2025 to test DHS’ compliance with specified requirements. Total population is comprised of 5,911 case numbers for individuals that received payments for months where they did not meet the work requirements. We noted that a customer must have four weeks of noncompliance, mandated communication from the TANF Employment and Education Program provider, and be given at least 15 days’ notice before a sanction could be imposed. Total dollar amount is $27,545,791. We noted the following: • For one (1) instance, there were no hours reported in CATCH for October 2024 through June 2025 and August to September 2025. Per review of DCAS the customer had hours recorded for July 2025 only. However, there was no sanction for this customer in DCAS for December 2024 to June 2025 and October 2025 going forward for the hours not worked in August to September 2025. DHS indicated that no action was taken after Sanction flag. DHS was unable to provide support to explain why the customer was not sanctioned. • For one (1) instance, there were no hours reported in CATCH for May 2025 through July 2025. Per review of DCAS there was no documentation to explain why there was no sanction for the month of July 2025. DHS was unable to provide support to explain why the customer was not sanctioned. • For one (1) instance, there were no hours reported in CATCH for February to April 2025 and no sanction imposed in April 2025. Per response from DHS-ESA/OPM "Customer was assigned to CATCH 3.0 (JP)". However, DHS was unable to provide support to explain why the customer was not sanctioned. Total payments made to these three (3) individuals during the periods in question was $25,151. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support exemptions or justifications for not imposing sanctions to individuals, individuals may be given full benefits instead of reduced federal benefits under the TANF program. In addition, miscoding of hours or amounts paid may result to providing inappropriate benefits to individuals. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation to support exemptions or justifications for individuals who refuse to fulfill the minimum working requirements to receive or maintain benefits under the TANF program. In addition, controls are not operating effectively over the supervisory review of transactions posted in DCAS to ensure accuracy. Recommendation - We recommend that DHS enforce existing policies and procedures over review and maintenance of appropriate documentation to ensure compliance with Penalty for Refusal to Work compliance requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS agrees with the findings and will work within the Division of Customer Workforce Employment and Training (DCWET) team to mitigate the causes of the findings. These findings are mostly caused by inconsistency of caseload management practices. Another mitigating factor is attributable to glitches in information technology around the sanction process. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-020 Prior Year Finding Number: 2024-023 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.405, a cost is allocable to a Federal award if it is assignable to that award in accordance with the relative benefits received. In addition, under 2 CFR Section 200.403, allowable costs must be adequately documented. Per 2 CFR Section 200.430, charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated, and must be incorporated into the official records of the recipient or subrecipient. The regulation also allows certain alternative approaches when properly documented and approved by the appropriate Federal agency or cognizant agency, as applicable. Based on CFSA’s Human Resources Administration Issuance: HR-06-1 dated May 12, 2006, staff must seek and receive advance written approval prior to working overtime. It also indicates that in emergency situations requiring an immediate response, the employee shall make every reasonable attempt to obtain advance approval by an appropriate manager or supervisor. Per District Personnel Issuance No. 2018-00 (Annual Leave) effective April 21, 2018 “Using Annual Leave” - An employee may use accrued annual leave at any time during the leave year if they receive approval from their immediate supervisor or the agency head responsible for the employee’s timesheet. If an employee wishes to use their accrued annual leave, they must: 1. Submit a request in advance to use annual leave to their manager or supervisor. 2. Receive approval from the manager or supervisor; and 3. Record the approved leave taken on their timesheet in PeopleSoft. Per CFSA’s guidelines dated May 15, 2021, employees must file a written request within agency’s prescribed time limits to use sick leave. Employees should consult their agency for specific guidelines on how to request sick leave. If no specific guidelines exist, employees should submit their leave requests through PeopleSoft. For doctor’s appointment, employees must make sick leave requests at least 24 hours in advance for medical, dental, or eye examinations or treatments. Employees should also be prepared to submit supporting evidence of the appointment according to their agency’s policy. CFSA uses a Random Moment Study (RMS) to allocate the administrative costs to the Foster Care program. The study entails selecting a sample of social workers on a quarterly basis to participate in the RMS study where the social workers are required to notate what they were doing at the sample moment. Subsequently, the supervisors of these social workers review and validate their responses. Validation of the responses adds an extra layer of reliability to the data collected. It ensures that the information provided by social workers is accurate and reflective of their actual activities. This validation process helps maintain the integrity of the study and ensures that the results are trustworthy in making decisions when determining the RMS percentage utilization in the allocation of the administrative costs. Condition – The following issues were observed: 1. During our review of the Activities Allowed or Unallowed and Allowable Costs/Cost Principles, we noted that CFSA was unable to provide sufficient supporting documentation to substantiate the allocation methodology for three (3) of the sixty (60) non-payroll expenditure samples selected for testing. 2. During our review of the payroll process regarding the review and approval of time and attendance, we noted the following in our sample of sixty (60) payroll items: • For two (2) samples, CFSA failed to provide documentation evidencing the approval of overtime paid. • For thirteen (13) samples, CFSA failed to provide documentation evidencing the approval of scheduled sick leave and annual leave taken. In addition one (1) of the thirteen (13) samples was coded as scheduled sick leave; however, per documentation provided, it was indicated that the timesheet should have coded the time as military leave. BDO did not receive documentation showing approval for either military leave or scheduled sick leave. • For two (2) samples, the employee's response to the RMS moment sample was not validated by the supervisor. Questioned Costs – Not determinable. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – Without sufficient documentation to support the cost allocation methodology, CFSA cannot demonstrate that costs charged to the Foster Care program were allowable and properly allocated, increasing the risk of unallowable costs being charged to the federal award. Additionally, without adequate internal controls and procedures for record maintenance, there is a risk of disputes between the agency and its employees regarding the accuracy of pay, leave and overtime. Furthermore, supervisor validation was not completed and documented for two of the moments selected for testing. Although CFSA’s control of over-assigning moments mitigates the risk of not meeting the aggregate 10% validation requirement, the two deviations noted reduce assurance that the 10% validation requirement was met. Cause – CFSA did not have proper internal controls and policies and procedures in place to ensure that documentation supporting the cost allocation methodology was retained and readily available for review. Additionally, CFSA did not have proper internal controls and policies and procedures in place to ensure that authorization forms evidencing the preapproval of overtime, scheduled sick leave and annual leave were maintained. Furthermore, although CFSA maintains an established validation process, supervisor validation was not completed for two of the moments selected for testing. Recommendation - We recommend that CFSA strengthen its policies, procedures, and controls to ensure that costs are accurately reported and claimed, and that documentation supporting the cost allocation methodology is maintained and readily available to substantiate the amounts allocated to the Foster Care program. We also recommend that pre-authorization of overtime, scheduled sick leave and annual leave is maintained. Furthermore, we recommend that CFSA ensure that the validation control is consistently performed for all moments selected for validation. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with the findings of Condition 1 and Condition 2. For Condition 1, although CFSA provided documents (including invoices) requested by and provided by the Office of the Chief Information Officer (OCTO) for the sampled items referenced, OCTO was unable to provide the specific documentation requested by the auditors documenting the allocation methodology of the expenditures assigned to CFSA and used for Title IV-E claiming purposes. For Condition 2, bullet 3, CFSA would simply note that, as is denoted in our federally approved cost allocation plan, CFSA adheres to HHS’ requirements for statistical significance in its entire RMS operation. The standard for supervisor validation of random moments is 10% of all accepted moments. CFSA’s internal controls involve oversampling moments requiring validation, and it consistently hits the 10% validation requirement in the aggregate. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-021 Prior Year Finding Number: 2024-024 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 29 CFR Section 97.20(b)(2), Accounting records. “Grantees and sub grantees must maintain records which adequately identify the source and application of funds provided for financially assisted activities. These records must contain information pertaining to grant or subgrant awards and authorizations, obligations, unobligated balances, assets, liabilities, outlays or expenditures, and income.” Per 45 CFR Section 1356.30(b), “The Title IV-E agency may not approve or license any prospective foster or adoptive parent, nor may the Title IV-E agency claim Federal Financial Participation (FFP) for any foster care maintenance or adoption assistance payment made on behalf of a child placed in a foster home operated under the auspices of a child placing agency or on behalf of a child placed in an adoptive home through a private adoption agency, if the Title IV-E agency finds that, based on a criminal records check conducted in accordance with paragraph (a) of this section, a court of competent jurisdiction has determined that the prospective foster or adoptive parent has been convicted of a felony involving: (1) Child abuse or neglect; (2) Spousal abuse; (3) A crime against a child or children (including child pornography); or, (4) A crime involving violence, including rape, sexual assault, or homicide, but not including other physical assault or battery.” Per 45 CFR Section 1356.30(f), "In order for a childcare institution to be eligible for Title IV-E funding, the licensing file for the institution must contain documentation which verifies that safety considerations with respect to the staff of the institution have been addressed.” Furthermore, per 45 CFR Section 1356.21(a), “Statutory and regulatory requirements of the Federal foster care program, To implement the foster care maintenance payments program provisions of the Title IV-E plan and to be eligible to receive FFP for foster care maintenance payments under this part, a Title IV-E agency must meet the requirements of this section, 45 CFR 1356.22, 45 CFR 1356.30, and Parts 472, 475(1), 475(4), 475(5), 475(6).” Per CFSA policy 6008.1, “As part of the home study process, an agency shall ensure that each applicant and any other person eighteen (18) years of age or older residing in the home comply with the requirements for a criminal records check established by the Adoption and Safe Families Amendment Act of 2000, effective June 27, 2000, D.C. Law 13-136.” Condition – For the fiscal year 2025, the Foster Care program had total disbursements of $3,094,192 for 3,280 maintenance payments. We selected a sample of sixty (60) participants representing disbursed federal funds totaling $60,436 and noted the following deficiencies: • For one (1) of sixty (60) samples, CFSA was unable to provide valid provider license as required by CFR 1356.30 (b). • For two (2) of sixty (60) samples, CFSA did not provide a copy of the registry check which is part of the criminal records check required by CFSA policy 6008.1. • For two (2) of sixty (60) samples, CFSA did not provide background checks such as criminal record checks and fingerprint-based checks from the national crime information databases or check registry for all adults in the household as required by the District as detailed in CFSA policy 6008.1. These deficiencies represent 1% of the total disbursements tested. Questioned Costs – Known amount is $825. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – CFSA was not in compliance with the eligibility requirements of the Foster Care program. Cause – CFSA does not have adequate controls in place to ensure that the required eligibility documentation is maintained to evidence compliance with eligibility requirements. Recommendation - We recommend CFSA reevaluate and strengthen its existing policies and procedures over the review and maintenance of appropriate documentation to ensure compliance with eligibility requirements in accordance with the program. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with the finding. CFSA notes that bullets 2 and 3 of the condition are federal “State Plan” and local regulatory requirements (respectively) and therefore are not subject to questioned costs. Bullet 1 involved a IV-E payment made to a provider with a lapsed license. It was processed through CFSA’s previous management information system, FACES. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-022 Prior Year Finding Number: 2024-026 Compliance Requirement: Special Tests and Provisions – Payment Rate Setting and Application Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per CFSA’s internal policies and procedures, providers must submit quarterly reports within 45 days of the end of each Federal fiscal year quarter. Upon receipt of quarterly reports from the provider, the Business Services Administration Program Manager reviews each Expenditure Detail Spreadsheet for compliance, accuracy and reasonableness. Condition – Our assessment of the special tests and provisions requirement revealed that while the selected providers’ quarterly reports displayed no deficiencies, CFSA was unable to provide documentation evidencing the review and approval of the quarterly reports relating to all sixty (60) transactions that were tested. Questioned Costs – Not determinable. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – The absence of documentation specifying who reviews and approves the quarterly reports compromises accountability and creates ambiguity in identifying the responsible parties in instances of errors or discrepancies. Cause – CFSA does not have adequate controls in place to ensure that review and approval of provider’s quarterly reports are documented. Recommendation - We recommend CFSA strengthen its policies and procedures to address the review and approval process for the provider’s quarterly reports. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-023 Prior Year Finding Number: 2024-027 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CFR Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CFR Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CFR Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CFR Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination during the fiscal year 2025 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exceptions: • For four (4) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-024 Prior Year Finding Number: 2024-030 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Years: 09/30/2022 – 09/29/2025 09/30/2024 – 09/29/2027 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal Funding Accountability and Transparency Act (FFATA) Reporting Compliance: In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025, onwards. FFATA reports are submitted no later than the month following the month in which this Federal award is made, and annually after that. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, 2 CFR Section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – During our testing of the reporting compliance requirement, we noted the following: • FFATA Reporting Compliance: During our testing of FFATA reporting, it was noted that reports were submitted late by the DBH program management due to staffing shortage. The FFATA reporting for all nine subawards selected for testing was submitted late, i.e., beyond the deadline of within 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: During our testing of the SEFA, we noted that DBH incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2025, DBH incurred $12.4 million in subrecipient expenditures for this program and incorrectly reported $11.7 million subrecipient expenditures on the preliminary SEFA. While the subrecipient expenditure amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with specified reporting requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure timely reporting and that correct amounts were reported and were properly reviewed as it relates to the Opioid STR program: • FFATA Reporting Compliance: Failure to submit FFATA reports within the deadline of 30 days of the subaward or subaward modification date results in noncompliance for the DBH program. • SEFA Reporting Compliance: The effect of the condition is that the SEFA was not accurately prepared. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that FFATA reports were submitted timely and the amounts on the SEFA were properly reported. Recommendation – We recommend the following: • FFATA Reporting Compliance: We recommend DBH to strengthen its internal control and procedures to ensure submission of FFATA reports within the deadline of 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: We recommend DBH to ensure that agency personnel receive proper training on subrecipient versus vendor determination; as well as review existing policies and procedures for preparing the SEFA to ensure that it is complete and accurate. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-025 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Key Employees Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Years: 09/30/2022 – 09/29/2025 09/30/2024 – 09/29/2027 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.508(d) says an auditee must “provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part.” The grant agreements provide that the State must maintain certain key personnel. Key personnel are organization staff members or consultants/subrecipients who must be part of the project regardless of whether they receive a salary or compensation from the project. These individuals must make a substantial contribution to the execution of the project. Key personnel for this program are the Project Director, Project Coordinator, and Data Coordinator. The Project Director, Project Coordinator, and Data Coordinator cannot be the same person. No more than two people can share a position. The Project Director is responsible for oversight of the entire project, including overseeing, monitoring, and managing the award, with a level of effort of 100% (1.0 FTE). The Project Coordinator is responsible for the day-to-day operations of the project, with a level of effort of 100% (1.0 FTE). The Data Coordinator is responsible for all aspects of data collection and reporting, ensuring complete, accurate, and timely data entry into SPARS and/or other data systems as directed by SAMHSA. The Data Coordinator is also responsible for monitoring client-level intake and follow-up rates, to ensure that recipients are meeting the target numbers reported in the application. The level of effort is 100% (1.0 FTE) for all awards $4 million and above, and 50% (0.5 FTE) for all awards less than $4 million. Any changes to key personnel, including level of effort involving separation from the project for more than three months or a 25 percent reduction in time dedicated to the project, requires prior approval, and must be submitted as a post-award amendment. Condition – During our testing of the key personnel requirement, we noted that for all four (4) samples selected for testing, we were unable to obtain and review documentation to support that the key personnel met the level of effort on the awards as required by the grant agreement. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with specified requirements using a statistically valid sample. Effect – There is a risk that employees are working on the program that are not approved by the granting agency. Cause – Management has not established internal control policies and procedures to ensure that key personnel met the level of effort on the awards as required by the grant agreement. Recommendation – We recommend that DBH develop and implement policies, procedures and controls to ensure proper documentation of the required and actual time and effort from key personnel in accordance with grant requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH agrees with the findings and will put controls into place to resolve the issues. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-026 Prior Year Finding Number: 2024-036 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2025; 09/01/2021 – 09/30/2025; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal Funding Accountability and Transparency Act (FFATA) Reporting Compliance: In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025, onwards. FFATA reports are submitted no later than the month following the month in which this Federal award is made, and annually after that. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, 2 CFR Section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – During our testing of the reporting compliance requirement, we noted the following: • FFATA Reporting Compliance: During our testing of FFATA reporting, it was noted that reports were submitted late by the DBH program management due to staffing shortage. The FFATA reporting for all four subawards selected for testing was submitted late, i.e., beyond the deadline of within 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: During our testing of the SEFA, we noted that DBH incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2025, DBH incurred $1.2 million in subrecipient expenditures for this program and incorrectly reported $1.4 million subrecipient expenditures on the preliminary SEFA. While the subrecipient expenditure amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with specified reporting requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure timely reporting and that correct amounts were reported and were properly reviewed as it relates to the Block Grants for Substance Use Prevention, Treatment, and Recovery Services program: • FFATA Reporting Compliance: Failure to submit FFATA reports within the deadline of 30 days of the subaward or subaward modification date results in noncompliance for the DBH program. • SEFA Reporting Compliance: The effect of the condition is that the SEFA was not accurately prepared. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that FFATA reports were submitted timely and the amounts on the SEFA were properly reported. Recommendation – We recommend the following: • FFATA Reporting Compliance: We recommend DBH to strengthen its internal control and procedures to ensure submission of FFATA reports within the deadline of 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: We recommend DBH to ensure that agency personnel receive proper training on subrecipient versus vendor determination; as well as review existing policies and procedures for preparing the SEFA to ensure that it is complete and accurate. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-027 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Homeland Security COVID-19 – Disaster Grants - Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Homeland Security and Emergency Management Agency (HSEMA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, 2 CFR Section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – During our testing of federal reporting and the Schedule of Expenditures of Federal Awards (SEFA), we noted that the cumulative federal expenditures reported on two (2) quarterly Federal Financial Report (SF-425) did not reconcile the total expenditures claimed on the SEFA for the life of the award. Specifically, the SF-425 submitted for the period ended September 30, 2025 reported a cumulative total of approximately $924 million, whereas the SEFA recorded lifetime expenditures of approximately $1.051 billion, resulting in an unreconciled variance of approximately $127 million. Additionally, during our testing of the SEFA, we noted that HSEMA incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2025, HSEMA had a negative $0.7 million in subrecipient expenditures for this program and incorrectly reported $37.9 million subrecipient expenditures on the preliminary SEFA. While the subrecipient expenditure amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of HSEMA’s compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – HSEMA did not comply with their policies and procedures to ensure accuracy of the SEFA and other reports necessary to meet compliance requirements. Recommendation – We recommend that HSEMA adheres to instituted policies and procedures to ensure the accuracy of the SF-425 and the SEFA. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – HSEMA agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Department of Treasury, State of Indiana Office of Community and Rural Affairs, Federal Financial Assistance Listing 21.029, AL192-23-NLC-23-103, AL192-23-NLC-25-104 A, AL192-23-NLC-25-104 B Coronavirus Capital Projects Fund Procurement, Suspension & Debarment Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 200.318 maintains that recipients must have and use documented procurement policies and must conform procurement standards to Uniform Guidance standards in sections 2 CFR 200.317 through 200.327. 2 CFR 200 Appendix II requires certain provisions be included in contracts if criteria are applicable. Additionally, 2 CFR 200.214 requires recipients to restrict the subawards and contract with certain parties that are debarred, suspended, or excluded from ineligible participation in Federal assistance programs or activities. Condition: Testing of the federal program identified the following: • The Entity’s formally documented procurement policy was missing the required elements detailed under Uniform Guidance • Four instances where the Entity did not follow the procurement process and did not have any formal documentation in place with the vendors. • Four instances where the Entity entered into a contract with a vendor over $25,000 and there was no review performed to ensure the vendor was not suspended or debarred. Cause: The Entity was not aware of the federal procurement requirements. Contract provisions were not evaluated compared to Uniform Guidance contract requirements. Contracts entered were not evaluated in accordance with Uniform Guidance as it relates to suspension and debarment. Effect: Ineffective controls over this area of compliance could result in a reasonable possibility the Entity would be noncompliant with the compliance requirements outlined above. Additionally, the Entity may enter into a covered transaction with a vendor that is suspended or debarred. Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of 4 out of 10 vendors were selected for testing. Repeat Finding form Prior Year: No Recommendation: We recommend the Entity update their procurement policy to ensure it includes all the required elements in accordance with Uniform Guidance. In addition, we suggest that management implement procedures and control processes related to the review of procurement to ensure the procurement methods are being followed and documentation is retained to support compliance. Also, management should ensure vendors are not suspended or debarred from doing business with the federal government prior to entering into a procurement transaction. Views of Responsible Officials: Management agrees with the finding.

Finding 2025-001 MATERIAL WEAKNESS IN INTERNAL CONTROLS OVER COMPLIANCE, MATERIAL NONCOMPLIANCE -REPORTING Federal Program: COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Agency: US Department of Treasury Pass- Through Agencies: Various Assistance Listing Number: 21.027 Criteria: Management is required to submit various annual, quarterly, and monthly reports to the grantor in accordance with the grant agreement. Additionally, 2 CFR 200.303 requires management to have appropriate controls such that appropriate preparation, reviews, and evidence of those reviews are in place. Condition/Perspective: Based on the results of the testing we noted the following: • Out of a total of 4 Annual reports sampled, 3 did not have proof of submission or review. • Out of a total of 16 Quarterly reports sampled, 10 did not have proof of submission or review and 5 had proof of submission, but no proof of review. Of the 6 reports with proof of submission, 2 were submitted late. • Out of a total of 13 Monthly reports sampled, 1 did not have proof of submission or review. Of the reports with proof of submission 7 were submitted late. Cause: Management continued to experience high turnover during the fiscal year and the documentation pertaining to the evidence of reviews and the evidence of report submission was not retained. Effect: Without appropriate controls in place there is a risk that the Division could have submitted a report that is incomplete, contained inaccurate information, past the reporting requirement due date, or could have failed to submit the report entirely. Noncompliance with such grant requirements could result in a loss of funding. Questioned Cost: None. Repeat Finding: Yes. See 2024-001 in prior year report. Recommendation: Division management should review all applicable grant compliance requirements and ensure that the requirements are being met, including that reports are submitted on a timely basis. Additionally, the Division should continue to address and enhance their control procedures such that the appropriate individuals review all required reports in a timely manner prior to submission to the granting agency(ies); and, maintain documentation evidencing such reviews and submission dates. View of Responsible Officials: See Corrective Action Plan.

Finding 2025-003 SIGNIFICANT DEFICIENCY IN IN INTERNAL CONTROLS OVER COMPLIANCE – Allowable Costs and Cost Principles and Activities Allowed and Unallowed Federal Program: COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Federal Agency: US Department of Health and Human Services Pass- Through Agencies: City & County of Denver Assistance Listing Number: 93.498 Criteria: In accordance with 2 CFR 200.303 the recipient and subrecipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition/Perspective: On a monthly basis management reviews costs for allowability and submits draw-down requests for reimbursement to the pass-through agency. From 3 selections of reimbursement requests, management could not provide documentation to evidence a review was performed prior to submission for 1 draw-down request. Cause: Documentation pertaining to the evidence of expenditure review was not retained as management was not aware that such documentation should be retained. Effect: Without appropriate review controls in place there is a risk that the Division could submit costs that are not allowed. Noncompliance with allowability criteria could result in the Division having to refund the granting agency or a loss of funding. Questioned Cost: None. Recommendation: The Division should enhance their control procedures such that documentation of review is retained. View of Responsible Officials: See Corrective Action Plan.

Item 2025-003: Material Weakness in Internal Control Over Compliance - Cash Management Federal agency: • U.S. Department of Agriculture • U.S. Department of Commerce Federal program: • Environmental Quality Incentives Program (ALN 10.912) • Habitat Conservation (ALN 11.463) Pass-through Entity: None Federal Award Year: Year ended September 30, 2025 Type of Finding: Material Weakness in Internal Control over Compliance Criteria: The Uniform Guidance (2 CFR 200.303) requires nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to review reimbursement requests. Condition: During our testing of cash management requirements, we noted that a review of the reimbursement requests sampled for testing was not performed prior to submission. Cause: The Band does not have a procedure for a review of the reimbursement requests prior to submission for the identified programs. Currently, the same employee prepares and submits the reimbursement requests. Effect: Likelihood of inaccurate reimbursement requests is increased when they are not thoroughly reviewed. Questioned costs: None Context: • ALN 10.912 – The population of reimbursement requests subject to cash management requirements included one request. Our sample included one reimbursement request which did not have documentation showing it was reviewed. • ALN 11.463 – The population of reimbursement requests subject to cash management requirements included eight requests. Our sample included two reimbursement requests which did not have documentation showing they were reviewed. Repeat finding: No Recommendation: We recommend that the Band review their processes to ensure all reimbursement requests have review a process documented indicating that a secondary review was performed prior to submission. Views of responsible officials: The Band agrees with the above finding and its response is included in the corrective action plan.

Finding 2025-002: U.S. Department of the Treasury Federal Financial Assistance Listing 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Compliance Requirement: Procurement, Suspension, and Debarment Type of Finding: Significant Deficiency in Internal Controls over Compliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Per 31 CFR 19.300, prior to enter in subawards and contracts with award funds, recipients must verify that such contractors and subrecipients are not suspended, debarred, or otherwise excluded pursuant to 31 CFR § 19.300. Condition: The County did not retain documentation of verifying that vendors were not suspended, debarred, or otherwise excluded prior to entering into a transaction with them. Cause: The County performed the verification but did not retain documentation, and we were unable to verify that it was performed prior to the transaction. Effect: Vendors could be suspended, debarred, or otherwise excluded, and the County would not be aware. Questioned Costs: None Context / Sampling: We tested four of 14 contracts subject to suspension and debarment in the SLFRF program. Repeat Finding from Prior Year: Yes, prior year finding 2024-003 Recommendation: The County should retain documentation of the review of all vendors. Views of Responsible Officials: Management agrees with the noted finding. Refer to Corrective Action Plan.

Finding No.: 2025-001 Federal Agency: U.S. Department of Education AL Program: 84.063/84.033/84.007 Student Financial Assistance Cluster Federal Award No.: Title IV HEA Program OPE ID 01034300 Area: Eligibility Questioned Costs: None Criteria: 2 CFR 200.303 (a) states the recipient and subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The College is required to establish internal control to ensure compliance with the following requirements: 34 CFR 676.20 (s) states that: Minimum and maximum Federal Supplemental Educational Opportunity Grants (FSEOG) awards requires: (a) An institution may award an FSEOG for an academic year in an amount it determines a student needs to continue his or her studies. However, except as provided in paragraph (c) of this section, an FSEOG may not be awarded for a full academic year that is— (1) Less than $100; or (2) More than $4,000. Condition: We noted that seven students were awarded amounts exceeding the maximum allowable limit of $4,000, while one student received an award below the minimum allowable amount of $100. Cause: The condition was primarily due to the College’s limited familiarity with FSEOG requirements, as this represents its first year administering the program. As a result, management did not have adequate procedures or guidance in place to ensure compliance with the minimum and maximum award limits prescribed under federal regulations. Effect or potential effect: The College is in noncompliance with applicable requirements. Identification as a Repeat Finding: Not applicable. Recommendation: We recommend that management establish and implement formal policies and procedures for the administration of the FSEOG program, including clear guidance on the minimum and maximum award limits in accordance with federal regulations. Management should also provide adequate training to Financial Aid Office personnel on applicable federal requirements, perform supervisory reviews of award calculations prior to disbursement, and conduct periodic monitoring to ensure ongoing compliance with established limits. Views of responsible officials The College acknowledges the finding. Refer to corrective action plan.

2025-003 (Repeat Finding) Retaining Sliding Scale Determination Documentation Special Tests and Provisions ALN 93.224 Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) US Department of Health and Human Services Contract Numbers H80CS30749-06 and H80CS30749-07 Contract Periods April 1, 2022 – March 31, 2023 and April 1, 2023 – March 31, 2024 Conditions and Criteria: The requirement under 45 CFR 75.361 provides requirements for the retention of records for grantees. In addition, 2 CFR 200.303 provides requirements to establish and maintain effective internal controls over Federal awards. Specifically, it states that financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Health and Human Services awarding agency of pass-through entity in the case of a subrecipient. In the 2023 audit, for 5 out of 40 samples selected for testing, it was noted that OCHS did not retain the proper documents that the patients had submitted that included their income and family size or the documents completed by OCHS showing the sliding fee discount determination for these patients. Effect: The effect is that records that are required to be retained were not retained and evidence of how the sliding fee discount was determined could not be examined. Questioned Costs: Any likely questioned costs could not be determined since compliance testing was unable to be performed due to the lack of documentation. It should be noted that there were no exceptions for 35 samples that were able to be tested, and for 5 samples with insufficient documentation, 3 had partial documentation of income (i.e., pay stubs) and 2 had no documentation of income as it was not maintained. However, the sliding scale calculation was completed for all 40 samples. Cause: Determining the sliding fee discount level for each patient is reassessed on an annual basis. During the year, there was employee turnover in the compliance department. Although OCHS has a records retention policy, there was a lack of monitoring in place to ensure that the requirement under 45 CFR 75.361 was adhered to. Auditor Recommendation: A procedure should be put in place to monitor whether the record retention policy is followed. Current Status: During the current year, fiscal 2025 audit testing, no samples lacked support for the sliding fee scale determination. However, there is a three-year documentation retention requirement per 45 CFR 200.303. If asked to produce documentation for fiscal year 2023, OCHS would not be able to do so, therefore, the 2023 fiscal year finding was repeated. Planned Corrective Action: See the following Corrective Action Plan section for management’s planned corrective action.

Finding 2025-001 Fixed Asset Reconciliations and Management of Federally Funded Equipment - Significant Deficiency in Financial Reporting and Internal Control over Equipment and Compliance Finding Federal Agency(ies): United States Agency for Global Media Federal Program(s): International Broadcasting Independent Grantee Organizations Assistance Listing Number(s): 90.500 Pass-through Entity (if applicable): N/A Award Identification Number and Year: MN01-25-GO-00001 (2025) Criteria or Specific Requirement: 2 CFR 200.313(d) requires recipients to maintain property records for equipment acquired with Federal funds. Such records should include, among other items, a description of the property, serial number or other identification number, source of funding, acquisition date, cost, location, use and condition, and ultimate disposition data. Additionally, recipients are required to conduct physical inventories of equipment and reconcile the results of those inventories to the property records. Further, 2 CFR 200.303 requires recipients to establish and maintain effective internal controls over Federal awards that provide reasonable assurance of compliance with applicable Federal requirements. Condition: MBN maintains equipment records in its accounting records and in its inventory management system (BarCloud). At the time of testing, MBN was completing a planned transition of those records from physical binder-based files to a centralized BarCloud system; a related inventory review and reconciliation was still in progress. Because the accounting fixed asset schedule consists of a combination of grouped asset additions and individual assets, while the inventory management system maintains records at the individual asset level, and because the inventory management system did not yet contain information necessary to reconcile inventory records to the accounting record (including asset classifications and in-service dates), the records maintained within the two systems are not yet fully reconciled. During audit testing performed while this reconciliation was ongoing, discrepancies were identified between the systems, including assets recorded in one system but not the other. Cause: The discrepancies noted relate primarily to the timing of audit testing in relation to the organization-wide reconciliation effort then already underway. During fiscal year 2025, MBN began a comprehensive reconciliation of equipment records, transitioning from manual, binder-based files maintained at field locations to a centralized BarCloud inventory management system and the fixed asset schedule. At the same time, the company was engaged in a detailed review and reconciliation of its property and equipment records, and had begun implementing more stringent controls over management of Federally funded equipment. This substantial undertaking was conducted during a period of reduced staffing within the finance and accounting function. Given the volume of records, the level of effort required, and the fact that records originating in prior years (especially those overseas where offices had been closed and access was limited) required significant enhancement before they could be reconciled, the reconciliation effort remained in progress at the time of audit testing, and additional time was needed to complete it.Effect or Potential Effect: Because management’s reconciliation effort was still in progress at the time of testing, there was a temporary, transitional risk that Federally funded equipment records maintained in the two systems were not yet fully aligned, and that some discrepancies between accounting and inventory records had not yet been identified and resolved. This risk is inherent to the period during which legacy binder-based records are consolidated into a centralized system and reconciled, and is expected to diminish as management completes its remediation efforts. Questioned Costs: None Context: As part of our testing of equipment management requirements, the Organization reviewed its equipment tracking processes and the records maintained within both the accounting system and the BarCloud inventory management system. Testing was performed during a period in which management was actively reconciling records - including records maintained at closed overseas locations - into BarCloud, while also reconciling the two systems. We noted that the systems maintained different levels of detail which, at the time of testing, had not yet been fully reconciled. Limited testing of vehicle records identified assets recorded in one system that were not reflected in the other, which is consistent with the transitional state of the records. Identification as a Repeat Finding, if Applicable: N/A Recommendation: We recommend that management continue establishing and implementing procedures to maintain equipment records in a manner permitting reconciliation between the accounting records and the inventory management system. The procedures should include the establishment of a common asset identification methodology, the reconciliation of equipment records between systems on a periodic basis, the investigation and resolution of any discrepancies, and the maintenance of documentation supporting the reconciliation process. Additionally, management should continue evaluating whether additional information should be maintained within the inventory management system to facilitate reconciliation and support compliance with Federal equipment management requirements.

Segregation of Duties Condition and criteria: During our audit of the Authority’s Financial Statements, we noted that the Authority does not have adequate segregation of duties in place. Specifically, the same individual is responsible for initiating and recording journal entries and disbursements and reconciling the bank accounts. In addition, in accordance with 2 CFR § 200.303(a), the non Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Cause and Effect: The Authority is a small entity with limited administrative and accounting staff, which makes it difficult to achieve a complete segregation of duties. Due to resource constraints, individual staff members are assigned multiple roles that overlap key financial processes. Without proper segregation of duties, there is an increased risk that errors or irregularities, including potential misappropriation of assets or fraud, could occur and remain undetected. This condition could lead to noncompliance with applicable grant requirements and inaccuracies in financial reporting. Auditor’s Recommendations: We recommend that the Authority assess the current structure and implement compensating controls where full segregation of duties is not feasible due to staffing limitations. These may include enhanced supervisory review, periodic oversight by the board or executive leadership, documentation of independent reviews, and rotation of duties when possible. Authority’s Response: The board reviews the reports monthly. A printed payroll report and checks written from meeting to meeting are provided and are approved and initialed. Also provided is a report of the bank statements for the board to review what has been received and what has been paid. Before any bills are paid they are approved at the meeting. If an error is made when inputting a deposit received into the software, the correction is printed and initialed approving the correction.