Findings Citing § 200.303

2024-001 REPORTING - SIGNIFICANT DEFICIENCY Federal Program Community Development Block Grant-Entitlement/Special Purpose Grants Cluster ALN 14.218; passed through the County of Berks COVID-19 - Emergency Rental Assistance ALN 21.023; passed through the County of Berks Criteria Per 2 CFR §200.303, non-federal entities must establish and maintain effective internal control over federal awards to provide reasonable assurance of compliance with federal statutes, regulations, and the terms and conditions of the award. The OMB Compliance Supplement for reporting requires entities to have controls to ensure accurate and timely submission of required reports. Condition/Cause The auditee did not have any documented or implemented internal controls over the review of federal program reporting requirements. Reports were prepared and submitted without documentation of supervisory review or verification of accuracy and completeness. Management did not design or implement procedures to review reports prior to submission, relying solely on preparer knowledge without formal oversight. Effect Without internal controls, there is an increased risk that reports submitted to the federal agency or pass-through entity may contain inaccurate or incomplete information, potentially resulting in noncompliance with reporting requirements. Questioned Costs None. Repeat Finding Yes; 2023-01. Recommendation We recommend that all grant reports are reviewed by a person independent of the preparer who has knowledge of the grant requirements. This review should include comparing the amounts reported to detailed support for accuracy. We also recommend the Authority review their recordkeeping procedures for documentation related to grant reporting. There should be a process in place to ensure all required documentation is maintained and filed in an orderly system that allows the Authority to locate and provide documentation when required. Management Response In general, management agrees with the finding. It should be noted that internal controls for supervisory review of reporting requirements were in place but were not written controls or processes. Reporting for the CDBG Program is accomplished through the preparation of the annual Comprehensive Annual Performance and Evaluation Report (CAPER). Written policies and procedures for the CAPER have been developed. Reporting for the Emergency Rental Assistance Program is accomplished through an online reporting system of the U.S. Treasury and by email to the Pennsylvania Human Services Department. This finding has since been resolved in 2025, with a new policy developed and implemented on December 12, 2025.

Finding 2024-002 Information on the federal program: Federal Agency: Federal Transportation Administration Pass-Through Entity: N/A Federal Program: Federal Transit Cluster Assistance Listing Number: 20.507 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs – Cost Principles Audit Findings: Material Weakness Criteria: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable, under federal awards, cost must meet certain criteria: a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the non-Federal entity. d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally financed program in either the current or a prior period. g) Be adequately documented. h) Cost must be incurred during the approved budget period. Additionally, 2 CFR 200.303 indicates that non-Federal Entities receiving Federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonfederal entity is managing the Federal award in compliance with Federal statutes, regulations and terms and conditions of the Federal award. The Corporation should have controls in place to document that salaries and overtime paid with federal funds were allowable. Timecards supporting hours worked should be approved and pay rates reviewed. Condition and Context: A summary of allowable charges for the grant was prepared for submission. Within the sample of 42, we noted that 9 timecards for bus operators did not have documented review. Documented review was implemented in September 2024. All instances of the error were prior to September 2024. We also noted 1 timecard showed 2 hours more than reflected on the pay register, resulting in a net underpayment. Effect: Payroll expenditures could be inaccurately charged as an allowable activity or allowable costs to the federal grant. Cause: Management noted that time is tracked in a spreadsheet and is reviewed but formal documentation of review was not maintained. Questioned Costs: None. Identification as a Repeat Finding, if Applicable: This is a repeat finding. See finding 2023-001 in the prior report. Recommendation: We recommend the Corporation maintain documented approval of all timecards. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.

Significant deficiency in internal control over compliance and compliance as it relates to allowable costs and activities. Federal Agency: All awards within the Research and Development Cluster Program Title: All awards within the Research and Development Cluster Assistance Listing Number: All awards within the Research and Development Cluster Award Number: All awards within the Research and Development Cluster Award Period: All awards within the Research and Development Cluster Criteria 2 U.S. Code of Federal Regulations (CFR) 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards Section 200.303 requires that each recipient of federal awards “Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition/Context for Evaluation During our audit, we tested nonpayroll costs charged to the federal awards for adherence to necessary compliance requirements and internal control over compliance requirements. Out of 25 sample selections, we noted the following related to seven sample items: - Five of seven sample items selected involved overcharges to the grants. All five showed management approval for the incorrect amounts. - One of seven sample items selected had no supporting documentation. - One of seven sample items had no management approval. Questioned Costs $1,790 Effect or Potential Effect AAHI may have charged unallowable or incorrect costs to the federal awards. Repeat Finding No. Recommendation We recommend AAHI implement the necessary internal controls to (1) ensure documentation is retained to support costs spent on federal awards and (2) ensure all costs are properly approved and for the correct amounts. Views of Responsible Officials of Auditee Management concurs with the finding and has provided the accompanying corrective action plan.

2024-007: Bureau of Indian Affairs – 105(l) Leases ALN 15.048, Lack of Approvals (Material Weakness) Condition There were several instances of lack of approvals for disbursements. Criteria Federal grant recipients are required to maintain effective internal controls over federal awards, as outlined in 2 CFR §200.303. Cause Turnover and inadequate staffing. Effect Some disbursements had no approvals. Perspective Information Nine of 27 tested. Recommendation All disbursements should have one approval and ensure the expenditure is eligible under the grant. View of Responsible Officials and Planned Corrective Action The Tribe has taken steps to strengthen internal controls over disbursement approvals and ensure that all expenditures are properly reviewed and documented including:  Establishment of a standardized disbursement approval process requiring documented approval prior to payment for non-routine/recurring expenditures.  Implementation of procedures to ensure all disbursements are reviewed for allowability under applicable grant requirements before payment is issued.  Maintenance of supporting documentation, including approval evidence, within the accounting records.  Ongoing review of disbursement procedures to ensure compliance with internal control requirements under 2 CFR §200.303. These measures are designed to ensure that all disbursements are properly authorized, documented, and compliant with applicable grant requirements. Corrective actions began implementation during throughout 2025. These procedures are currently in place and will continue to be refined as part of ongoing internal control improvements.

FINDING 2024‐001 – Allowable Cost Principles and Activities Allowed or Unallowed Material Weakness in Internal Control over Compliance Assistance Listing Number: 21.029 Federal Program Name: COVID-19 - Coronavirus Capital Projects Fund Award Year: 2024 Criteria: Uniform Guidance requires non-Federal entities to establish and maintain effective internal controls over Federal awards, including ensuring transactions are properly recorded, reported, and allowable. Specifically: • 2 CFR §200.302(b)(1) and (b)(2) require financial management systems to provide accurate, current, and complete disclosure of financial results and to identify expenditures by Federal award. • 2 CFR §200.302(b)(6) requires written procedures for determining the allowability of costs. • 2 CFR §200.303 requires entities to establish and maintain effective internal controls over compliance, including appropriate segregation of duties. Condition and context: The Cooperative does not have formalized written policies and procedures governing the coding, review, and reporting of expenditures charged to Federal awards, including payroll costs. Additionally, adequate segregation of duties is not in place over the review and approval of expenditure coding and financial reporting. As a result, payroll expenditures were not consistently or timely coded to the appropriate grant. Payroll expenditures totaling $16,990 were identified subsequent to year-end and recorded and reported late. These costs were not included in the appropriate reporting period, resulting in delayed recognition of allowable expenditures. Questioned costs: None. Effect: The absence of formal policies, procedures, and proper segregation of duties increases the risk that expenditures are not accurately, completely, or timely recorded and reported by Federal award. This may result in: • Financial reports that do not reflect complete and accurate program expenditures for the reporting period; • Increased risk of noncompliance with Federal reporting requirements; • Potential misstatement or omission of allowable costs; and • Delays in reimbursement or increased risk of questioned costs. Additionally, the late identification and backdating of payroll expenditures contributed to the triggering of Single Audit requirements, which are now being performed after the required timeframe. Cause: The deficiencies are due to a lack of formalized written policies and procedures over expenditure coding, allowability determinations, and reporting, as well as inadequate segregation of duties in the preparation, review, and approval of grant-related expenditures and reports. Repeat finding: No Recommendation: We recommend the Cooperative develop and implement written policies and procedures to ensure timely, consistent, and correct coding of all grant-related expenditures (payroll and non-payroll). Within these policies and procedures, we recommend establishing review and approval controls, including periodic review of expenditure coding by supervisory or accounting personnel. Implementing these policies and procedures will ensure expenditures are recorded within the appropriate reporting period. Views of responsible officials and planned corrective actions: Wabash currently maintains informal procedures for coding and reviewing invoices and payroll records, management recognizes the need for a formalized, written policy governing expenditures charged to federal awards. To address identified material weaknesses, Wabash is committed to implementing a comprehensive written policy by June 30, 2026. This policy will formalize the coding, review, and reporting processes for all federal expenditures. Contact Person(s): Cheryl Gaither, Controller Justin Gephart, Chief Operating Officer

Significant deficiency in internal control over compliance and compliance as it relates to allowable costs and activities. Federal Agency: All awards within the Research and Development Cluster Program Title: All awards within the Research and Development Cluster Assistance Listing Number: All awards within the Research and Development Cluster Award Number: All awards within the Research and Development Cluster Award Period: All awards within the Research and Development Cluster Criteria 2 U.S. Code of Federal Regulations (CFR) 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards Section 200.303 requires that each recipient of federal awards “Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition/Context for Evaluation During our audit, we tested nonpayroll costs charged to the federal awards for adherence to necessary compliance requirements and internal control over compliance requirements. Out of 25 sample selections, we noted the following related to seven sample items: - Five of seven sample items selected involved overcharges to the grants. All five showed management approval for the incorrect amounts. - One of seven sample items selected had no supporting documentation. - One of seven sample items had no management approval. Questioned Costs $1,790 Effect or Potential Effect AAHI may have charged unallowable or incorrect costs to the federal awards. Repeat Finding No. Recommendation We recommend AAHI implement the necessary internal controls to (1) ensure documentation is retained to support costs spent on federal awards and (2) ensure all costs are properly approved and for the correct amounts. Views of Responsible Officials of Auditee Management concurs with the finding and has provided the accompanying corrective action plan.

Finding Number:2024-006 Instance of Non-Compliance:Allowability of Costs Assistance Listing # 66.466 Questioned Cost $0 Repeat Finding: No Condition: During testing of disbursements, including both federal grant expenditures and nonfederal funded transactions, it was noted that a majority of the sampled items lacked documented evidence of review and approval. While approvals may have occurred, there was no retained written or system-based documentation to substantiate that such reviews were performed in accordance with the organization’s established approval requirements. Criteria: In accordance with 2 CFR Part 200, specifically § 200.303 (Internal Controls), nonfederal entities are required to establish and maintain effective internal controls over federal awards, including proper authorization and documentation of transactions. Additionally, the Organization’s accounting policies require that all disbursements and employee reimbursements be reviewed and approved by appropriate personnel, with supporting documentation maintained within designated systems such as QuickBooks Online (QBO) and Gusto. Cause: The deficiency appears to result from inconsistent adherence to established policies and procedures, as well as insufficient monitoring and enforcement controls to ensure that approvals are properly documented and retained within the accounting system. Effect: The lack of documented approvals increases the risk of unauthorized, inappropriate, or unsupported expenditures. This control weakness may result in noncompliance with federal regulations and internal policies and could lead to questioned costs or additional audit findings. Recommendation: Management should strengthen internal controls by reinforcing compliance with existing approval and documentation requirements. Specifically, all disbursements and reimbursements should include verifiable evidence of review and approval (e.g., documented electronic approvals within QBO or Gusto, or appropriately signed supporting documentation) prior to payment processing. Additionally, management should implement periodic monitoring procedures to ensure compliance and provide training to relevant personnel on documentation and approval standards. Views of Responsible Officials: Management acknowledges the finding and agrees that documentation of disbursement approvals needs to be strengthened. While approvals were generally occurring, they were not consistently documented or retained in accordance with established policies. To address this, the organization has implemented a requirement for documented email approvals from appropriate managers prior to processing payments. In addition, the organization is evaluating and implementing an electronic system to capture and retain approvals for accounts payable and credit card transactions. Management will also reinforce compliance through periodic monitoring and staff training to ensure adherence to approval and documentation requirements. Responsible Official: Abel Olivo, Executive Director, in coordination with the organization’s outsourced accounting firm Anticipated Completion Date: May 31, 2026

Criteria: Per 2 CFR § 200.303(a), the non-Federal entity must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the awards. Additionally, per 2 CFR §200.403 and §200.302, costs charged to federal awards must be allowable, allocable, and properly documented, and financial reporting must be accurate, complete, and supported by the accounting system. Condition: Although the Parish has implemented internal controls related to the allowability of costs and the preparation of required reports for the Coronavirus State and Local Fiscal Recovery funds, they were not operating effectively during fiscal year 2024. Tests of controls indicated that transactions were not tracked appropriately to ensure they were charged to the correct funding source. In addition, quarterly project and expenditure reports submitted to the U.S. Treasury included inaccurate or unsupported information due to a lack of tracking and reconciliation procedures. Cause: As discussed in item 2024-001, the Parish encountered several challenges during the transition of administration and key personnel. Parish administration and management were immediately tasked with enhancing operations related to procedural concerns from the prior administration and performing the accounting function without sufficient documentation on several balances and transactions. The documented controls were not in practice because of this. Effect: While no instances of noncompliance were noted, the lack of documented controls in practice increases the risk that future required reports could be incomplete, inaccurate, or untimely, as well as, federal costs being unallowed per the cost principles which could potentially result in program noncompliance. Recommendation: We recommend that the Parish enhance and document internal controls over financial reporting, as described in our recommendations described under item 2024-001, to prevent noncompliance of the Uniform Guidance as required. Views of responsible officials: See management’s responses to findings on Page 116.

Criteria: In accordance with 2 CFR § 200.331, a non-federal entity that passes federal awards to subrecipients is responsible for 1) evaluating each subrecipient’s risk of noncompliance, 2) monitoring the activities of subrecipients to ensure that the subaward is used for authorized purposes, in compliance with laws and the terms and conditions of the subaward, and 3) verifying that subrecipients have audits in accordance with the Uniform Guidance, if applicable. Adequate internal controls are required to ensure compliance with these requirements under 2 CFR § 200.303. Condition: During our audit, we noted that the Parish did not have sufficient internal controls in place to ensure effective subrecipient monitoring. Specifically, there was no documented risk assessment of subrecipients prior to issuing subawards, the Parish did not perform periodic reviews or site visits to monitor subrecipient performance or compliance, and the subrecipient audit reports were not consistently obtained or reviewed. Cause: As discussed in item 2024-001, the Parish encountered several challenges during the transition of administration and key personnel. Parish administration and management were immediately tasked with enhancing operations related to procedural concerns from the prior administration and performing the accounting function without sufficient documentation on several balances and transactions. The documented controls were not in practice because of this. Effect: Failure to properly monitor subrecipients increases the risk that federal funds may be misused or not spent in accordance with program requirements to achieve program objectives. It also exposes the Parish to potential liability for questioned costs incurred by subrecipients to be repaid to the federal agency. Recommendation: We recommend that the entity establish and implement formal policies and procedures for subrecipient monitoring in accordance with 2 CFR § 200.331. This should include conducting and documenting pre-award risk assessments, developing a subrecipient monitoring plan (e.g., site visits, desk reviews), reviewing subrecipient performance and audit reports on a regular basis. Views of responsible officials: See management’s responses to findings on Page 116

Finding 2024-004 Lack of documented approval of Other Than Personal Services (OTPS) expenditures charged to federal awards (Assistance Listings 19.510, 93.566, 93.583 and 93.576) Criteria: Under 2 CFR 200.303, the nonfederal entity must establish, document, and maintain effective internal control over federal awards that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award; those internal controls should align with the Green Book or COSO framework and include adequate authorization and review of disbursements. To be allowable under a federal award, costs must be necessary and reasonable, allocable, accorded consistent treatment, determined in accordance with GAAP, not used to meet cost-sharing of other federal programs, adequately documented, and incurred during the approved budget period per 2 CFR 200.403. Inadequate or missing documentation may result in costs being considered improper payments or disallowed costs. Condition and Context: During testing of OTPS expenditures charged to the programs, the Organization did not consistently document required management approval prior to payment. For 13 of 23 OTPS transactions tested, totaling $49,393, the supporting documentation did not contain evidence of review and approval by an individual with appropriate authority in accordance with the Organization’s written policies and procedures. In addition, for these items, there was no alternative documentation demonstrating that the costs had been reviewed for allowability, allocability, and reasonableness before being charged to the federal award. Cause: The Organization’s policies require documented approval for OTPS expenditures; however, management did not effectively enforce these procedures, and staff responsible for processing OTPS transactions were not consistently following the policy and procedures on the documentation and approval requirements. Effect: Because documented approval was not consistently obtained prior to payment, there is an increased risk that unallowable, unreasonable, or non-program-related OTPS costs could be charged to the federal award. The transactions identified without documented approval may be subject to disallowance by the federal awarding agency or pass-through entity. Identification as a repeat finding: No. Questioned costs: None. Recommendation: We recommend that management:  Reinforce and, if necessary, update written policies and procedures to require documented review and approval of all OTPS expenditures charged to federal awards prior to payment, including documentation of the program, funding source, and allowability assessment.  Provide training to staff responsible for initiating, reviewing, and approving OTPS transactions to ensure understanding of Uniform Guidance requirements for allowability, allocability, and documentation.  Implement periodic monitoring (for example, supervisory review of a sample of OTPS transactions) to verify that approvals are documented and that OTPS costs charged to federal awards are properly supported and in compliance with 2 CFR 200.303 and 2 CFR 200.403. Views of Responsible Officials: The Organization proactively enacted rigorous internal controls and systemic enhancements for FY25 to ensure optimal oversight and adherence to federal guidelines. Management has addressed this recommendation by deploying a strict, comprehensive expense request process to ensure robust internal controls over all Other Than Personal Services (OTPS) expenditures. To ensure full compliance with 2 CFR 200.303 and 200.403, Finance has deployed the following enhancements to our accounts payable workflows:  Strict Electronic Approval Workflow: Finance has established a stringent review and approval protocol that requires direct involvement from Program Directors and Department Heads. All OTPS expenditures are now routed through a formalized electronic workflow, which mandates documented review and secure electronic signatures from authorized leadership prior to any payment processing.  System-Integrated Documentation: The new process strictly requires that all supporting documentation-including invoices, receipts, and evidence of allowability-be provided upfront. These documents are now uploaded and attached directly to the specific transaction within the accounting program, creating a permanent, easily accessible, and audit-ready trail for every federal charge.  Targeted Training and Oversight: To support this modernized workflow, Finance is providing targeted training to all staff responsible for initiating and approving transactions, ensuring a clear understanding of Uniform Guidance requirements. Furthermore, Finance leadership conducts periodic supervisory reviews directly within the accounting system to verify that all electronic approvals are captured and source documents are properly attached.

Information on Federal Programs: 93.083 – Centers for Disease Control and Prevention: Prevention of Disease, Disability, and Death through Immunization & Control of Respiratory & Related Diseases. Criteria or Specific Requirements: 2 CFR §200.303 requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the award is managed in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government (Green Book), issued by the Comptroller General of the United States, or the COSO Internal Control Integrated Framework. 2 CFR §200.318-200.320 require the non-Federal entity to have and use documented procurement procedures for the acquisition of property or services under a Federal award that are consistent with the standards for general procurement, competition, and methods of procurement. Condition: ATS’s organization-wide procurement policy does not include documented procurement procedures that address the Uniform Guidance requirements for procurement under Federal awards (for example, methods of procurement, competition requirements, and applicable thresholds) as required by 2 CFR §200.318-200.320. For the federally funded program, ATS implemented a separate written selection policy for contractors/health systems; however, this policy does not fully address all Uniform Guidance procurement elements. Cause: Management had not fully updated its written procurement policies and procedures to incorporate the specific requirements of 2 CFR §200.318-200.320 for procurements under Federal awards. As a result, internal control procedures over procurement under the Federal program were not fully documented in a manner consistent with the Uniform Guidance. Effect: Failure to have and use fully documented procurement policies and procedures compliant with the Uniform Guidance could result in noncompliance with Federal procurement requirements and increase the risk of unallowable or improperly procured costs under Federal awards. In the current year, our testing did not identify specific instances in which procurement transactions under the Federal program were noncompliant; however, the lack of fully compliant written procedures represents a significant deficiency in internal control over compliance. Perspective: ATS did not have documented procurement policies and procedures that were fully compliant with 2 CFR §200.320 for procurement under Federal awards. However, for the Federal program, ATS established a documented selection criteria policy for contractors/health systems. Under this policy, a selection subcommittee reviews, evaluates, and selects health systems based on defined criteria, and each selected application is submitted to the prime awardee for review and approval before ATS issues contracts. In a random sample of 8 procurement contracts tested, all 8 followed the documented selection process and were supported by appropriate documentation. Questioned Costs: None. Identification as a Repeat Finding: Continued Finding 2023-005. Recommendation: ATS should update and formalize its procurement policies and procedures to incorporate the requirements of 2 CFR §200.318-200.320 for all procurements under Federal awards, including: methods of procurement and thresholds, competition requirements, documentation of procurement history, and oversight responsibilities. Once updated, ATS should ensure the procurement under the Federal program is carried out in accordance with these policies and that staff are trained on the revised requirements.

FINDING 2024-003 Subject: Water and Waste Disposal System for Rural Communities - Internal Controls Federal Agency: Department of Agriculture Federal Program: Water and Waste Disposal System for Rural Communities Assistance Listings Number: 10.760 Federal Award Number and Year (or Other Identifying Number): 1780-12 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Material Weakness Condition and Context An effective internal control system, which would include segregation of duties, was not in place at the Town to ensure compliance with requirements related to the grant agreement and the following compliance requirements: Activities Allowed or Unallowed and Allowable Costs/Cost Principles. There was no documented oversight, review, or approval process in place over federal expenditures related to the grant. Although the Town Council approved grant project-related contracts, individual expenditures did not have a documented review process in place (or consistent Town Council approval) to ensure disbursements made were allowable and in accordance with contract provisions and the grant agreement. Additionally, related grant expenditures from the Town's Sewer Construction fund were not consistently or appropriately recorded in the Town's general ledger. The lack of internal controls was a systemic issue throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 18 TOWN OF NEW MARKET SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause The Town relied on its Rural Development Grant Administrator to handle approvals of related expenditures, reimbursements, and other grant compliance tasks. The Clerk-Treasurer is new to the position and is still working to implement internal controls over the Town's federal grant programs. Effect Without the proper implementation of an effectively designed system of internal controls, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. It also placed the Town at risk of noncompliance with the grant agreement, as grant related disbursements without adequate review could be unallowable. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the Town design and implement a proper system of internal controls, including policies and procedures that would provide segregation of duties to ensure appropriate reviews, approvals, and oversight of grant related disbursements are taking place. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Water and Waste Disposal System for Rural Communities - Equipment Federal Agency: Department of Agriculture Federal Program: Water and Waste Disposal System for Rural Communities Assistance Listings Number: 10.760 Federal Award Number and Year (or Other Identifying Number): 1780-12 Compliance Requirement: Equipment and Real Property Management Audit Findings: Material Weakness, Modified Opinion INDIANA STATE BOARD OF ACCOUNTS 19 TOWN OF NEW MARKET SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Condition and Context The Town had not properly designed and implemented a system of internal controls to ensure compliance with requirements related to the grant agreement and the Equipment and Real Property Management compliance requirement. A property record or capital asset listing is required to be maintained for all equipment purchased with federal grant awards to ensure adequate safeguards are in place to prevent loss or damage of items. The Town disbursed federal funds for its Sewer Construction project and added $1,600,438 to its capital asset records in 2024 noted as "Infrastructure." None of the required information, including description of the property, a serial number or another identification number, the source of funding for the property (including the FAIN), the title holder, the acquisition date, the cost of the property, the percentage of the federal agency contribution towards the original purchase, the location, etc., was included in the Town's property/asset records. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.313(d) states: "Management requirements. Procedures for managing equipment (including replacement equipment), whether acquired in whole or in part under a Federal award, until disposition takes place will, as a minimum, meet the following requirements: (1) Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the FAIN), who holds title, the acquisition date, and cost of the property, percentage of Federal participation in the project costs for the Federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sale price of the property. (2) A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. (3) A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. INDIANA STATE BOARD OF ACCOUNTS 20 TOWN OF NEW MARKET SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (4) Adequate maintenance procedures must be developed to keep the property in good condition. (5) If the non-Federal entity is authorized or required to sell the property, proper sales procedures must be established to ensure the highest possible return." Cause The Town was unaware of the requirements regarding identifying information for assets purchased with federal funds. The Clerk-Treasurer is new to the position and is still working to implement internal controls over the Town's federal grant programs. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As a result, assets purchased with federal dollars were not properly identified in the Town's asset listing. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the Town. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the Town establish a proper system of internal controls and develop policies and procedures to ensure asset records include all the necessary information for assets purchased with federal funds. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: Water and Waste Disposal System for Rural Communities - Suspension and Debarment Federal Agency: Department of Agriculture Federal Program: Water and Waste Disposal System for Rural Communities Assistance Listings Number: 10.760 Federal Award Number and Year (or Other Identifying Number): 1780-12 Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Condition and Context An effective internal control system was not in place at the Town to ensure compliance with requirements related to the grant agreement and the suspension and debarment portion of the Procurement and Suspension and Debarment compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 21 TOWN OF NEW MARKET SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Prior to entering into subawards and covered transactions with federal funds, recipients are required to verify that contractors and vendors are not suspended, debarred, or otherwise excluded from receiving those federal funds. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under procurement and nonprocurement transactions (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification is to be done by checking SAM exclusions online, collecting a certification from that vendor/contractor, or adding a clause or condition to the covered transaction with that vendor/contractor. The Town had two contracted vendors related to this project with combined federal expenditures of $1,530,838 during the audit period including its engineering and main construction firms. The Town could not provide documentation that procedures were performed to verify that each of these vendors paid from the grant were not excluded or disqualified from participation in federal programs. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 180.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person." Cause Town officials were unaware of the grant's requirements regarding suspension and debarment. The Town did not have a documented federal procurement policy to ensure that the suspension and debarment status of contractors and vendors receiving federal funds was conducted prior to entering into the covered transactions or contracts. The Clerk-Treasurer is new to the position and is still working to implement internal controls over the Town's federal grant programs. INDIANA STATE BOARD OF ACCOUNTS 22 TOWN OF NEW MARKET SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the Town cannot ensure the vendors paid with federal funds are eligible to participate in federal programs. Any program funds the Town used to pay vendors that have been suspended or debarred would be unallowable, and the funding agency could potentially recover them. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions or the federal award could result in the loss of future federal funding to the Town. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the Town adopt a federal procurement policy and implement a system of internal controls to ensure that all contractors and vendors that are paid $25,000 or more, all or in-part with federal funds, are not suspended or debarred from participating in federal programs before entering into any covered transactions. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: Water and Waste Disposal Systems for Rural Communities - Reporting Federal Agency: Department of Agriculture Federal Program: Water and Waste Disposal Systems for Rural Communities Assistance Listings Number: 10.760 Federal Award Number and Year (or Other Identifying Number): 1780-12 Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion Condition and Context The Town had not designed or implemented adequate internal controls and procedures to ensure that reports were prepared, accurate, and submitted in accordance with the applicable compliance requirements for the federal grant. The United States Department of Agriculture (USDA) requires the following reports be submitted annually: • Statement of Budget, Income, and Equity (Form RD 442-2) • Balance Sheet (Form RD 442-3) The Form RD 442-2 covers financial operations relating to the Town's sewer construction and improvement project, and the Form RD 442-3 presents the financial status of the project. In both instances, a borrower may submit the financial data on other forms, provided the forms are in a similar format and signed and dated by the organization's official to certify the correctness of the information. Alternatively, an annual audit may be submitted in lieu of the forms. INDIANA STATE BOARD OF ACCOUNTS 23 TOWN OF NEW MARKET SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) The Town was required to file each report, as noted above, during the audit period; however, the reports were not filed nor was an annual audit filed by the September 30, 2025 Single Audit deadline, as the Town did not report any federal expenditures to the USDA or the Indiana State Board of Accounts. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 7 CFR 1780.47(e) states in part: ". . . within 60 days following the end of each fiscal year, furnish the RUS with annual financial statements, consisting of a verification of the organization's balance sheet and statement of income and expense by an appropriate official of the organization. Forms RD 442-2, 'Statement of Budget, Income and Equity,' and 442-3 may be used." Cause The Town was unable to provide documentation to show that the Form RD 442-2 and the Form RD 442-3 reports were filed. The Clerk-Treasurer is new to the position and is still working to implement internal controls over the Town's federal grant programs. Effect Without the proper implementation of an effectively designed system of internal controls, the Town could not ensure that the required reports were filed with the awarding agency. As such, the awarding agency did not have accurate and current information to discern the financial status of the Town's project. Furthermore, noncompliance with the provisions of federal statutes, regulations, and the terms and conditions or the federal award could result in the loss of future federal funding to the Town. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 24 TOWN OF NEW MARKET SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that the Town's management design and implement a system of internal controls that would provide segregation of duties for the preparation and review of federal reports to ensure appropriate reviews, approvals, and oversight are taking place. Additionally, management should develop policies and procedures to ensure that all required reports are filed timely and accurately and ensure that federal awards are properly reported to both the federal and state regulatory agencies to ensure the federal Single Audit deadline is met. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Criteria: HUD’s Continuum of Care program (ALN 14.267) requires that participant eligibility determinations, including income calculations and rent reasonableness assessments, be accurate, properly supported, and in compliance with program requirements. These determinations should be subject to appropriate internal control procedures, including review controls, to ensure accuracy and reduce the risk of error or conflict of interest. In accordance with 2 CFR § 200.303, organizations must establish and maintain effective internal controls over compliance, including segregation of duties and ongoing monitoring activities. Additionally, 24CFR § 578.103 requires recipients to maintain sufficient documentation to support eligibility determinations and related compliance requirements. Conditions: In a nonstatistical sample of 18 tenant files tested, there was no evidence of documented supervisory review of eligibility determinations, income calculations, or supporting documentation. These results indicate that controls designed to ensure completeness and accuracy of eligibility determinations are not operating effectively. Cause and Effect: This condition appears to be due to the absence of a formalized policy or consistent practice requiring documented supervisory review of eligibility determinations. We identified a significant deficiency in internal control over compliance related to this process. Although eligibility determinations were generally appropriate based on testing, the lack of documented review indicates that a key control is not operating effectively. This increases the risk that errors or noncompliance could occur and not be detected in a timely manner. No questioned costs were identified as a result of this condition. Recommendations: We recommend management strengthen controls over eligibility determinations by requiring documented supervisory review of all initial eligibility decisions and periodic file reviews. This review should be evidenced by a formal sign-off (electronic or manual) and include verification of key eligibility criteria. Management may also consider implementing a standardized review checklist to ensure consistency and completeness of the review process.

Criteria: HUD’s Continuum of Care program (ALN 14.267) requires that participant annual income be determined using gross income in accordance with 24 CFR § 5.609 and 24 CFR § 5.611, and that such determinations be supported by adequate and verifiable source documentation. Recipients are required to maintain complete and accurate participant files, including signed income certifications, zero-income affidavits where applicable, and sufficient third-party or source documentation (e.g., pay stubs) to support income calculations. In accordance with 2 CFR § 200.303, organizations must establish and maintain effective internal controls over compliance to ensure that income determinations and rent calculations are accurate, complete, and properly documented. Conditions: Our testing of 18 tenant files identified deficiencies in income documentation and rent calculation support. Specifically, 2 tenant files lacked documented zero-income verification, 2 files contained insufficient supporting pay documentation, 1 file was missing a signed income certification, and in 2 instances rent calculations were based on net wages rather than gross wages. These results indicate that controls over income verification and rent calculation documentation are not consistently operating effectively. Cause and Effect: This condition appears to be due to inconsistent application of documentation requirements and the absence of a formalized review process to ensure completeness and accuracy of income determinations and rent calculations. We identified a significant deficiency in internal control over compliance related to income verification and rent calculation documentation. While rent calculations appeared reasonable based on available information and no questioned costs were identified, the control deficiencies increase the risk that errors or noncompliance could occur and not be detected in a timely manner. Recommendations: We recommend management enhance controls over income verification and rent calculation documentation by implementing standardized documentation requirements and file checklists to ensure all required support (e.g., pay stubs, zero-income affidavits, and calculation worksheets) is obtained and retained prior to approval of assistance. Additionally, a secondary review should be performed and documented to verify the completeness and accuracy of income determinations and rent calculations.

Criteria: HUD’s Continuum of Care program (ALN 14.267) requires that rental assistance payments comply with rent reasonableness requirements in accordance with 24 CFR § 578.49. Rent reasonableness must be determined and documented prior to execution of the lease and before assistance is provided, and must be based on accurate lease terms, unit characteristics, and comparable market data. Additionally, participant income used in determining rent contributions must be calculated in accordance with 24 CFR § 5.609 and 24 CFR § 5.611. In accordance with 2 CFR § 200.303, organizations are required to establish and maintain effective internal controls over compliance to ensure that rent determinations are accurate, properly supported, and performed in a timely manner. Conditions: Our testing of 18 tenant files identified deficiencies in the timeliness and accuracy of rent reasonableness determinations. Specifically, in 4 instances, rent reasonableness calculations were performed after lease execution, and in 5 instances, the calculations were based on incorrect lease amounts. These results indicate that controls over the timeliness and accuracy of rent reasonableness determinations are not consistently operating effectively. Cause and Effect: This condition appears to be due to inadequate internal controls and monitoring procedures to ensure that rent reasonableness determinations are completed prior to lease execution and that lease terms are verified for accuracy before performing the analysis. We identified a significant deficiency in internal control over compliance related to rent reasonableness determinations. The lack of timely and accurate determinations increases the risk that the program could approve rents that exceed market rates, resulting in potential noncompliance with program requirements and inefficient use of program funds. No questioned costs were identified as a result of this condition. Recommendations: We recommend management implement formal procedures requiring that rent reasonableness determinations are completed and documented prior to lease execution and approval of assistance. Management should establish standardized checklists or workflows to ensure rent reasonableness is performed as a required step before assistance is authorized. Additionally, staff should be trained on these procedures and the importance of timely compliance. A secondary review process should be implemented to verify lease terms, unit data, and calculation accuracy. Periodic supervisory reviews should also be conducted to ensure compliance with documentation and timing requirements.

Criteria: HUD’s Continuum of Care program (ALN 14.267) requires recipients to maintain complete and accurate documentation to support participant eligibility and rental assistance in accordance with 24 CFR §578.103. Tenant-based rental assistance must be supported by a valid lease between the participant and landlord in accordance with applicable housing requirements (including 24 CFR § 982.305 and 24 CFR §982.309, as applicable through program guidance). Required participant protections and disclosures, including those under the Violence Against Women Act (VAWA), must be provided and documented in accordance with 24 CFR § 5.2005 and 24 CFR § 5.2009. In addition, housing quality standards and environmental requirements, including inspections and lead-based paint disclosures, must be completed and documented prior to assistance in accordance with 24 CFR § 982.401 and 24 CFR § 35.92. Furthermore, in accordance with 2 CFR § 200.303, organizations must establish and maintain effective internal controls to ensure required documentation is obtained, reviewed, and retained prior to the disbursement of federal funds. Where utilities are paid as a supportive service under 24 CFR § 578.51, appropriate documentation, including participant consent, must be maintained. Conditions: Our testing of 18 tenant files identified multiple instances of missing or incomplete required documentation. Specifically, 1 file lacked an executed lease agreement, 3 files contained leases with terms less than one year, 2 files were missing required RAP forms with VAWA addenda, 1 file lacked inspection documentation, 1 file was missing a Form W-9, and 1 file did not include a required lead-based paint disclosure. Additionally, among 2 Permanent Supportive Housing tenant files tested, 1 file lacked a required Consent to Pay Utilities form. These results indicate that controls over required documentation are not consistently operating effectively. Cause and Effect: This condition appears to be due to inadequate internal controls and monitoring procedures to ensure that all required documentation is obtained, completed, and retained prior to the approval and disbursement of rental assistance. Specifically, staff did not consistently utilize a standardized checklist or review process to verify file completeness. We identified a significant deficiency in internal control over compliance related to required documentation. The absence of required documentation increases the risk of noncompliance with program requirements, potential disallowance of costs, and repayment of federal funds. No questioned costs were identified as a result of this condition. Recommendations: We recommend management strengthen controls over required documentation by implementing a standardized pre-approval checklist to ensure all required documentation is obtained and verified prior to disbursement of assistance. This should include, at a minimum, a fully executed lease (including verification of lease term), RAP agreement and VAWA documentation, inspection and housing quality documentation, Form W-9, and required lead-based paint disclosures. For supportive services such as utility payments, required participant consent documentation should be obtained and retained prior to payment. Additionally, management should implement a documented secondary review process and perform periodic quality control reviews to ensure ongoing compliance. Staff should be trained on documentation requirements and file completion standards.

Criteria: HUD’s Continuum of Care program (ALN 14.267) requires recipients to provide and document matching contributions in accordance with 24 CFR § 578.73. Recipients must maintain adequate records to support the source and allowability of match contributions in accordance with 24 CFR § 578.103. In addition, in accordance with 2 CFR § 200.303, organizations are required to establish and maintain effective internal controls over compliance, including appropriate segregation of duties and review procedures, to ensure that match calculations and supporting documentation are accurate, complete, and properly supported. Conditions: Our testing of 2 Permanent Supportive Housing tenant files related to matching requirements identified that, in both instances, match calculations and supporting documentation were not reviewed and approved by an individual independent of the preparer. These results indicate that controls over the review and approval of match documentation are not operating effectively. Cause and Effect: This condition appears to be due to inadequate segregation of duties and the absence of a formalized independent review process over match calculations and supporting documentation. We identified a significant deficiency in internal control over compliance related to the matching requirement. The lack of independent review increases the risk that errors or noncompliance in match reporting could occur and not be detected in a timely manner. Although no questioned costs or instances of noncompliance were identified as a result of our testing, this control is considered important to ensuring ongoing compliance with program requirements. Recommendations: We recommend management strengthen controls over match reporting by enhancing segregation of duties and implementing an independent review process for match calculations and supporting documentation. Where full segregation of duties is not feasible, compensating controls—such as documented supervisory review by an individual not involved in preparation—should be implemented. Management should also establish formal procedures and standardized checklists to ensure match contributions are properly supported, reviewed, and approved prior to reporting. Periodic monitoring procedures should be performed to ensure continued compliance.

United States Department of the Treasury Reference Number: 2024-010 Program: 21.027 Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Number: 51-6000255 Type of Finding: Noncompliance and Significant Deficiency in Internal Controls over Compliance Compliance Requirement: Reporting Condition: The following conditions were found during testing of the Town’s Annual Report for the period April 1, 2023 through March 31, 2024. 1. The Town’s procedures over the reporting did not include documentation of the preparation and review of the report. 2. Testing of the key line items- Obligations and Expenditures - Quantifiable Objective Criteria revealed the following: a. The Town reported the budgeted amount as cumulative obligations. b. The Town reported the same amount for current period obligations, current period expenditures and cumulative expenditures. The reported amount appeared to be the calculated amount of cumulative obligations. The support for the report did not appear to calculate the current period obligations or current period expenditures. A similar finding was reported in prior years’ audits. Criteria: United States Department of the Treasury State and Local Fiscal Recovery Funds Compliance and Reporting Guidance version 5.0 was issued September 20, 2022 and provides detailed reporting requirements 31 CFR §35.3 defines obligation and 2 CFR §200.1 defines expenditures. 2 CFR § 200.303 requires the implementation of effective internal controls: “Internal control requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the conditions of the federal award.” Cause: The Town experienced turnover at key positions in the Finance Department during the year. Effect: The Town was not in compliance with the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) at 2 C.F.R. § 200.32 and the Guidance on Recipient Compliance and Reporting Responsibilities, issued by the U.S. Department of the Treasury. Recommendation: We recommend that the Finance Department enhance its processes and oversight surrounding grant financial reporting to ensure all required reports are completed accurately and timely. Views of Responsible Town Officials and Planned Corrective Actions: See corrective action plan. Responsible Positions: Town Manager and Director of Finance

Lack of Internal Controls over Substantially All Compliance Requirements Federal Agency: U.S. Department of Agriculture / U.S. Department of Education Federal Program: Child and Adult Care Food Program / Alaska Native Educational Programs ALN: 10.558 / 84.356A Award Numbers: 53301 / S356A210037 Type of Finding: Material weakness in internal control over compliance and material noncompliance. Criteria: Management is responsible for designing, implementing and maintaining internal controls relevant to ensuring that transactions charged to programs follow proper internal control processes (2 CFR Part 200 Subpart E §200.400 (d)). This includes ensuring there is proper supporting documentation for transactions as well as methods to document approval of the cost/activity to determine whether it is allowable under the funding requirements. Additionally, requirements relevant to maintaining effective internal control over Federal awards found in 2 CFR Part 200 Subpart E §200.303-Internal Controls are required to be implemented by grant recipients to provide reasonable assurance they are managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Condition and context: We were unable to obtain sufficient audit evidence to support compliance with applicable compliance requirements for all major federal programs of the Organization including Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Cash Management, Eligibility, Period of Performance, Procurement and Suspension and Debarment, Reporting and Special Tests and Provisions. The Organization was unable to provide supporting documentation for auditor’s to verify compliance with the compliance requirements listed above. Cause: Insufficient monitoring by management and the board over the financial and other activities of the Club as well as employee turnover in several positions contributed to an ineffective control environment throughout the Organization. Effect: Because adequate supporting documentation was not available for expenditures charged to the program, we could not determine whether the costs charged to the programs were allowable and in compliance with the applicable requirements. Accordingly, we consider the entire amount of expenditures for these programs during the audit period to be likely questioned costs. Questioned Costs: Likely questioned costs: Alaska Native Educational Program (ALN 84.356A) $757,173 and Child and Adult Care Food Program (ALN 10.558) $274,693 are equal to total estimated program expenditures during the period, representing the auditor’s best estimate of total questioned costs (likely questioned costs) for these major programs due to lack of adequate supporting documentation. Repeat finding: No, however due to the number of issues identified we believe this to be a systemic issue. Recommendation: We recommend that management implement a stronger internal controls environment that includes adequate staffing to maintain a segregation of duties for an effective control environment as well as improving monitoring processes to ensure the Organization is in compliance with requirements applicable to Federal statutes, regulations, and the terms and conditions of the award Management’s Response: Management concurs with the finding. See Corrective Action Plan.

Subrecipient Monitoring Federal Department – U.S. Department of Justice Pass-through Illinois Criminal Justice Information Authority Federal Award Identification Number and Year: 15JOVW-21-GG-00543-STOP and 2021 15JOVW-22-GG-00422-STOP and 2022 Violence Against Women Formula Grants, Federal Assistance Listing #16.588 County Department – State’s Attorney Office Finding 2024 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4)Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. CONDITION During the current audit period, the Cook County State’s Attorney Office (SAO) did not adequately comply with its subrecipient monitoring requirements as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding was an inadequate understanding of sub-recipient monitoring policies and best practices. While the Department believed at the time that they were in compliance with the applicable monitoring requirements, they now recognize that their efforts did not fully meet the necessary standards. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in the inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of two (2) subrecipients (of a population of 4 subrecipients), we noted the following:  For both subrecipients, we noted documentation was not maintained to support SAO’s evaluation of the subrecipients’ risk of noncompliance and the frequency of monitoring to be conducted by SAO based on the assessed risk.  We also noted for both subrecipients, no documentation was provided to verify whether the subrecipients were required to have a Single Audit conducted, including SAO’s review of the report, and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.332e(3).  The SAO utilized a “Subrecipient Monitoring Checklist” (Checklist) to conduct and document its monitoring of subrecipients. Based on review, we noted the Checklist does not include evidence of who completed the monitoring, the date the actual monitoring was performed nor the subrecipient personnel with whom the monitoring results were discussed during the site visit. Also, the Checklist appears to be inaccurately completed. Specifically, we noted the Checklist noted that the results include expected corrective actions and dates for resolution. However, there was no finding or issues noted in the formal letter submitted to the subrecipient(s) after the site visit(s). IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend SAO implement procedures to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance and review of the Single audit report, as required by Federal regulations. Also, we suggest that the Checklist be accurately prepared and updated to include evidence of who completed the monitoring, the date the actual monitoring was performed, and the subrecipient personnel with whom the monitoring results were discussed during the site visit. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 38-39.

Assistance Listing, Federal Agency, and Program Name COVID 19 21.027, U.S. Department of Treasury, Coronavirus State and Local Fiscal Recovery Fund Federal Award Identification Number and Year N/A Pass through Entity Michigan Department of Health and Human Services Finding Type Material weakness and material noncompliance with laws and regulations Repeat Finding No Criteria The City must establish and maintain effective internal controls to ensure compliance with federal requirements including period of performance as outlined in 2 CFR 200.303. Condition The City lacked adequate controls to verify that expenditures charged to the grant were incurred within the proper period of performance. Transactions were processed without sufficient review or procedures around the period of performance, resulting in expenditures being charged from outside the allowable timeframe. Questioned Costs None If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported N/A Identification of How Questioned Costs Were Computed N/A Context During the year, the City requested reimbursement for $151,621 of expenditures that were not within the period of performance. Cause and Effect The City's control for identifying whether expenditures charged to the grant was not effective as it relied on the date of the vendor's invoice and not the period in which the services were performed. As a result, reports and reimbursement requests improperly included $64,109 of expenditures incurred prior to the period of performance. The City identified the error after year end and appropriately excluded the expenditures from the final SEFA. Later, it was discovered that an additional $87,512 was improperly included on the SEFA. The City removed the additional expenditures discovered from the SEFA as well, thus creating no questioned costs. Recommendation Internal controls should be strengthened to ensure expenditures are being properly reviewed for period of performance before submitting for reimbursement. Views of Responsible Officials and Corrective Action Plan The CIty concurs with this finding and has already implemented controls to look specifically at service period of expenditures when reviewing invoices and submitting reports and reimbursement requests.

2024-101 Lack of Internal Controls over the Application of the Sliding Fee Scale (repeated, prior two years 2023-101 and 2022-101) (initially reported 2014) Assistance Listing Number: 93.224 and 93.527 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program Compliance Requirement: Special Tests and Provisions – Sliding Fee Discounts Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), COVID-19 H8L50549 (2023), and COVID-19 H8G48569 (2022). Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: The Organization lacks consistently applied processes and procedures related to the application of the sliding fee scale. The Organization also lacks a clear review process related to the sliding fee scale to identify errors quickly to allow for corrections to be made in a timely manner. This has been a systemic issue as a repeat finding in the prior years. The sample was not statistically valid. - Sliding fee scales were not used for the agreement that the Organization has in place with the local school district in which they provide services to students. The agreement specifically does not allow the Organization to obtain information related to household size and income as needed to appropriately place the family on the sliding fee scale. The agreement also indicates no amounts can be collected from the students, except when that student has insurance which allows the Organization to bill the insurance company for a portion of the fees. - Sliding fee scales are not used in the disaster recovery bus program that does not charge the patients for services. - Thirteen of the sixty encounters sampled where the sliding scale was used had the wrong sliding fee scale applied based on information obtained about the patient’s family size and income. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Health centers must prepare and apply a sliding fee discount schedule, so that the amounts owed for health center services by eligible patients are adjusted based on the patient's ability to pay (42 U.S.C 254b(k)(3)(G)(i)). The patient's ability to pay is based on the official poverty guidelines, as revised annually by the U.S. Department of Health and Human Services (42 U.S.C 9902(2)). Cause: Failure to apply the sliding fee correctly, as noted in 13 of the encounters above, was due to improper staff training or failure to properly monitor the process. Failure to apply the sliding fee scales due to the requirements of the agreement with the local school district and procedures applied to the disaster recovery bus program do not follow the written procedures of the Organization for use of the sliding fee scale. Effect: The Organization could be incorrectly billing for services and maintaining customer account balances at incorrect amounts. Recommendation: Staff should be consistently trained in how patients should complete the intake forms, including the sliding fee scale application, and require patients complete the form appropriately, including refusal to provide information, if applicable. Staff should also be consistently trained in what documentation is considered sufficient to support income identified as well as verify the application is consistent with the documentation and, when needed, clearly document the reasons for inconsistency. Staff should make every effort to obtain documentation of patient income in accordance with internal policies and procedures. Patients should be billed the usual and customary billing rates for all services until all documentation is received, or policies are adjusted to allow for self-determination by patients in certain situations. A process should be put in place to track patients to attempt further collection of the necessary data that would allow for adjustment of the bill after the fact when necessary. These exceptions should be tracked each month with the monthly review by the regional operations managers. The reviews by the regional operations managers should be documented and retained including the results and corrective action of the follow-up on deficiencies noted. The Organization should discuss with HRSA what could be done to either adjust policies and procedures used during the school visits to be compliant or obtain a waiver from HRSA to indicate their knowledge and approval of the school visits and disaster bus program visits not being compliant with the application of the sliding fee scale requirements. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The Billing and Collections Policy was updated to waive co-pays for students in the School-Based Program. The Billing Department is in the process of auditing and implementing quarterly feedback & training sessions for the Operations Department for training and compliance for the Sliding Fee Discount Program. This process was implemented in 2025.

2024-104 Lack of Controls Related to Filing Reports (repeated, prior years 2023-104) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Reporting Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), C1650381 (2023), COVID-19 H8L50549 (2023), COVID-19 H8G48569 (2022).GA142923 (2021) G2846293 (2022) and G3949501 (2023) Finding Type: Significant Deficiency in Internal Control Questioned Costs: $0 Condition: The Organization did not maintain proper documentation to support the review of the report prior to submission to the grantor, other than the review done by the preparer. In four of the reports selected for testing under ALN 93.224 and 93.527 two reports did not have documentation of approval by the CEO prior to submission. In three of the reports selected for testing under ALN 93.211 two reports did not have documentation of approval by the CEO prior to submission. This is a systemic issue that has been a finding in the previous year. The sample was not statistically valid. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: The Organization did not have a process in place for review of the data being reported on the HRSA website for the funds being expensed under the federal award programs. Effect: The Organization could submit incorrect information. Recommendation: Documentation should be kept that clearly documents who prepared the information, who reviewed the information, and that the reviewer considered whether the information was complete and accurate. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The accounting staff was restructured in November 2024 with the addition of a Finance Manager and Senior Accountant to strengthen internal controls and facilitate segregation of duties best practices for day-to-day activities. In addition to review of month-end journal entries, reporting requirements with additional review was also implemented in 2025.

2024-105 Lack of Payroll Review and Approval (repeated, prior year 2023-105) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs, Period of Performance Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: No documentation of employee time approval by supervisors could be provided. The payroll clerk processes the payroll, and the finance director approves through the releasing of the payroll. However, there is no formal documentation of the overall review of the payroll process and the supervisors’ approval of time recorded by employees. This is a systemic issue and has been a finding in the previous year. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards The requirement is for the Organization to have a process in place to correctly calculate, record, and pay payroll related expenses in accordance with grant and program requirements. Cause: The Organization does not have an effective process to review, approve, and document the supervisor’s approvals prior to making the payments. Effect: This situation provides an opportunity for errors and unauthorized transactions to occur and not be detected in a timely manner resulting in payroll expenses to be charged incorrectly to the federal awards. Recommendation: In April 2024, the Organization began using a third-party service provider to process payroll resulting in new control processes over the approval of time sheets by supervisors. We recommend that the Organization implement internal control procedures under the new payroll processes to ensure that documentation of supervisor approval of time sheets and subsequent payments is kept on file. Views of Responsible Officials and Planned Corrective Actions: The Organization has implemented a new payroll process using the ADP system. Employees are now required to approve their own time within the ADP portal, and this approval is documented. Following this, supervisors review and approve their employees’ time, which is also documented in the portal. Human Resources then prepares the payroll, reviewing all entries and initialing a shared file of payroll items and providing backup for changes. Once HR confirms accuracy, they notify Finance. Finance then reviews the payroll, with the Finance Manager providing the final approval within ADP once all items are confirmed. This entire process is fully documented, with approvals recorded within ADP by employees and supervisors and the shared file drive where HR and Finance initial off on the reviewed payroll items, ensuring a traceable record of the entire payroll approval process.

2024-106 Lack of Time and Effort Documentation Policy (Initially reported 2024) Assistance Listing Number: 93.224, 93.527 and 93.211. Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program, and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: Time and effort reporting on actual hours spent on individual grant projects used to support the budgeted allocations of employee salary for each grant are not being kept. This is a systemic issue as a procedure for documenting time and effort by employee to justify the allocation of salaries across grants has not been put in place. This is a systematic issue. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Also, under eCFR 2 CFR 200.430 – Compensation – personal services budget estimates do not qualify as support for charges to federal awards. Cause: The Organization has not put into practice a procedure where records are kept with employee salaries spent by hour on individual grants to substantiate the amount of budgeted FTE used on the reimbursement requests. Effect: Budgeted FTE used for reimbursement requests may be inaccurate resulting in incorrect amounts being requested for reimbursement. Recommendation: The Organization should put in place procedures to accurately document employee hours spent on each of the federal awards to support the budgeted FTE used on the reimbursement requests. Views of Responsible Officials and Planned Corrective Action: We acknowledge the finding and have adopted a formal Time and Effort Reporting Policy. Standardized timesheets will be implemented and staff trained within 60 days, with supervisors reviewing submissions. The Finance Manager will monitor records monthly and conduct quarterly reviews to ensure compliance going forward.

2024-101 Lack of Internal Controls over the Application of the Sliding Fee Scale (repeated, prior two years 2023-101 and 2022-101) (initially reported 2014) Assistance Listing Number: 93.224 and 93.527 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program Compliance Requirement: Special Tests and Provisions – Sliding Fee Discounts Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), COVID-19 H8L50549 (2023), and COVID-19 H8G48569 (2022). Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: The Organization lacks consistently applied processes and procedures related to the application of the sliding fee scale. The Organization also lacks a clear review process related to the sliding fee scale to identify errors quickly to allow for corrections to be made in a timely manner. This has been a systemic issue as a repeat finding in the prior years. The sample was not statistically valid. - Sliding fee scales were not used for the agreement that the Organization has in place with the local school district in which they provide services to students. The agreement specifically does not allow the Organization to obtain information related to household size and income as needed to appropriately place the family on the sliding fee scale. The agreement also indicates no amounts can be collected from the students, except when that student has insurance which allows the Organization to bill the insurance company for a portion of the fees. - Sliding fee scales are not used in the disaster recovery bus program that does not charge the patients for services. - Thirteen of the sixty encounters sampled where the sliding scale was used had the wrong sliding fee scale applied based on information obtained about the patient’s family size and income. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Health centers must prepare and apply a sliding fee discount schedule, so that the amounts owed for health center services by eligible patients are adjusted based on the patient's ability to pay (42 U.S.C 254b(k)(3)(G)(i)). The patient's ability to pay is based on the official poverty guidelines, as revised annually by the U.S. Department of Health and Human Services (42 U.S.C 9902(2)). Cause: Failure to apply the sliding fee correctly, as noted in 13 of the encounters above, was due to improper staff training or failure to properly monitor the process. Failure to apply the sliding fee scales due to the requirements of the agreement with the local school district and procedures applied to the disaster recovery bus program do not follow the written procedures of the Organization for use of the sliding fee scale. Effect: The Organization could be incorrectly billing for services and maintaining customer account balances at incorrect amounts. Recommendation: Staff should be consistently trained in how patients should complete the intake forms, including the sliding fee scale application, and require patients complete the form appropriately, including refusal to provide information, if applicable. Staff should also be consistently trained in what documentation is considered sufficient to support income identified as well as verify the application is consistent with the documentation and, when needed, clearly document the reasons for inconsistency. Staff should make every effort to obtain documentation of patient income in accordance with internal policies and procedures. Patients should be billed the usual and customary billing rates for all services until all documentation is received, or policies are adjusted to allow for self-determination by patients in certain situations. A process should be put in place to track patients to attempt further collection of the necessary data that would allow for adjustment of the bill after the fact when necessary. These exceptions should be tracked each month with the monthly review by the regional operations managers. The reviews by the regional operations managers should be documented and retained including the results and corrective action of the follow-up on deficiencies noted. The Organization should discuss with HRSA what could be done to either adjust policies and procedures used during the school visits to be compliant or obtain a waiver from HRSA to indicate their knowledge and approval of the school visits and disaster bus program visits not being compliant with the application of the sliding fee scale requirements. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The Billing and Collections Policy was updated to waive co-pays for students in the School-Based Program. The Billing Department is in the process of auditing and implementing quarterly feedback & training sessions for the Operations Department for training and compliance for the Sliding Fee Discount Program. This process was implemented in 2025.

2024-104 Lack of Controls Related to Filing Reports (repeated, prior years 2023-104) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Reporting Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), C1650381 (2023), COVID-19 H8L50549 (2023), COVID-19 H8G48569 (2022).GA142923 (2021) G2846293 (2022) and G3949501 (2023) Finding Type: Significant Deficiency in Internal Control Questioned Costs: $0 Condition: The Organization did not maintain proper documentation to support the review of the report prior to submission to the grantor, other than the review done by the preparer. In four of the reports selected for testing under ALN 93.224 and 93.527 two reports did not have documentation of approval by the CEO prior to submission. In three of the reports selected for testing under ALN 93.211 two reports did not have documentation of approval by the CEO prior to submission. This is a systemic issue that has been a finding in the previous year. The sample was not statistically valid. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: The Organization did not have a process in place for review of the data being reported on the HRSA website for the funds being expensed under the federal award programs. Effect: The Organization could submit incorrect information. Recommendation: Documentation should be kept that clearly documents who prepared the information, who reviewed the information, and that the reviewer considered whether the information was complete and accurate. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The accounting staff was restructured in November 2024 with the addition of a Finance Manager and Senior Accountant to strengthen internal controls and facilitate segregation of duties best practices for day-to-day activities. In addition to review of month-end journal entries, reporting requirements with additional review was also implemented in 2025.

2024-105 Lack of Payroll Review and Approval (repeated, prior year 2023-105) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs, Period of Performance Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: No documentation of employee time approval by supervisors could be provided. The payroll clerk processes the payroll, and the finance director approves through the releasing of the payroll. However, there is no formal documentation of the overall review of the payroll process and the supervisors’ approval of time recorded by employees. This is a systemic issue and has been a finding in the previous year. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards The requirement is for the Organization to have a process in place to correctly calculate, record, and pay payroll related expenses in accordance with grant and program requirements. Cause: The Organization does not have an effective process to review, approve, and document the supervisor’s approvals prior to making the payments. Effect: This situation provides an opportunity for errors and unauthorized transactions to occur and not be detected in a timely manner resulting in payroll expenses to be charged incorrectly to the federal awards. Recommendation: In April 2024, the Organization began using a third-party service provider to process payroll resulting in new control processes over the approval of time sheets by supervisors. We recommend that the Organization implement internal control procedures under the new payroll processes to ensure that documentation of supervisor approval of time sheets and subsequent payments is kept on file. Views of Responsible Officials and Planned Corrective Actions: The Organization has implemented a new payroll process using the ADP system. Employees are now required to approve their own time within the ADP portal, and this approval is documented. Following this, supervisors review and approve their employees’ time, which is also documented in the portal. Human Resources then prepares the payroll, reviewing all entries and initialing a shared file of payroll items and providing backup for changes. Once HR confirms accuracy, they notify Finance. Finance then reviews the payroll, with the Finance Manager providing the final approval within ADP once all items are confirmed. This entire process is fully documented, with approvals recorded within ADP by employees and supervisors and the shared file drive where HR and Finance initial off on the reviewed payroll items, ensuring a traceable record of the entire payroll approval process.

2024-106 Lack of Time and Effort Documentation Policy (Initially reported 2024) Assistance Listing Number: 93.224, 93.527 and 93.211. Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program, and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: Time and effort reporting on actual hours spent on individual grant projects used to support the budgeted allocations of employee salary for each grant are not being kept. This is a systemic issue as a procedure for documenting time and effort by employee to justify the allocation of salaries across grants has not been put in place. This is a systematic issue. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Also, under eCFR 2 CFR 200.430 – Compensation – personal services budget estimates do not qualify as support for charges to federal awards. Cause: The Organization has not put into practice a procedure where records are kept with employee salaries spent by hour on individual grants to substantiate the amount of budgeted FTE used on the reimbursement requests. Effect: Budgeted FTE used for reimbursement requests may be inaccurate resulting in incorrect amounts being requested for reimbursement. Recommendation: The Organization should put in place procedures to accurately document employee hours spent on each of the federal awards to support the budgeted FTE used on the reimbursement requests. Views of Responsible Officials and Planned Corrective Action: We acknowledge the finding and have adopted a formal Time and Effort Reporting Policy. Standardized timesheets will be implemented and staff trained within 60 days, with supervisors reviewing submissions. The Finance Manager will monitor records monthly and conduct quarterly reviews to ensure compliance going forward.

2024-101 Lack of Internal Controls over the Application of the Sliding Fee Scale (repeated, prior two years 2023-101 and 2022-101) (initially reported 2014) Assistance Listing Number: 93.224 and 93.527 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program Compliance Requirement: Special Tests and Provisions – Sliding Fee Discounts Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), COVID-19 H8L50549 (2023), and COVID-19 H8G48569 (2022). Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: The Organization lacks consistently applied processes and procedures related to the application of the sliding fee scale. The Organization also lacks a clear review process related to the sliding fee scale to identify errors quickly to allow for corrections to be made in a timely manner. This has been a systemic issue as a repeat finding in the prior years. The sample was not statistically valid. - Sliding fee scales were not used for the agreement that the Organization has in place with the local school district in which they provide services to students. The agreement specifically does not allow the Organization to obtain information related to household size and income as needed to appropriately place the family on the sliding fee scale. The agreement also indicates no amounts can be collected from the students, except when that student has insurance which allows the Organization to bill the insurance company for a portion of the fees. - Sliding fee scales are not used in the disaster recovery bus program that does not charge the patients for services. - Thirteen of the sixty encounters sampled where the sliding scale was used had the wrong sliding fee scale applied based on information obtained about the patient’s family size and income. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Health centers must prepare and apply a sliding fee discount schedule, so that the amounts owed for health center services by eligible patients are adjusted based on the patient's ability to pay (42 U.S.C 254b(k)(3)(G)(i)). The patient's ability to pay is based on the official poverty guidelines, as revised annually by the U.S. Department of Health and Human Services (42 U.S.C 9902(2)). Cause: Failure to apply the sliding fee correctly, as noted in 13 of the encounters above, was due to improper staff training or failure to properly monitor the process. Failure to apply the sliding fee scales due to the requirements of the agreement with the local school district and procedures applied to the disaster recovery bus program do not follow the written procedures of the Organization for use of the sliding fee scale. Effect: The Organization could be incorrectly billing for services and maintaining customer account balances at incorrect amounts. Recommendation: Staff should be consistently trained in how patients should complete the intake forms, including the sliding fee scale application, and require patients complete the form appropriately, including refusal to provide information, if applicable. Staff should also be consistently trained in what documentation is considered sufficient to support income identified as well as verify the application is consistent with the documentation and, when needed, clearly document the reasons for inconsistency. Staff should make every effort to obtain documentation of patient income in accordance with internal policies and procedures. Patients should be billed the usual and customary billing rates for all services until all documentation is received, or policies are adjusted to allow for self-determination by patients in certain situations. A process should be put in place to track patients to attempt further collection of the necessary data that would allow for adjustment of the bill after the fact when necessary. These exceptions should be tracked each month with the monthly review by the regional operations managers. The reviews by the regional operations managers should be documented and retained including the results and corrective action of the follow-up on deficiencies noted. The Organization should discuss with HRSA what could be done to either adjust policies and procedures used during the school visits to be compliant or obtain a waiver from HRSA to indicate their knowledge and approval of the school visits and disaster bus program visits not being compliant with the application of the sliding fee scale requirements. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The Billing and Collections Policy was updated to waive co-pays for students in the School-Based Program. The Billing Department is in the process of auditing and implementing quarterly feedback & training sessions for the Operations Department for training and compliance for the Sliding Fee Discount Program. This process was implemented in 2025.

2024-104 Lack of Controls Related to Filing Reports (repeated, prior years 2023-104) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Reporting Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), C1650381 (2023), COVID-19 H8L50549 (2023), COVID-19 H8G48569 (2022).GA142923 (2021) G2846293 (2022) and G3949501 (2023) Finding Type: Significant Deficiency in Internal Control Questioned Costs: $0 Condition: The Organization did not maintain proper documentation to support the review of the report prior to submission to the grantor, other than the review done by the preparer. In four of the reports selected for testing under ALN 93.224 and 93.527 two reports did not have documentation of approval by the CEO prior to submission. In three of the reports selected for testing under ALN 93.211 two reports did not have documentation of approval by the CEO prior to submission. This is a systemic issue that has been a finding in the previous year. The sample was not statistically valid. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: The Organization did not have a process in place for review of the data being reported on the HRSA website for the funds being expensed under the federal award programs. Effect: The Organization could submit incorrect information. Recommendation: Documentation should be kept that clearly documents who prepared the information, who reviewed the information, and that the reviewer considered whether the information was complete and accurate. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The accounting staff was restructured in November 2024 with the addition of a Finance Manager and Senior Accountant to strengthen internal controls and facilitate segregation of duties best practices for day-to-day activities. In addition to review of month-end journal entries, reporting requirements with additional review was also implemented in 2025.

2024-105 Lack of Payroll Review and Approval (repeated, prior year 2023-105) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs, Period of Performance Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: No documentation of employee time approval by supervisors could be provided. The payroll clerk processes the payroll, and the finance director approves through the releasing of the payroll. However, there is no formal documentation of the overall review of the payroll process and the supervisors’ approval of time recorded by employees. This is a systemic issue and has been a finding in the previous year. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards The requirement is for the Organization to have a process in place to correctly calculate, record, and pay payroll related expenses in accordance with grant and program requirements. Cause: The Organization does not have an effective process to review, approve, and document the supervisor’s approvals prior to making the payments. Effect: This situation provides an opportunity for errors and unauthorized transactions to occur and not be detected in a timely manner resulting in payroll expenses to be charged incorrectly to the federal awards. Recommendation: In April 2024, the Organization began using a third-party service provider to process payroll resulting in new control processes over the approval of time sheets by supervisors. We recommend that the Organization implement internal control procedures under the new payroll processes to ensure that documentation of supervisor approval of time sheets and subsequent payments is kept on file. Views of Responsible Officials and Planned Corrective Actions: The Organization has implemented a new payroll process using the ADP system. Employees are now required to approve their own time within the ADP portal, and this approval is documented. Following this, supervisors review and approve their employees’ time, which is also documented in the portal. Human Resources then prepares the payroll, reviewing all entries and initialing a shared file of payroll items and providing backup for changes. Once HR confirms accuracy, they notify Finance. Finance then reviews the payroll, with the Finance Manager providing the final approval within ADP once all items are confirmed. This entire process is fully documented, with approvals recorded within ADP by employees and supervisors and the shared file drive where HR and Finance initial off on the reviewed payroll items, ensuring a traceable record of the entire payroll approval process.

2024-106 Lack of Time and Effort Documentation Policy (Initially reported 2024) Assistance Listing Number: 93.224, 93.527 and 93.211. Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program, and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: Time and effort reporting on actual hours spent on individual grant projects used to support the budgeted allocations of employee salary for each grant are not being kept. This is a systemic issue as a procedure for documenting time and effort by employee to justify the allocation of salaries across grants has not been put in place. This is a systematic issue. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Also, under eCFR 2 CFR 200.430 – Compensation – personal services budget estimates do not qualify as support for charges to federal awards. Cause: The Organization has not put into practice a procedure where records are kept with employee salaries spent by hour on individual grants to substantiate the amount of budgeted FTE used on the reimbursement requests. Effect: Budgeted FTE used for reimbursement requests may be inaccurate resulting in incorrect amounts being requested for reimbursement. Recommendation: The Organization should put in place procedures to accurately document employee hours spent on each of the federal awards to support the budgeted FTE used on the reimbursement requests. Views of Responsible Officials and Planned Corrective Action: We acknowledge the finding and have adopted a formal Time and Effort Reporting Policy. Standardized timesheets will be implemented and staff trained within 60 days, with supervisors reviewing submissions. The Finance Manager will monitor records monthly and conduct quarterly reviews to ensure compliance going forward.

2024-101 Lack of Internal Controls over the Application of the Sliding Fee Scale (repeated, prior two years 2023-101 and 2022-101) (initially reported 2014) Assistance Listing Number: 93.224 and 93.527 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program Compliance Requirement: Special Tests and Provisions – Sliding Fee Discounts Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), COVID-19 H8L50549 (2023), and COVID-19 H8G48569 (2022). Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: The Organization lacks consistently applied processes and procedures related to the application of the sliding fee scale. The Organization also lacks a clear review process related to the sliding fee scale to identify errors quickly to allow for corrections to be made in a timely manner. This has been a systemic issue as a repeat finding in the prior years. The sample was not statistically valid. - Sliding fee scales were not used for the agreement that the Organization has in place with the local school district in which they provide services to students. The agreement specifically does not allow the Organization to obtain information related to household size and income as needed to appropriately place the family on the sliding fee scale. The agreement also indicates no amounts can be collected from the students, except when that student has insurance which allows the Organization to bill the insurance company for a portion of the fees. - Sliding fee scales are not used in the disaster recovery bus program that does not charge the patients for services. - Thirteen of the sixty encounters sampled where the sliding scale was used had the wrong sliding fee scale applied based on information obtained about the patient’s family size and income. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Health centers must prepare and apply a sliding fee discount schedule, so that the amounts owed for health center services by eligible patients are adjusted based on the patient's ability to pay (42 U.S.C 254b(k)(3)(G)(i)). The patient's ability to pay is based on the official poverty guidelines, as revised annually by the U.S. Department of Health and Human Services (42 U.S.C 9902(2)). Cause: Failure to apply the sliding fee correctly, as noted in 13 of the encounters above, was due to improper staff training or failure to properly monitor the process. Failure to apply the sliding fee scales due to the requirements of the agreement with the local school district and procedures applied to the disaster recovery bus program do not follow the written procedures of the Organization for use of the sliding fee scale. Effect: The Organization could be incorrectly billing for services and maintaining customer account balances at incorrect amounts. Recommendation: Staff should be consistently trained in how patients should complete the intake forms, including the sliding fee scale application, and require patients complete the form appropriately, including refusal to provide information, if applicable. Staff should also be consistently trained in what documentation is considered sufficient to support income identified as well as verify the application is consistent with the documentation and, when needed, clearly document the reasons for inconsistency. Staff should make every effort to obtain documentation of patient income in accordance with internal policies and procedures. Patients should be billed the usual and customary billing rates for all services until all documentation is received, or policies are adjusted to allow for self-determination by patients in certain situations. A process should be put in place to track patients to attempt further collection of the necessary data that would allow for adjustment of the bill after the fact when necessary. These exceptions should be tracked each month with the monthly review by the regional operations managers. The reviews by the regional operations managers should be documented and retained including the results and corrective action of the follow-up on deficiencies noted. The Organization should discuss with HRSA what could be done to either adjust policies and procedures used during the school visits to be compliant or obtain a waiver from HRSA to indicate their knowledge and approval of the school visits and disaster bus program visits not being compliant with the application of the sliding fee scale requirements. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The Billing and Collections Policy was updated to waive co-pays for students in the School-Based Program. The Billing Department is in the process of auditing and implementing quarterly feedback & training sessions for the Operations Department for training and compliance for the Sliding Fee Discount Program. This process was implemented in 2025.

2024-104 Lack of Controls Related to Filing Reports (repeated, prior years 2023-104) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Reporting Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), C1650381 (2023), COVID-19 H8L50549 (2023), COVID-19 H8G48569 (2022).GA142923 (2021) G2846293 (2022) and G3949501 (2023) Finding Type: Significant Deficiency in Internal Control Questioned Costs: $0 Condition: The Organization did not maintain proper documentation to support the review of the report prior to submission to the grantor, other than the review done by the preparer. In four of the reports selected for testing under ALN 93.224 and 93.527 two reports did not have documentation of approval by the CEO prior to submission. In three of the reports selected for testing under ALN 93.211 two reports did not have documentation of approval by the CEO prior to submission. This is a systemic issue that has been a finding in the previous year. The sample was not statistically valid. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: The Organization did not have a process in place for review of the data being reported on the HRSA website for the funds being expensed under the federal award programs. Effect: The Organization could submit incorrect information. Recommendation: Documentation should be kept that clearly documents who prepared the information, who reviewed the information, and that the reviewer considered whether the information was complete and accurate. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The accounting staff was restructured in November 2024 with the addition of a Finance Manager and Senior Accountant to strengthen internal controls and facilitate segregation of duties best practices for day-to-day activities. In addition to review of month-end journal entries, reporting requirements with additional review was also implemented in 2025.

2024-105 Lack of Payroll Review and Approval (repeated, prior year 2023-105) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs, Period of Performance Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: No documentation of employee time approval by supervisors could be provided. The payroll clerk processes the payroll, and the finance director approves through the releasing of the payroll. However, there is no formal documentation of the overall review of the payroll process and the supervisors’ approval of time recorded by employees. This is a systemic issue and has been a finding in the previous year. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards The requirement is for the Organization to have a process in place to correctly calculate, record, and pay payroll related expenses in accordance with grant and program requirements. Cause: The Organization does not have an effective process to review, approve, and document the supervisor’s approvals prior to making the payments. Effect: This situation provides an opportunity for errors and unauthorized transactions to occur and not be detected in a timely manner resulting in payroll expenses to be charged incorrectly to the federal awards. Recommendation: In April 2024, the Organization began using a third-party service provider to process payroll resulting in new control processes over the approval of time sheets by supervisors. We recommend that the Organization implement internal control procedures under the new payroll processes to ensure that documentation of supervisor approval of time sheets and subsequent payments is kept on file. Views of Responsible Officials and Planned Corrective Actions: The Organization has implemented a new payroll process using the ADP system. Employees are now required to approve their own time within the ADP portal, and this approval is documented. Following this, supervisors review and approve their employees’ time, which is also documented in the portal. Human Resources then prepares the payroll, reviewing all entries and initialing a shared file of payroll items and providing backup for changes. Once HR confirms accuracy, they notify Finance. Finance then reviews the payroll, with the Finance Manager providing the final approval within ADP once all items are confirmed. This entire process is fully documented, with approvals recorded within ADP by employees and supervisors and the shared file drive where HR and Finance initial off on the reviewed payroll items, ensuring a traceable record of the entire payroll approval process.

2024-106 Lack of Time and Effort Documentation Policy (Initially reported 2024) Assistance Listing Number: 93.224, 93.527 and 93.211. Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program, and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: Time and effort reporting on actual hours spent on individual grant projects used to support the budgeted allocations of employee salary for each grant are not being kept. This is a systemic issue as a procedure for documenting time and effort by employee to justify the allocation of salaries across grants has not been put in place. This is a systematic issue. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Also, under eCFR 2 CFR 200.430 – Compensation – personal services budget estimates do not qualify as support for charges to federal awards. Cause: The Organization has not put into practice a procedure where records are kept with employee salaries spent by hour on individual grants to substantiate the amount of budgeted FTE used on the reimbursement requests. Effect: Budgeted FTE used for reimbursement requests may be inaccurate resulting in incorrect amounts being requested for reimbursement. Recommendation: The Organization should put in place procedures to accurately document employee hours spent on each of the federal awards to support the budgeted FTE used on the reimbursement requests. Views of Responsible Officials and Planned Corrective Action: We acknowledge the finding and have adopted a formal Time and Effort Reporting Policy. Standardized timesheets will be implemented and staff trained within 60 days, with supervisors reviewing submissions. The Finance Manager will monitor records monthly and conduct quarterly reviews to ensure compliance going forward.

2024-101 Lack of Internal Controls over the Application of the Sliding Fee Scale (repeated, prior two years 2023-101 and 2022-101) (initially reported 2014) Assistance Listing Number: 93.224 and 93.527 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program Compliance Requirement: Special Tests and Provisions – Sliding Fee Discounts Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), COVID-19 H8L50549 (2023), and COVID-19 H8G48569 (2022). Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: The Organization lacks consistently applied processes and procedures related to the application of the sliding fee scale. The Organization also lacks a clear review process related to the sliding fee scale to identify errors quickly to allow for corrections to be made in a timely manner. This has been a systemic issue as a repeat finding in the prior years. The sample was not statistically valid. - Sliding fee scales were not used for the agreement that the Organization has in place with the local school district in which they provide services to students. The agreement specifically does not allow the Organization to obtain information related to household size and income as needed to appropriately place the family on the sliding fee scale. The agreement also indicates no amounts can be collected from the students, except when that student has insurance which allows the Organization to bill the insurance company for a portion of the fees. - Sliding fee scales are not used in the disaster recovery bus program that does not charge the patients for services. - Thirteen of the sixty encounters sampled where the sliding scale was used had the wrong sliding fee scale applied based on information obtained about the patient’s family size and income. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Health centers must prepare and apply a sliding fee discount schedule, so that the amounts owed for health center services by eligible patients are adjusted based on the patient's ability to pay (42 U.S.C 254b(k)(3)(G)(i)). The patient's ability to pay is based on the official poverty guidelines, as revised annually by the U.S. Department of Health and Human Services (42 U.S.C 9902(2)). Cause: Failure to apply the sliding fee correctly, as noted in 13 of the encounters above, was due to improper staff training or failure to properly monitor the process. Failure to apply the sliding fee scales due to the requirements of the agreement with the local school district and procedures applied to the disaster recovery bus program do not follow the written procedures of the Organization for use of the sliding fee scale. Effect: The Organization could be incorrectly billing for services and maintaining customer account balances at incorrect amounts. Recommendation: Staff should be consistently trained in how patients should complete the intake forms, including the sliding fee scale application, and require patients complete the form appropriately, including refusal to provide information, if applicable. Staff should also be consistently trained in what documentation is considered sufficient to support income identified as well as verify the application is consistent with the documentation and, when needed, clearly document the reasons for inconsistency. Staff should make every effort to obtain documentation of patient income in accordance with internal policies and procedures. Patients should be billed the usual and customary billing rates for all services until all documentation is received, or policies are adjusted to allow for self-determination by patients in certain situations. A process should be put in place to track patients to attempt further collection of the necessary data that would allow for adjustment of the bill after the fact when necessary. These exceptions should be tracked each month with the monthly review by the regional operations managers. The reviews by the regional operations managers should be documented and retained including the results and corrective action of the follow-up on deficiencies noted. The Organization should discuss with HRSA what could be done to either adjust policies and procedures used during the school visits to be compliant or obtain a waiver from HRSA to indicate their knowledge and approval of the school visits and disaster bus program visits not being compliant with the application of the sliding fee scale requirements. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The Billing and Collections Policy was updated to waive co-pays for students in the School-Based Program. The Billing Department is in the process of auditing and implementing quarterly feedback & training sessions for the Operations Department for training and compliance for the Sliding Fee Discount Program. This process was implemented in 2025.

2024-104 Lack of Controls Related to Filing Reports (repeated, prior years 2023-104) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Reporting Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), C1650381 (2023), COVID-19 H8L50549 (2023), COVID-19 H8G48569 (2022).GA142923 (2021) G2846293 (2022) and G3949501 (2023) Finding Type: Significant Deficiency in Internal Control Questioned Costs: $0 Condition: The Organization did not maintain proper documentation to support the review of the report prior to submission to the grantor, other than the review done by the preparer. In four of the reports selected for testing under ALN 93.224 and 93.527 two reports did not have documentation of approval by the CEO prior to submission. In three of the reports selected for testing under ALN 93.211 two reports did not have documentation of approval by the CEO prior to submission. This is a systemic issue that has been a finding in the previous year. The sample was not statistically valid. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: The Organization did not have a process in place for review of the data being reported on the HRSA website for the funds being expensed under the federal award programs. Effect: The Organization could submit incorrect information. Recommendation: Documentation should be kept that clearly documents who prepared the information, who reviewed the information, and that the reviewer considered whether the information was complete and accurate. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The accounting staff was restructured in November 2024 with the addition of a Finance Manager and Senior Accountant to strengthen internal controls and facilitate segregation of duties best practices for day-to-day activities. In addition to review of month-end journal entries, reporting requirements with additional review was also implemented in 2025.

2024-105 Lack of Payroll Review and Approval (repeated, prior year 2023-105) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs, Period of Performance Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: No documentation of employee time approval by supervisors could be provided. The payroll clerk processes the payroll, and the finance director approves through the releasing of the payroll. However, there is no formal documentation of the overall review of the payroll process and the supervisors’ approval of time recorded by employees. This is a systemic issue and has been a finding in the previous year. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards The requirement is for the Organization to have a process in place to correctly calculate, record, and pay payroll related expenses in accordance with grant and program requirements. Cause: The Organization does not have an effective process to review, approve, and document the supervisor’s approvals prior to making the payments. Effect: This situation provides an opportunity for errors and unauthorized transactions to occur and not be detected in a timely manner resulting in payroll expenses to be charged incorrectly to the federal awards. Recommendation: In April 2024, the Organization began using a third-party service provider to process payroll resulting in new control processes over the approval of time sheets by supervisors. We recommend that the Organization implement internal control procedures under the new payroll processes to ensure that documentation of supervisor approval of time sheets and subsequent payments is kept on file. Views of Responsible Officials and Planned Corrective Actions: The Organization has implemented a new payroll process using the ADP system. Employees are now required to approve their own time within the ADP portal, and this approval is documented. Following this, supervisors review and approve their employees’ time, which is also documented in the portal. Human Resources then prepares the payroll, reviewing all entries and initialing a shared file of payroll items and providing backup for changes. Once HR confirms accuracy, they notify Finance. Finance then reviews the payroll, with the Finance Manager providing the final approval within ADP once all items are confirmed. This entire process is fully documented, with approvals recorded within ADP by employees and supervisors and the shared file drive where HR and Finance initial off on the reviewed payroll items, ensuring a traceable record of the entire payroll approval process.

2024-106 Lack of Time and Effort Documentation Policy (Initially reported 2024) Assistance Listing Number: 93.224, 93.527 and 93.211. Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program, and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: Time and effort reporting on actual hours spent on individual grant projects used to support the budgeted allocations of employee salary for each grant are not being kept. This is a systemic issue as a procedure for documenting time and effort by employee to justify the allocation of salaries across grants has not been put in place. This is a systematic issue. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Also, under eCFR 2 CFR 200.430 – Compensation – personal services budget estimates do not qualify as support for charges to federal awards. Cause: The Organization has not put into practice a procedure where records are kept with employee salaries spent by hour on individual grants to substantiate the amount of budgeted FTE used on the reimbursement requests. Effect: Budgeted FTE used for reimbursement requests may be inaccurate resulting in incorrect amounts being requested for reimbursement. Recommendation: The Organization should put in place procedures to accurately document employee hours spent on each of the federal awards to support the budgeted FTE used on the reimbursement requests. Views of Responsible Officials and Planned Corrective Action: We acknowledge the finding and have adopted a formal Time and Effort Reporting Policy. Standardized timesheets will be implemented and staff trained within 60 days, with supervisors reviewing submissions. The Finance Manager will monitor records monthly and conduct quarterly reviews to ensure compliance going forward.

2024-104 Lack of Controls Related to Filing Reports (repeated, prior years 2023-104) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Reporting Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), C1650381 (2023), COVID-19 H8L50549 (2023), COVID-19 H8G48569 (2022).GA142923 (2021) G2846293 (2022) and G3949501 (2023) Finding Type: Significant Deficiency in Internal Control Questioned Costs: $0 Condition: The Organization did not maintain proper documentation to support the review of the report prior to submission to the grantor, other than the review done by the preparer. In four of the reports selected for testing under ALN 93.224 and 93.527 two reports did not have documentation of approval by the CEO prior to submission. In three of the reports selected for testing under ALN 93.211 two reports did not have documentation of approval by the CEO prior to submission. This is a systemic issue that has been a finding in the previous year. The sample was not statistically valid. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: The Organization did not have a process in place for review of the data being reported on the HRSA website for the funds being expensed under the federal award programs. Effect: The Organization could submit incorrect information. Recommendation: Documentation should be kept that clearly documents who prepared the information, who reviewed the information, and that the reviewer considered whether the information was complete and accurate. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The accounting staff was restructured in November 2024 with the addition of a Finance Manager and Senior Accountant to strengthen internal controls and facilitate segregation of duties best practices for day-to-day activities. In addition to review of month-end journal entries, reporting requirements with additional review was also implemented in 2025.

2024-101 Lack of Internal Controls over the Application of the Sliding Fee Scale (repeated, prior two years 2023-101 and 2022-101) (initially reported 2014) Assistance Listing Number: 93.224 and 93.527 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program Compliance Requirement: Special Tests and Provisions – Sliding Fee Discounts Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), COVID-19 H8L50549 (2023), and COVID-19 H8G48569 (2022). Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: The Organization lacks consistently applied processes and procedures related to the application of the sliding fee scale. The Organization also lacks a clear review process related to the sliding fee scale to identify errors quickly to allow for corrections to be made in a timely manner. This has been a systemic issue as a repeat finding in the prior years. The sample was not statistically valid. - Sliding fee scales were not used for the agreement that the Organization has in place with the local school district in which they provide services to students. The agreement specifically does not allow the Organization to obtain information related to household size and income as needed to appropriately place the family on the sliding fee scale. The agreement also indicates no amounts can be collected from the students, except when that student has insurance which allows the Organization to bill the insurance company for a portion of the fees. - Sliding fee scales are not used in the disaster recovery bus program that does not charge the patients for services. - Thirteen of the sixty encounters sampled where the sliding scale was used had the wrong sliding fee scale applied based on information obtained about the patient’s family size and income. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Health centers must prepare and apply a sliding fee discount schedule, so that the amounts owed for health center services by eligible patients are adjusted based on the patient's ability to pay (42 U.S.C 254b(k)(3)(G)(i)). The patient's ability to pay is based on the official poverty guidelines, as revised annually by the U.S. Department of Health and Human Services (42 U.S.C 9902(2)). Cause: Failure to apply the sliding fee correctly, as noted in 13 of the encounters above, was due to improper staff training or failure to properly monitor the process. Failure to apply the sliding fee scales due to the requirements of the agreement with the local school district and procedures applied to the disaster recovery bus program do not follow the written procedures of the Organization for use of the sliding fee scale. Effect: The Organization could be incorrectly billing for services and maintaining customer account balances at incorrect amounts. Recommendation: Staff should be consistently trained in how patients should complete the intake forms, including the sliding fee scale application, and require patients complete the form appropriately, including refusal to provide information, if applicable. Staff should also be consistently trained in what documentation is considered sufficient to support income identified as well as verify the application is consistent with the documentation and, when needed, clearly document the reasons for inconsistency. Staff should make every effort to obtain documentation of patient income in accordance with internal policies and procedures. Patients should be billed the usual and customary billing rates for all services until all documentation is received, or policies are adjusted to allow for self-determination by patients in certain situations. A process should be put in place to track patients to attempt further collection of the necessary data that would allow for adjustment of the bill after the fact when necessary. These exceptions should be tracked each month with the monthly review by the regional operations managers. The reviews by the regional operations managers should be documented and retained including the results and corrective action of the follow-up on deficiencies noted. The Organization should discuss with HRSA what could be done to either adjust policies and procedures used during the school visits to be compliant or obtain a waiver from HRSA to indicate their knowledge and approval of the school visits and disaster bus program visits not being compliant with the application of the sliding fee scale requirements. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The Billing and Collections Policy was updated to waive co-pays for students in the School-Based Program. The Billing Department is in the process of auditing and implementing quarterly feedback & training sessions for the Operations Department for training and compliance for the Sliding Fee Discount Program. This process was implemented in 2025.

2024-104 Lack of Controls Related to Filing Reports (repeated, prior years 2023-104) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Reporting Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), C1650381 (2023), COVID-19 H8L50549 (2023), COVID-19 H8G48569 (2022).GA142923 (2021) G2846293 (2022) and G3949501 (2023) Finding Type: Significant Deficiency in Internal Control Questioned Costs: $0 Condition: The Organization did not maintain proper documentation to support the review of the report prior to submission to the grantor, other than the review done by the preparer. In four of the reports selected for testing under ALN 93.224 and 93.527 two reports did not have documentation of approval by the CEO prior to submission. In three of the reports selected for testing under ALN 93.211 two reports did not have documentation of approval by the CEO prior to submission. This is a systemic issue that has been a finding in the previous year. The sample was not statistically valid. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Cause: The Organization did not have a process in place for review of the data being reported on the HRSA website for the funds being expensed under the federal award programs. Effect: The Organization could submit incorrect information. Recommendation: Documentation should be kept that clearly documents who prepared the information, who reviewed the information, and that the reviewer considered whether the information was complete and accurate. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The accounting staff was restructured in November 2024 with the addition of a Finance Manager and Senior Accountant to strengthen internal controls and facilitate segregation of duties best practices for day-to-day activities. In addition to review of month-end journal entries, reporting requirements with additional review was also implemented in 2025.

2024-105 Lack of Payroll Review and Approval (repeated, prior year 2023-105) (initially reported 2023) Assistance Listing Number: 93.224, 93.527 and 93.211 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs, Period of Performance Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: No documentation of employee time approval by supervisors could be provided. The payroll clerk processes the payroll, and the finance director approves through the releasing of the payroll. However, there is no formal documentation of the overall review of the payroll process and the supervisors’ approval of time recorded by employees. This is a systemic issue and has been a finding in the previous year. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards The requirement is for the Organization to have a process in place to correctly calculate, record, and pay payroll related expenses in accordance with grant and program requirements. Cause: The Organization does not have an effective process to review, approve, and document the supervisor’s approvals prior to making the payments. Effect: This situation provides an opportunity for errors and unauthorized transactions to occur and not be detected in a timely manner resulting in payroll expenses to be charged incorrectly to the federal awards. Recommendation: In April 2024, the Organization began using a third-party service provider to process payroll resulting in new control processes over the approval of time sheets by supervisors. We recommend that the Organization implement internal control procedures under the new payroll processes to ensure that documentation of supervisor approval of time sheets and subsequent payments is kept on file. Views of Responsible Officials and Planned Corrective Actions: The Organization has implemented a new payroll process using the ADP system. Employees are now required to approve their own time within the ADP portal, and this approval is documented. Following this, supervisors review and approve their employees’ time, which is also documented in the portal. Human Resources then prepares the payroll, reviewing all entries and initialing a shared file of payroll items and providing backup for changes. Once HR confirms accuracy, they notify Finance. Finance then reviews the payroll, with the Finance Manager providing the final approval within ADP once all items are confirmed. This entire process is fully documented, with approvals recorded within ADP by employees and supervisors and the shared file drive where HR and Finance initial off on the reviewed payroll items, ensuring a traceable record of the entire payroll approval process.

2024-106 Lack of Time and Effort Documentation Policy (Initially reported 2024) Assistance Listing Number: 93.224, 93.527 and 93.211. Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program, and Rural Telemedicine Grants Compliance Requirement: Allowable Activities and Allowable Costs Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), H8L50549 (2023), COVID-19 H8G48569 (2022), GA142923 (2021), G2846293(2022) and G3949501 (2023) Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: Time and effort reporting on actual hours spent on individual grant projects used to support the budgeted allocations of employee salary for each grant are not being kept. This is a systemic issue as a procedure for documenting time and effort by employee to justify the allocation of salaries across grants has not been put in place. This is a systematic issue. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Also, under eCFR 2 CFR 200.430 – Compensation – personal services budget estimates do not qualify as support for charges to federal awards. Cause: The Organization has not put into practice a procedure where records are kept with employee salaries spent by hour on individual grants to substantiate the amount of budgeted FTE used on the reimbursement requests. Effect: Budgeted FTE used for reimbursement requests may be inaccurate resulting in incorrect amounts being requested for reimbursement. Recommendation: The Organization should put in place procedures to accurately document employee hours spent on each of the federal awards to support the budgeted FTE used on the reimbursement requests. Views of Responsible Officials and Planned Corrective Action: We acknowledge the finding and have adopted a formal Time and Effort Reporting Policy. Standardized timesheets will be implemented and staff trained within 60 days, with supervisors reviewing submissions. The Finance Manager will monitor records monthly and conduct quarterly reviews to ensure compliance going forward.

2024-101 Lack of Internal Controls over the Application of the Sliding Fee Scale (repeated, prior two years 2023-101 and 2022-101) (initially reported 2014) Assistance Listing Number: 93.224 and 93.527 Name of Federal Agency: Department of Health and Human Services, HRSA Program Title: Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) and Grants for New and Expanded Services Under the Health Center Program Compliance Requirement: Special Tests and Provisions – Sliding Fee Discounts Pass-through Entity: N/A Federal Grant/Contract Number and Grant Year: H8006452 (2024 and 2023), H2E45500 (2022), H8K49674 (2023), COVID-19 H2E50094 (2023), H8N53812 (2024), COVID-19 H8L50549 (2023), and COVID-19 H8G48569 (2022). Finding Type: Material Weakness in Internal Control Questioned Costs: $0 Condition: The Organization lacks consistently applied processes and procedures related to the application of the sliding fee scale. The Organization also lacks a clear review process related to the sliding fee scale to identify errors quickly to allow for corrections to be made in a timely manner. This has been a systemic issue as a repeat finding in the prior years. The sample was not statistically valid. - Sliding fee scales were not used for the agreement that the Organization has in place with the local school district in which they provide services to students. The agreement specifically does not allow the Organization to obtain information related to household size and income as needed to appropriately place the family on the sliding fee scale. The agreement also indicates no amounts can be collected from the students, except when that student has insurance which allows the Organization to bill the insurance company for a portion of the fees. - Sliding fee scales are not used in the disaster recovery bus program that does not charge the patients for services. - Thirteen of the sixty encounters sampled where the sliding scale was used had the wrong sliding fee scale applied based on information obtained about the patient’s family size and income. Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Health centers must prepare and apply a sliding fee discount schedule, so that the amounts owed for health center services by eligible patients are adjusted based on the patient's ability to pay (42 U.S.C 254b(k)(3)(G)(i)). The patient's ability to pay is based on the official poverty guidelines, as revised annually by the U.S. Department of Health and Human Services (42 U.S.C 9902(2)). Cause: Failure to apply the sliding fee correctly, as noted in 13 of the encounters above, was due to improper staff training or failure to properly monitor the process. Failure to apply the sliding fee scales due to the requirements of the agreement with the local school district and procedures applied to the disaster recovery bus program do not follow the written procedures of the Organization for use of the sliding fee scale. Effect: The Organization could be incorrectly billing for services and maintaining customer account balances at incorrect amounts. Recommendation: Staff should be consistently trained in how patients should complete the intake forms, including the sliding fee scale application, and require patients complete the form appropriately, including refusal to provide information, if applicable. Staff should also be consistently trained in what documentation is considered sufficient to support income identified as well as verify the application is consistent with the documentation and, when needed, clearly document the reasons for inconsistency. Staff should make every effort to obtain documentation of patient income in accordance with internal policies and procedures. Patients should be billed the usual and customary billing rates for all services until all documentation is received, or policies are adjusted to allow for self-determination by patients in certain situations. A process should be put in place to track patients to attempt further collection of the necessary data that would allow for adjustment of the bill after the fact when necessary. These exceptions should be tracked each month with the monthly review by the regional operations managers. The reviews by the regional operations managers should be documented and retained including the results and corrective action of the follow-up on deficiencies noted. The Organization should discuss with HRSA what could be done to either adjust policies and procedures used during the school visits to be compliant or obtain a waiver from HRSA to indicate their knowledge and approval of the school visits and disaster bus program visits not being compliant with the application of the sliding fee scale requirements. Views of Responsible Officials and Planned Corrective Actions: The Organization has hired a new Chief Financial Officer as well as additional supporting staff within the finance department. The Billing and Collections Policy was updated to waive co-pays for students in the School-Based Program. The Billing Department is in the process of auditing and implementing quarterly feedback & training sessions for the Operations Department for training and compliance for the Sliding Fee Discount Program. This process was implemented in 2025.