Findings Citing § 200.303

Federal Agency: Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Identification Number and Year: SLFRP02236 - 2025 Pass-Through Agency: Ramsey County Pass-Through Number: SLFRP0236 Award Period: March 3, 2021 – December 31, 2026 Type of Finding: Material Weakness over Internal Controls Criteria or specific requirement: 2 CFR 200.303 requires that recipients and subrecipients receiving federal awards establish, document and maintain effective internal control over the federal awards that provides reasonable assurance that the recipient or subrecipient is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition: The rental units supported by the grant can only be occupied by households whose annual income does not exceed certain thresholds. Annual income is documented for purposes of eligibility and applications are maintained supporting that tenants are eligible. From our discussions with management there are no documented internal controls surrounding the eligibility process. Context: No instances of non-eligible tenants were noted in our testing, and this finding relates only to implementation of a documented internal control process. Cause: The program was new during the fiscal year, and management was not aware of the requirement for a documented internal control process. Effect: Errors in the eligibility process could occur without a documented internal control process. No errors were noted in our testing. Repeat Finding: No Recommendation: We recommend the Organization implement a review process for eligibility determination for the program. Views of responsible officials: There is no disagreement with the audit finding.

Program Information: U.S. Department of the Interior Single Agreement – Assistance Listing #15.036 Award Number: A18AV00341 Award Period: 10/01/2024 – 9/30/2025 Criteria: Reporting requirements are contained in the following: Monitoring and reporting program performance, 2 CFR Section 200.329. • Per the award documents, the grantee shall prepare and provide an Annual Narrative Report. Per 2 CFR § 200.303, recipients must establish and maintain effective internal controls over federal awards to ensure compliance with applicable regulations. Condition/Context: NWIFC did not complete and obtain management approval of the FY25 Annual Narrative Report prior to the required submission date. As a result, the FY24 Annual Narrative Report was submitted to the funding agency in its place. [ X ] Compliance Finding [ X ] Significant Deficiency [ ] Material Weakness Cause: Internal controls were not sufficient to ensure the FY25 Annual Narrative Report was completed, reviewed, approved, and submitted in accordance with award requirements. Effect: Failure to comply with required reporting requirements may result in increased scrutiny by the funding agency and could adversely affect future funding decisions. Questioned Costs: N/A. This finding relates to reporting requirements and does not affect the allowability, support, or eligibility of program expenditures. Therefore, no questioned costs were identified. Repeat Finding: No. Recommendation: We recommend that NWIFC ensure required annual narrative reports are completed, reviewed, approved, and submitted timely, and that evidence of review and approval is maintained. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and has prepared corrective action as detailed in its Corrective Action Plan.

Type: Significant deficiency in internal control over compliance and noncompliance. Criteria: The Uniform Guidance as described in 2 CFR, Part 200.303, non-federal entities receiving federal awards to establish and maintain effective internal control over federal awards that provides reasonable assurance that the entity is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Road Commission did not have formal written federal policies and procedures that document the processes and controls used to administer federal awards, including procedures for compliance with applicable federal program requirements under Uniform Guidance (2 CFR, Part 200.303). Cause: The Road Commission has historically relied on state compliance requirements and MDOT oversight, and has not formalized Federal Uniform Guidance requirements into its written policies and procedures. Management was not fully aware that Uniform Guidance requires entity-specific documented procedures in addition to compliance with state procurement laws. Effect: Without written federal policies and procedures, there is an increased risk that federal award requirements may not be consistently applied, monitored, or retained as institutional knowledge, particularly during changes in personnel or program responsibilities. Perspective: As a condition of accepting a federal award, the Road Commission should have required policies and procedures in place. Questioned Costs: None noted. Initial Year of Finding: 2025 Recommendation: We recommend the Road Commission develop and implement written federal policies and procedures addressing the administration of federal awards to ensure compliance with Uniform Guidance (2 CFR, Part 200). The policies should address the following key compliance areas; allowable costs, cash management, procurement, and conflicts of interest. In addition, we recommend that management review and modify the procedure policy to include all the necessary items outlined in the Uniform Guidance. View of Responsible Officials and Planned Corrective Plan: See corrective action plan.

Item 2025-001 Reporting (Repeat 2024-002) Head Start and Early Head Start Assistance Listing #93.600 Head Start Grant No. 04CH0127807 U.S. Department of Health and Human Services Federal Award Year - 2025 Condition – Adequate controls were not in place to review and approve grant reports prior to their submission to the grantor. The Federal Financial Reports (SF-425) for the Head Start Cluster grants were not reviewed and approved prior to submission to the Payment Management System. Criteria – Grantees should have controls in place to ensure that grant reports are being reviewed and approved by management prior to being submitted to the grantor. 2 CFR 200.303 requires the non‐Federal entity to “(a) establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non‐Federal entity is managing the Federal statutes, regulations, and the terms and conditions of the Federal award.” Cause – Lack of sufficient controls over the review and approval of grant reports to ensure the accuracy and completeness of the report being submitted to the grantor. Questioned Costs – None noted. This finding is a deficiency in internal control over compliance for reporting that does not affect amounts expended or received from the Federal award. Effect – Lack of proper review and approval could result in improper reporting which could lead to disallowed costs. However, our audit disclosed no instances of unallowable costs. Recommendation – We recommend the implementation of controls to ensure there is evidence of review and approval of the quarterly grant reports prior to submission to the grantor. Management’s Response – The Agency will implement controls to ensure proper review and approval is obtained on required grant reports prior to submission to the grantor.

Finding 2025-003: Reporting Review Process Information on the Federal Programs: Assistance Listing Number 93.550 - Transitional Living Program, U.S. Department of Health and Human Services. Award Number: 90CX7428-03-00 Compliance Requirements: Reporting Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria Uniform Guidance (2 CFR 200.303) requires non-Federal entities to establish and maintain effective internal control over federal awards to provide reasonable assurance of compliance with reporting requirements. This includes controls to ensure required reports are prepared accurately, reviewed, approved by an authorized individual, and submitted timely. Condition The submission process for federal financial reports requires that report data be entered into the applicable federal reporting system and certified by an authorized individual who performs a final review prior to submission. During the audit, we noted that certain required SF-425 Federal Financial Reports had been prepared, but were not certified by an authorized signer and, as a result, were not submitted by the applicable due dates. The reports were subsequently reviewed, certified, and submitted. Cause During the year, the Organization experienced transitions in financial leadership and in personnel responsible for federal reporting. As a result of these transitions, the responsibility for certifying required federal financial reports was not formally reassigned, which contributed to the reports not being timely certified and submitted. Effect Reports were not certified or submitted in accordance with reporting requirements. Although subsequently corrected, this reflects a deficiency in internal control over compliance that increases the risk of noncompliance from delinquent or inaccurate reporting. Questioned Costs None. Recommendation The Organization should implement formal controls over federal reporting, including a documented review by a qualified individual independent of preparation prior to submission, and procedures to track and monitor reporting deadlines.

S3800-010 Finding Reference Number – 2025-004 S3800-011 Title and CFDA Number of Federal Program – Section 202 Supportive Housing for the Elderly, Capital Advance and Project Rental Assistance Contract, ALN 14.157 S3800-015 Type of Finding – Federal Award Finding; Other Matters S3800-016 Finding Resolution Status – Resolved S3800-017 Information on Universe Population Size The total population was all disbursements from the bank accounts, 155 checks or transfers totaling $205,900. S3800-018 Sample Size Information The sample size was 40 disbursements totaling $60,503. Errors were found on 5 out of the 40 disbursements tested totaling $1,425. S3800-019 Identification of Repeat Finding and Finding Reference Number – N/A S3800-020 Criteria – Per 2 CFR sections 200.302 and 200.303 of the Uniform Guidance, an entity must establish and maintain effective internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. Allowable cost controls of Sessions Village 202 require the location and general ledger account coding to be written on each invoice to be reviewed by the Executive Director/ Administrator before the invoice is processed to be paid. In addition, all checks are required to have two signatures. S3800-030 Statement of Condition – During our audit, we noted four invoices whereby the amounts paid for by Sessions Village 202 did not match the split by location on the campus or the invoice was not for the business purpose of Sessions Village 202. This resulted in Sessions Village 202 paying for expenditures that were unrelated to the project. In addition, we noted one instance where the check only contained one signature. S3800-032 Cause – During the year ended September 30, 2025, there was turnover in the accounts payable position. As a result, errors were made during the cash disbursement process that were not caught by management’s review and monitoring procedures. S3800-033 Effect or Potential Effect – Failure to maintain effective internal controls over compliance with federal requirements increases the risk of unauthorized or unallowable transactions occurring. S3800-035 Auditor Non-Compliance Code –S (Internal Controls) S3800-037 FHA/Contract Number – 171-EE015 S3800-038 Questioned Costs – $0 S3800-040 Questioned Costs – $0 S3800-045 Reporting Views of Responsible Officials – Sessions Village 202 is in agreement with the findings, and the recommendations have been implemented. S3800-050 Context A sample of 40 checks totaling $60,503 was selected for audit from a population of 155 checks totaling $205,900. The test found 5 checks that were not in compliance with Sessions Village 202’s allowable cost controls totaling $1,425. Our sample was a statistically valid sample. S3800-080 Recommendation – We recommend the related parties reimburse Sessions Village 202 for the expenditures paid on their behalf. In addition, we recommend management review the disbursements made during the periods of turnover to confirm there were no other unallowable payments made. We also recommend management of Sessions Village 202 review their internal controls over the cash disbursement process with the necessary individuals involved in the process to ensure the controls are consistently performed going forward. S3800-090 Auditor’s Summary of Auditee Comments on the Findings and Recommendations – The related parties reimbursed Sessions Village 202 for the expenditures paid on their behalf. Since the new accounts payable clerk started in the Summer of 2025, they have been reviewing all of the supporting documentation for disbursements made during the period of turnover, and accumulating any additional corrections that need to be made. They will continue this process for all disbursements from the period of turnover. The Executive Director/Administrator and Accountant at the management agent will review the process and procedures in place with the new accounts payable clerk, and implement controls to ensure the appropriate facility and general ledger account coding are made going forward. In addition, they will review the review and monitoring controls in place and revise as needed to ensure the proper checks are in place to catch errors. S3800-130 Response Indicator – Agree S3800-140 Completion Date – June 11, 2026 S3800-150 Response – The related parties reimbursed Sessions Village 202 for the expenditures paid on their behalf. Since the new accounts payable clerk started in the Summer of 2025, they have been reviewing all of the supporting documentation for disbursements made during the period of turnover, and accumulating any additional corrections that need to be made. They will continue this process for all disbursements from the period of turnover. The Executive Director/Administrator and Accountant at the management agent will review the process and procedures in place with the new accounts payable clerk, and implement controls to ensure the appropriate facility and general ledger account coding are made going forward. In addition, they will review the review and monitoring controls in place and revise as needed to ensure the proper checks are in place to catch errors.

S3800-010 Finding Reference Number – 2025-003 S3800-011 Title and CFDA Number of Federal Program – Section 232 Loan – Mortgage Insurance Nursing Homes, Intermediate Care Facilities, Board and Care Homes and Assisted Living Facilities Loan, ALN 14.129 S3800-015 Type of Finding – Federal Award Finding; Other Matters S3800-016 Finding Resolution Status – Resolved S3800-017 Information on Universe Population Size The total population was all disbursements from the bank accounts, 1,166 checks or transfers totaling $9,963,223. S3800-018 Sample Size Information The sample size was 59 disbursements totaling $421,877. Errors were found on 2 out of the 59 disbursements tested totaling $2,071. S3800-019 Identification of Repeat Finding and Finding Reference Number – N/A S3800-020 Criteria – Per 2 CFR sections 200.302 and 200.303 of the Uniform Guidance, an entity must establish and maintain effective internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. Allowable cost controls of Cheney Care Community require general ledger account coding to be written on each invoice to be reviewed by the Executive Director before the invoice is processed to be paid. S3800-030 Statement of Condition – During our audit, we noted two invoices whereby the amounts paid for by Cheney Care Community did not match the split by location on the campus or the invoice was not for the business purpose of Cheney Care Community. This resulted in Cheney Care Community paying for expenditures that were unrelated to the project. In addition, we noted one invoice where the invoice did not include the general ledger account coding. S3800-032 Cause – During the year ended September 30, 2025, there was turnover in the accounts payable position. As a result, errors were made during the cash disbursement process that were not caught by management’s review and monitoring procedures. S3800-033 Effect or Potential Effect – Failure to maintain effective internal controls over compliance with federal requirements increases the risk of unauthorized or unallowable transactions occurring. S3800-035 Auditor Non-Compliance Code – S (Internal Controls) S3800-037 FHA/Contract Number – 171-22029 S3800-038 Questioned Costs – $0 S3800-040 Questioned Costs – $0 S3800-045 Reporting Views of Responsible Officials – Cheney Care Community is in agreement with the findings, and the recommendations will be implemented. S3800-050 Context – A sample of 59 checks totaling $421,877 was selected for audit from a population of 1,166 checks totaling $9,963,223. The test found 2 checks that were not in compliance with Cheney Care Community’s allowable cost controls totaling $2,071. Our sample was a statistically valid sample. S3800-080 Recommendation – We recommend the related parties reimburse Cheney Care Community for the expenditures paid on their behalf. In addition, we recommend management review the disbursements made during the periods of turnover to confirm there were no other unallowable payments made. We also recommend management of Cheney Care Community review their internal controls over the cash disbursement process with the necessary individuals involved in the process to ensure the controls are consistently performed going forward. S3800-090 Auditor’s Summary of Auditee Comments on the Findings and Recommendations - The related parties reimbursed Cheney Care Community for the expenditures paid on their behalf. Since the new accounts payable clerk started in the Summer of 2025, they have been reviewing all of the supporting documentation for disbursements made during the period of turnover, and accumulating any additional corrections that need to be made. They will continue this process for all disbursements from the period of turnover. The Executive Director/Administrator and Accountant will review the process and procedures in place with the new accounts payable clerk, and implement controls to ensure the appropriate facility and general ledger account coding are made going forward. In addition, they will review the review and monitoring controls in place and revise as needed to ensure the proper checks are in place to catch errors. S3800-130 Response Indicator – Agree S3800-140 Completion Date – November 20, 2025 S3800-150 Response – The related parties reimbursed Cheney Care Community for the expenditures paid on their behalf. Since the new accounts payable clerk started in the Summer of 2025, they have been reviewing all of the supporting documentation for disbursements made during the period of turnover, and accumulating any additional corrections that need to be made. They will continue this process for all disbursements from the period of turnover. The Executive Director/Administrator and Accountant will review the process and procedures in place with the new accounts payable clerk, and implement controls to ensure the appropriate facility and general ledger account coding are made going forward. In addition, they will review the review and monitoring controls in place and revise as needed to ensure the proper checks are in place to catch errors.

REPORTING – COMPLIANCE AND CONTROLS REPEAT FINDING: NO FEDERAL AGENCY: U.S. DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT; PASSED THROUGH FLORIDA DEPARTMENT OF COMMERCE PROGRAM: COMMUNITY DEVELOPMENT BLOCK GRANTS, ALN 14.228 GRANT NUMBERS: H2494, H2384, M0043, M0024, M0150, M0154, MT151 FINDING TYPE: SIGNIFICANT DEFICIENCY CRITERIA: Under 29 CFR sections 5.5 and 5.6; the A-102 Common Rule (section 36(i)(5)), OMB Circular A-110 (2 CFR Part 215, Appendix A, Contract Provisions); 2 CFR Part 176, Subpart C; and 2 CFR section 200.326; the County’s contractor is required to submit a copy of the payroll and a statement of compliance (certified payrolls) weekly for each week in which any contract work is performed. The grant agreements outline the reports required to be submitted and their due dates. Additionally, 2 CFR 200.303(a) of the Uniform Guidance requires non-federal entities to establish and maintain effective internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. CONDITION: 18 of 135 total reports required under the grants were tested for compliance with this requirement. This was not a statistically valid sample. The auditor noted the following which affected 7 of the reports tested: - For 5 reports, there was no evidence of a second review - For 1 monthly progress report, the report was submitted later than the due date - For 1 quarterly progress report, the funds used through the report date were not included at the correct amount and there were other mathematical errors - For 2 reports, the client could not show when the reports were submitted to the grantor CAUSE: Management has not established procedures for reviewing all program reports and/or the reviews failed to identify reporting errors and ensure reports were submitted timely. EFFECT: Certain reports were not submitted timely or may not have been submitted to the grantor, and certain reports were inaccurate. QUESTIONED COSTS: None. The finding is over the reporting compliance requirement. Amounts expended and received from federal awards were not affected. RECOMMENDATION: We recommend procedures be established for review of all program reports prior to submission to the grantors and that the review be documented; procedures be established to ensure reports are submitted timely; and a reconciliations of reported amounts to the accounting records be performed. VIEW OF RESPONSIBLE OFFICIALS: See Management’s Response and Corrective Action Plan beginning on page 122.

SPECIAL TESTS AND PROVISIONS, WAGE RATE REQUIREMENTS – COMPLIANCE AND CONTROLS REPEAT FINDING: NO FEDERAL AGENCY: U.S. DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT; PASSED THROUGH FLORIDA DEPARTMENT OF COMMERCE PROGRAM: COMMUNITY DEVELOPMENT BLOCK GRANTS, ALN 14.228 GRANT NUMBERS: H2494, H2384, M0043, M0024, M0150, M0154, MT151 FINDING TYPE: SIGNIFICANT DEFICIENCY CRITERIA: 2 CFR 200.303(a) of the Uniform Guidance requires non-federal entities to establish and maintain effective internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. CONDITION: The County relies on third-party consultants to obtain and review construction contractors’ weekly certified payrolls, and the consultants report the information to the County. In some cases, the County does not review the certified payrolls until the end of the construction contract. Additionally, the auditor tested 2 of 3 grants that had construction performed during the fiscal year for compliance with this requirement and for 1 grant tested, the County could not provide evidence that the consultant verified that the certified payrolls were submitted. The sample was not statistically valid. CAUSE: Management has not established procedures for regular monitoring of consultants’ performance related to obtaining and reviewing evidence of certified payrolls. EFFECT: Certified payrolls for a construction contract subject to wage rate requirements under the Davis-Bacon Act were not reviewed by the County during the fiscal year. QUESTIONED COSTS: None. The auditor is not aware of any amounts paid in violation of Federal statutes as a result of this finding. RECOMMENDATION: We recommend procedures be established for the County to obtain and review of certified payrolls for the construction projects on a more frequent basis to ensure compliance with the wage rate requirements. VIEW OF RESPONSIBLE OFFICIALS: See Management’s Response and Corrective Action Plan beginning on page 122.

Material Weakness in Internal Control over Compliance and Material Instance of Noncompliance (Scope Limitation) Federal Agency: U.S. Department of Health and Human Services Federal Program: Centers for Independent Living Assistance Listing Number: 93.432 Direct Award Numbers: 2322CAILCL-00 and 2338CAILCL-00 Pass-Through Entity: California Department of Rehabilitation Grant Identifying Number: 32594 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles and Period of Performance – Payroll Expenditures, Cash Management and Reporting Criteria: Pursuant to 2 CFR §200.303, the Organization is required to establish and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Under 2 CFR §200.403 and 2 CFR §200.405, costs charged to the Federal award must be allowable, allocable, reasonable, and adequately documented. Under 2 CFR §200.403(h) and 2 CFR §200.309, costs must be incurred within the approved period of performance. Under 2 CFR §200.305, for cash management using the reimbursement method, the Organization must maintain records sufficient to support amounts requested for reimbursement and demonstrate that reimbursement requests are based on allowable program expenditures. Under 2 CFR §200.328 (financial reporting) and §200.329 (performance reporting) recipients are responsible for monitoring activities under federal awards and must submit required performance and financial reports at the intervals required by the federal award, which may be no more frequent than quarterly and no less frequent than annually. Condition and Context: The Organization did not have adequately designed internal controls over the review and approval of allowable payroll activities and payroll expenditures, cash management activities and federal reporting requirements. Specifically, there were no documented review and approval procedures or supervisory controls in place to ensure the accuracy and completeness of time and effort tracking of payroll expenditures, reimbursement requests or financial reports under the federal program. Additionally, sufficient appropriate audit evidence was not available to support compliance with the Activities Allowed or Unallowed and Allowable Costs/Cost Principles-Payroll Expenditures, Cash Management and Reporting compliance requirements. The lack of documentation and supporting records resulted in a scope limitation that prevented the auditors from performing necessary procedures to determine whether the Organization complied with applicable federal requirements related to allowed or unallowed payroll activities and allowable costs/cost principles for payroll expenditures, cash management transactions and financial reporting submissions for the population selected for testing. The condition affected the administration of the Centers for Independent Living federal program for the fiscal year ended September 30, 2025.Cause: Management did not design and implement documented internal controls requiring supervisory review and approval of allowable payroll activities and payroll expenditures, cash management activities and federal financial reporting. In addition, management did not maintain adequate supporting documentation to demonstrate compliance with federal requirements. Effect: The lack of effective internal controls increased the risk that errors, omissions, or noncompliance related to allowed or unallowed payroll activities and allowable costs/cost principles for payroll expenditures, cash management and reporting could occur and not be detected in a timely manner. Furthermore, because sufficient appropriate audit evidence was unavailable, the auditors were unable to determine whether the auditee complied with applicable federal compliance requirements related to - allowable payroll activities and payroll expenditures, cash management and reporting. Questioned Costs: Questioned costs could not be determined due to the scope limitation. Repeat Finding: No Recommendation: We recommend that management design and implement formal internal controls over - allowable payroll activities and payroll expenditures, cash management and reporting activities, including documented supervisory review and approval procedures for all time and effort tracking of payroll expenditures, federal reimbursement requests and financial reports. Management should also establish policies and procedures to ensure adequate supporting documentation is retained and readily available to support compliance with federal program requirements and facilitate audit testing. This should include comprehensive training for staff involved in federal program administration, regular monitoring to ensure controls are consistently applied, and periodic internal audits to assess the effectiveness of compliance systems. Views of Responsible Officials: Management Position: Management agrees with this finding. Adequate internal controls over payroll, cash management, and federal reporting were not in place during FY2025 as a direct result of inconsistencies in procedures and internal controls.Corrective Actions:  Accountability & Role Clarity: The Executive Director and Program Manager have mapped compliance requirements for each federal award—including expenditure review, reporting, receivables, and deliverables—and assigned clear ownership across management positions to eliminate single points of failure and reinforce segregation of duties.  Training & Ongoing Monitoring: All management staff will receive annual training on federal grant requirements (allowable/unallowable costs, period of performance, cash management, and reporting) at the start of each fiscal year. Monthly monitoring meetings among the Executive Director, Program Manager, and Accountant will precede Finance Committee meetings to review grant spending. Periodic internal reviews and a final year-end reconciliation will be conducted. Documentation & Continuity: All grant-related records will be maintained on a shared organizational drive accessible to all responsible staff. Formal onboarding and off boarding procedures for federal grant management will be developed to ensure continuity regardless of personnel changes. The Finance Manual will be updated to reflect all procedures.  Hood & Strong has been retained suggests proper internal controls necessary to achieve full federal compliance. All federal award information will be regularly reported to the Board of Directors.

Material Weakness in Internal Control Over Compliance and Instance of Noncompliance - Missing Supporting Documentation for Tested Expenditures Federal Agency: U.S. Department of Health and Human Services Federal Program: Centers for Independent Living Assistance Listing Number: 93.432 Direct Award Numbers: 2322CAILCL-00 and 2338CAILCL-00 Pass-Through Entity: California Department of Rehabilitation Grant Identifying Number: 32594 Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance – Nonpayroll Expenditures Criteria: Pursuant to 2 CFR §200.303, the Organization is required to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Organization is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Under 2 CFR §200.403 and 2 CFR §200.405, costs charged to the Federal award must be allowable, allocable, reasonable, and adequately documented. Under 2 CFR §200.403(h) and 2 CFR §200.309, costs must be incurred within the approved period of performance. Condition and Context: The Organization lacked documented review and approval controls over activities allowed or unallowed, allowable costs/cost principles, and period of performance for nonpayroll expenditures. In addition, 3 of 40 nonpayroll expenditure transactions tested were not supported by adequate documentation to demonstrate the costs were allowable and incurred within the approved period of performance. Cause: Management did not design and implement documented review and approval controls over the applicable compliance requirements or procedures to ensure supporting documentation was obtained and retained for Federal expenditures. Effect: The lack of effective internal controls increased the risk that errors, omissions, or noncompliance related to activities allowed or unallowed, allowable costs/cost principles, and period of performance for nonpayroll expenditures could occur and not be detected in a timely manner, resulting in questioned costs and potential repayment of Federal funds. Questioned Costs: Undetermined. Repeat Finding: Yes. Reference number 2024-002. Recommendation: We recommend management design and implement documented review and approval controls over the applicable compliance requirements and require supporting documentation for Federal expenditures before costs are charged to the Federal award. This should include comprehensive training for staff involved in federal program administration, regular monitoring to ensure controls are consistently applied, and periodic internal audits to assess the effectiveness of compliance systems. Views of Responsible Officials: Management Position: Management agrees with this finding and acknowledges it as a repeat of Finding 2024-002. Systemic gaps in documentation practices under prior financial management resulted in insufficient supporting documentation for three of forty transactions tested. Corrective Actions:  Immediate Control Reinforcement & Training: The Executive Director and Program Manager reviewed each federal award to identify allowable cost categories, applicable periods of performance, and required documentation standards. Funders were engaged directly to clarify documentation requirements; at the April 14 all-staff meeting, a funder provided comprehensive training on reporting and compliance. Additional funder-led training sessions for management and all staff are underway.  Monitoring & Internal Audit: Monthly meetings among the Executive Director, Program Manager, and Accountant review grant spending and federal compliance. Written corrective action plans are developed for each identified noncompliance area. The Accountant will maintain current budget tracking with immediate notification to the Executive Director of discrepancies. All findings are reported to the Board monthly or by special session. Federal grant compliance is incorporated into relevant staff performance evaluations.  Documentation & Formalization: CID will implement a dual-storage documentation methodology combining a shared drive and a document management system (DMS) to ensure that all grantrelated expenditures are fully supported and readily retrievable. All financial files will be organized within a confidential folder structure using a standardized naming convention that includes vendor name, date, and grant code, with subfolders categorized by expense type. Copies of all supporting documentation including invoices, receipts, timesheets, and allocation records will be maintained in both the shared drive and the DMS to ensure redundancy and accessibility. The Executive Director, Accountant, and Program Manager will share responsibility for filing grant documentation in accordance with each grant's reporting deadline, with no costs posted to a grant prior to confirmation that adequate support has been filed and is retrievable. This structured methodology will ensure that CID can readily produce complete documentation for any audited expenditure and that unsupported costs are not charged against any grant funding source.  Finance documentation processes have been reviewed with the Accountant; Hood & Strong is providing Executive Director training on the FundEZ cloud platform. All updated procedures will be reflected in the Finance Manual.

Reporting – HUD 50058 Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Housing Voucher Cluster ALN: 14.871 14.879 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: October 1, 2024 – September 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per HUD PIH guidance (e.g., Notice PIH 2011 65), Public Housing Agencies are required to submit Form HUD 50058 data to HUD’s PIC system in a timely manner, within 60 days of the effective date of the transaction, to ensure accurate and current program reporting. Condition: Of the 40 HUD 50058 transactions tested, three were not submitted to the HUD Public and Indian Housing Information Center (PIC) system within 60 days of the effective date, as required by HUD PIH guidance (e.g., Notice PIH 2011 65), resulting in untimely reporting of program data. Questioned costs: None. Context: See “Condition.” Cause: Lack of automated controls and monitoring over submission deadlines, combined with insufficient staff awareness and resource constraints, resulted in untimely HUD 50058 submissions. Effect: Untimely submission of HUD 50058 reports results in outdated or inaccurate data in HUD’s PIC system, which may impair HUD’s ability to effectively monitor program performance and compliance, and increases the risk of noncompliance with HUD PIH reporting requirements. Repeat Finding: No Recommendation: The City should implement procedures and controls to ensure timely submission of HUD 50058 transactions, including establishing a tracking mechanism for due dates, enhancing supervisory review of submission timeliness, and providing training to staff on HUD PIH reporting requirements to ensure compliance with the 60 day standard. Views of responsible officials: See management response on corrective action plan.

Reporting - SEMAP Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Housing Voucher Cluster ALN: 14.871 14.879 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: October 1, 2024 – September 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 24 CFR 985.101(a), SEMAP certifications must be formally approved by the City’s governing board (or authorized official) and signed by appropriate management prior to submission. Additionally, in accordance with 2 CFR 200.303(a), the City must maintain effective internal controls, including documented review and approval, to ensure the accuracy and completeness of reports submitted to HUD. Condition: The City did not maintain documentation evidencing that the SEMAP certification report was reviewed and approved prior to submission to HUD; therefore, we were unable to determine whether the review and approval controls were performed before submission. Questioned costs: None. Context: See “Condition.” Cause: The condition occurred because the City had not formalized procedures requiring documentation and retention of SEMAP review and approval prior to submission. Effect: Without documented review and approval, there is an increased risk that inaccurate, incomplete, or unsupported SEMAP certifications could be submitted to HUD, which could affect HUD’s assessment of the City’s Housing Choice Voucher program performance and result in noncompliance with SEMAP certification requirements. Repeat Finding: No. Recommendation: The City should formalize SEMAP review and approval procedures, require documented evidence of supervisory or authorized official approval prior to submission, and retain such documentation to support compliance with SEMAP certification and internal control requirements. Views of responsible officials: See management response on corrective action plan.

Special Test – Reasonable Rent Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Housing Voucher Cluster ALN: 14.871 14.879 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: October 1, 2024 – September 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 24 CFR 982.507(a)(1), the City must determine that the rent to owner is reasonable prior to approving the lease and executing the HAP contract; therefore, housing assistance payments should not be made before a rent reasonableness determination is completed. Condition: For one of 40 samples tested, the City issued a housing assistance payment before completing and documenting the required rent reasonableness determination. As a result, the City did not demonstrate compliance with Housing Choice Voucher program requirements requiring rent reasonableness to be determined prior to approval of the lease and execution of the HAP contract. Questioned costs: None. Context: See “Condition.” Cause: The City did not have sufficient control procedures in place to ensure rent reasonableness determinations were completed, documented, and reviewed before housing assistance payments were issued. Effect: Failure to complete rent reasonableness determinations prior to payment increases the risk that housing assistance payments may be made for units with rents that are not properly supported as reasonable, which could result in improper payments and noncompliance with Housing Choice Voucher program requirements. Repeat Finding: No. Recommendation: The City should strengthen controls over the lease-up and payment process to ensure rent reasonableness determinations are completed, documented, and reviewed before lease approval, HAP contract execution, and issuance of housing assistance payments. This may include using a formal checklist or workflow control, requiring supervisory review, and providing staff training on program requirements. Views of responsible officials: See management response on corrective action plan.

Special Test – Utility Allowance Schedule Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Housing Voucher Cluster ALN: 14.871 14.879 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: October 1, 2024 – September 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 24 CFR 982.517 requires the City to maintain and update utility allowance schedules based on current data, further implying the need for accurate and reliable calculations supported by effective internal controls. Condition: The City updated and finalized the utility allowance schedule without documented independent review of the underlying utility rate data, assumptions, and calculations. As a result, duties over preparation and approval of the schedule were not adequately segregated. Questioned costs: None. Context: See “Condition.” Cause: The City had not established a formal control requiring documented independent review and approval of the utility allowance schedule prior to finalization. Effect: Without documented independent review, errors in utility rate data, assumptions, or calculations may not be prevented or detected timely, increasing the risk of inaccurate utility allowances, improper housing assistance payments, and noncompliance with Housing Choice Voucher program requirements. Repeat Finding: No. Recommendation: The City should establish and implement a formal review and approval control over the utility allowance schedule. The review should be performed by an individual independent of preparation, documented prior to finalization, and include verification of utility rate data, assumptions, calculations, and compliance with applicable Housing Choice Voucher program requirements. Views of responsible officials: See management response on corrective action plan.

Equipment and Real Property Management Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-0007-056-2024, 3-48-0007-057-2024, 3-48-0007-058-2024, 3-48-0007-059-2024, 3-48-0007-060-2025, 3-48-0007-061-2025 December 29, 2023 – December 29, 2027, December 27, 2023 – December 27, 2027, August 16, 2024 – August 16, 2028, August 16, 2024 – August 16, 2028, September 18, 2025 – September 18, 2029, September 10, 2025 – September 10, 2029 Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 2 CFR 200.313(d), the City is required to maintain property records for equipment acquired with federal funds that include, among other elements, the source of funding and the percentage of federal participation. Condition: The City’s fixed asset ledger does not identify or distinguish assets acquired with federal award funds from assets acquired with other funding sources. As a result, the City’s property records do not readily identify the source of funding or percentage of federal participation for individual assets, as required by 2 CFR 200.313(d). Questioned costs: None. Context: See “Condition.” Cause: The City’s fixed asset system was not configured to capture funding source and federal participation information, and related procedures did not require this information to be recorded when assets were added to the ledger. Effect: Without complete property records, the City cannot readily demonstrate compliance with federal property management requirements. This increases the risk that federally funded assets may not be properly identified, safeguarded, reported, or disposed of in accordance with federal requirements. Repeat Finding: No Recommendation: The City should configure its fixed asset system, or implement an equivalent tracking mechanism, to identify assets acquired with federal award funds and document the related funding source and percentage of federal participation. The City should also update written procedures and perform periodic reviews to ensure property records remain complete, accurate, and compliant with federal requirements. Views of responsible officials: See management response on corrective action plan.

Reporting – FAA Form 5100-127 Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-0007-056-2024, 3-48-0007-057-2024, 3-48-0007-058-2024, 3-48-0007-059-2024 December 29, 2023 – December 29, 2027, December 27, 2023 – December 27, 2027, August 16, 2024 – August 16, 2028, August 16, 2024 – August 16, 2028 Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 49 U.S.C. § 47107(a)(15) and Federal Aviation Administration (FAA) guidance, including AC 150/5100-19, requires airport sponsors to prepare FAA Form 5100-127 using financial information that is accurate, complete, and supported by underlying accounting records. Additionally, in accordance with 2 CFR 200.302(b)(3), the City must maintain financial management systems and internal controls that ensure reported data is complete, accurate, and reconcilable to the general ledger. Condition: During testing of FAA Form 5100-127 submitted in March 2025, which reported financial information for the fiscal year ended September 30, 2024, with comparative amounts for the fiscal year ended September 30, 2023, we noted that several line items did not agree to the City’s general ledger or supporting documentation. As a result, certain amounts reported on the form were not fully supported by the underlying accounting records. The specific line items and variances are summarized in the table below. The large variances noted were attributable primarily to reporting input/mapping errors and did not result in questioned costs; however, the errors indicate that the reconciliation and review controls did not operate at a sufficient level of precision. Questioned costs: None. Context: See “Condition.” Cause: The condition occurred because reconciliation procedures were not sufficiently detailed or consistently documented, supporting general ledger documentation was not maintained for all reported amounts, and the review process was not performed at a level of precision sufficient to identify variances prior to submission. Effect: As a result, the FAA may rely on financial information that is inaccurate or not fully supported by the City’s accounting records, which could impair monitoring of airport financial operations and compliance with grant assurances. The condition also increases the risk of future reporting errors and additional FAA oversight. Repeat Finding: No. Recommendation: The City should enhance its existing reconciliation and review procedures by requiring documented tie-outs of FAA Form 5100-127 amounts to the general ledger, retention of supporting documentation for all reported amounts, and evidence of supervisory review prior to submission. Views of responsible officials: See management response on corrective action plan.

Special Tests and Provisions – Revenue Diversion Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-0007-056-2024, 3-48-0007-057-2024, 3-48-0007-058-2024, 3-48-0007-059-2024, 3-48-0007-060-2025, 3-48-0007-061-2025 December 29, 2023 – December 29, 2027, December 27, 2023 – December 27, 2027, August 16, 2024 – August 16, 2028, August 16, 2024 – August 16, 2028, September 18, 2025 – September 18, 2029, September 10, 2025 – September 10, 2029 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 49 U.S.C.47107(b), The Secretary of Transportation may approve a project grant application under this subchapter for an airport development project only if the Secretary receives written assurances, satisfactory to the Secretary, that local taxes on aviation fuel (except taxes in effect on December 30, 1987) and the revenues generated by a public airport will be expended for the capital or operating costs of— • the airport; • the local airport system; or • other local facilities owned or operated by the airport owner or operator and directly and substantially related to the air transportation of passengers or property. Condition: The City did not maintain a formal written policy or documented procedure to ensure airport-generated revenues are used only for allowable airport-related purposes in accordance with federal revenue-use restrictions. Questioned costs: None. Context: See “Condition.” Cause: The City had not formalized its process for translating federal airport revenue-use requirements into written policies and control procedures. Effect: The absence of a written policy increases the risk that airport revenues could be used for unallowable purposes or that federal revenue-use requirements may be applied inconsistently. Although no specific instances of revenue diversion were identified, the lack of formalized guidance and related controls increases the risk of noncompliance with 49 U.S.C. § 47107(b). Repeat Finding: No Recommendation: The City should develop, formally adopt, and implement a written airport revenue policy that defines allowable and unallowable uses of airport-generated revenues, aligns with federal revenue-use requirements and applicable FAA guidance, establishes expenditure review and approval procedures, and requires periodic monitoring for compliance. Relevant personnel should be trained on the policy. Views of responsible officials: See management response on corrective action plan.

Reporting – Semi-Annual Performance Report Federal Agency: U.S. Department of Homeland Security Federal Program Title: Staffing for Adequate Fire and Emergency Response (SAFER) ALN: 97.083 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: EMW-2022-FF-01428 February 26, 2024 – February 25, 2027 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The City should have controls designed to ensure proper financial and performance reporting, including adequate review prior to submission. Condition: The City did not maintain documented evidence of an independent review and approval of the semi-annual SAFER Hiring Performance Progress Report prior to submission. The same individual prepared, reviewed, and submitted the report, which limited segregation of duties and independent oversight over the reporting process. Questioned costs: None. Context: See “Condition.” Cause: The City had not established a formal review and approval procedure requiring independent supervisory review of SAFER performance reports prior to submission. Effect: Without documented independent review, there is an increased risk that errors, omissions, or unsupported information in the SAFER performance report may not be detected and corrected before submission, which could reduce the reliability of information reported to FEMA. Repeat Finding: No. Recommendation: The City should establish and document a formal review and approval process for SAFER performance reports prior to submission. The process should require independent review by an individual other than the preparer, or, if staffing limitations prevent full segregation of duties, a documented compensating supervisory review. Views of responsible officials: See management response on corrective action plan.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/Entitlements Grants ALN: 14.218 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B-18-MC-48-0002, B-19-MC-48-0002, B-20-MC-48-0002, B-21-MC-48-0002, B-22-MC-48-0002, B-23-MC-48-0002, B-24-MC-48-0002 October 1, 2018 – September 1, 2025, October 1, 2019 – September 1, 2026, October 1, 2020 – September 1, 2027, October 1, 2021 – September 1, 2028, October 1, 2022 – September 1, 2029, October 1, 2023 – September 1, 2030, October 1, 2024 – September 1, 2031 Type of Finding: Material Weakness in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). As of March 8, 2025, fsrs.gov was retired, and all subaward reporting data and functionality are now on SAM.gov. Condition: During the fiscal year, the City issued multiple first-tier subawards under the Community Development Block Grants/Entitlement Grants program that exceeded the $30,000 reporting threshold. However, the City did not report any of the applicable subawards in the FFATA Subaward Reporting System/SAM.gov as required. Questioned costs: None. Context: See “Condition.” Cause: The City had not established sufficient procedures or oversight controls to identify first-tier subawards subject to FFATA reporting requirements and ensure the required subaward information was submitted timely. Additionally, personnel responsible for grant administration were not sufficiently aware of the applicable FFATA reporting requirements. Effect: Failure to report required subaward information resulted in noncompliance with federal transparency reporting requirements and reduced public visibility into the use of federal funds. The lack of reporting may also subject the City to increased federal monitoring, enforcement actions, or other administrative remedies. Repeat Finding: No. Recommendation: The City should establish and implement formal procedures to identify subawards subject to FFATA reporting, track applicable reporting deadlines, and ensure required submissions are completed timely in SAM.gov. The City should also provide training to grant administration personnel and perform corrective reporting for previously omitted subawards, as applicable. Views of responsible officials: See management response on corrective action plan.

Criteria 2 CFR 200.303 requires that the non-Federal entity must "(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States and the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Uniform Guidance 2 CFR Section 200.320 (a)(2) states regarding the applicability of simplified acquisition procedures: "The aggregate dollar amount of the procurement transaction is higher than the micro_x0002_purchase threshold but does not exceed the simplified acquisition threshold. If simplified acquisition procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources. Unless specified by the Federal agency, the recipient or subrecipient may exercise judgment in determining what number is adequate." AIHEC's procurement policy requires that for procurement by small purchase ($10,000 - $249,000), where the aggregate dollar amount is higher than the micro-purchase threshold, price or rate quotations must be obtained from three qualified sources. If three separate qualified sources cannot be obtained the reason needs to be formally documented. Condition/Context During our testing of procurement transactions, we noted that AIHEC did not provide supporting procurement documentation for certain sampled transactions. In addition, for procurements identified as sole-source, AIHEC did not provide approved sole-source justification documentation. As a result, we were unable to verify compliance with the applicable federal procurement requirements. Cause Management does not have sufficient internal controls in place to ensure that AIHEC's procurement policies are followed for all procurement transactions prior to entering the procurement. Effect AIHEC entered into a procurement that did not go through a competitive solicitation process. Recommendation Management should review its policies and procedures to ensure all procurement transactions are in accordance with AIHEC's procurement policies and have the appropriate supporting documentation.

Finding No.: 2025-014 Identification of Federal Program: Federal Agency: U.S. Department of Housing and Urban Development (HUD) AL Program: 14.850 Public Housing Operating Fund Federal Award No.: GQ00100000125D, GQ00100000225D, GQ00100000325D, GQ00100000425D Area: Eligibility Criteria or specific requirement (including statutory, regulatory or other citation): 24 CFR 5.905(a)(1) states: A PHA that administers a Section 8 or public housing program under an Annual Contributions Contract with HUD must carry out background checks necessary to determine whether a member of a household applying for admission to any federally assisted housing program is subject to a lifetime sex offender registration requirement under a State sex offender registration program. This check must be carried out with respect to the State in which the housing is located and with respect to States where members of the applicant household are known to have resided. Section 9 I.E, Other Considerations – Criminal Background Checks, of GHURA Admissions and Continued Occupancy Policy (ACOP) states: Each household member age 18 and over will be required to execute a consent form for a criminal background check as part of the annual reexamination process. Additionally, HUD recommends that at annual reexaminations PHAs ask whether the tenant, or any member of the tenant’s household, is subject to a lifetime sex offender registration requirement in any state [Notice PIH 2012-28]. At the annual reexamination, the PHA will ask whether the tenant, or any member of the tenant’s household, is subject to a lifetime sex offender registration requirement in any state. The PHA will use the Dru Sjodin National Sex Offender database to verify the information provided by the tenant. Finding No.: 2025-014, continued Criteria or specific requirement (including statutory, regulatory or other citation), continued: Section 3‑II.E, EIV System Searches – EIV Income Report of GHURA Admissions and Continued Occupancy Policy (ACOP) states: For each new admission, the PHA is required to review income information in EIV to confirm and validate family reported income within 120 days after the move-in information is transmitted to HUD. The PHA must print and maintain copies of the reports in the tenant file and resolve any discrepancies with the family EIV Income Report. Section 7-I.E. Level 5 and 6 Verifications: Up-Front Income Verification (UIV) of GHURA Admissions and Continued Occupancy Policy (ACOP) states: PHAs are required to obtain an EIV Income report for each family anytime the PHA conducts an annual reexamination. However, PHAs are not required to use the EIV Income report: • At annual reexamination if the PHA used Safe Harbor verification from another means-test federal assistance program to determine the family’s income; or • During any interim reexaminations. The EIV Income Report is also not available for program applicants at admission. When required to use the EIV Income Report, in order for the report to be considered current, the PHA must pull the report within 120 days of the effective date of the annual reexamination. 24 CFR 5.618(b), Acceptable documentation; confidentiality, states: (i) A PHA or owner may determine the net assets of a family based on a certification by the family that the net family assets (as defined in § 5.603) do not exceed $50,000, which amount will be adjusted annually in accordance with the Consumer Price Index for Urban Wage Earners and Clerical Workers, without taking additional steps to verify the accuracy of the declaration. The declaration must state the amount of income the family expects to receive from such assets; this amount must be included in the family's income. (ii) A PHA or owner may determine compliance with paragraph (a)(1)(ii) of this section based on a certification by a family that certifies that such family does not have any present ownership interest in any real property at the time of the income determination or review. Finding No.: 2025-014, continued Criteria or specific requirement (including statutory, regulatory or other citation), continued: Section 7 I.F. of GHURA’s Admissions and Continued Occupancy Policy (ACOP) states: When HUD requires third-party verification, self-certification, or “tenant declaration,” is used as a last resort when the PHA is unable to obtain third-party verification. Self-certification, however, is an acceptable form of verification when: 1. A source of income is fully excluded 2. Net family assets total $5,000 or less and the PHA has adopted a policy to accept self-certification at annual recertification, when applicable 3. The PHA has adopted a policy to implement streamlined annual recertifications for fixed sources of income 24 CFR 5.508(b)(2-3), Evidence of citizenship or eligible immigration status, states: For noncitizens who are 62 years of age or older or who will be 62 years of age or older and receiving assistance under a Section 214 covered program on September 30, 1996 or applying for assistance on or after that date, the evidence consists of: (i) A signed declaration of eligible immigration status; and (ii) Proof of age document For all other noncitizens, the evidence consists of: (i) A signed declaration of eligible immigration status; (ii) One of the INS documents referred to in § 5.510; and (iii) A signed verification consent form. 24 CFR 960.259(c)(1), PHA responsibility for reexamination and verification, states: Except as provided in paragraph (c)(2) of this section, the PHA must obtain and document in the family file third-party verification of the following factors, or must document in the file why third-party verification was not available: (i) Reported family annual income; (ii) The value of assets; (iii) Expenses related to deductions from annual income; and (iv) Other factors that affect the determination of adjusted income or income-based rent 24 CFR 960.253(b) requires Public Housing Agencies (PHAs) to accurately calculate tenant rent by applying the appropriate rent formula based on verified family income and ensuring the tenant’s rent share is correctly determined in accordance with HUD requirements. Finding No.: 2025-014, continued Criteria or specific requirement (including statutory, regulatory or other citation), continued: 24 CFR 908.101 requires PHAs to maintain complete, accurate, and current records to comply with HUD requirements. Specifically, PHAs must retain complete and accurate data for the most recent three years, including the HUD 50058 (Family Report) and all supporting documentation. 2 CFR 200.303 requires the implementation and monitoring of effective internal controls to provide reasonable assurance that data reported to HUD is accurate, complete, and compliant with Federal requirements. Condition: For thirteen (33%) of forty participants tested, deficiencies were noted, as follows: Item No. Unit Certification Effective Date Criminal History/Sex Offender Registry Search Enterprise Income Verification (EIV) Report Date Other Required PHA Forms Variance (HUD-50058 - Tenant Register) Utility Allowance Variance (HUD-50058 - Register) 1 ALC 05/01/25 Not in file - - - - 2 LTJ 02/01/25 Not in file - - - - 3 EM 09/01/25 10/18/25 - - - - 4 GMM 05/22/25 - 03/19/26 - - - 5 MJA 10/16/24 - 05/30/25 - - - 6 POD 08/27/25 - Not In File - - - 7 SS 08/01/25 - - D-214 Form - - 8 SB 11/01/24 - 09/03/24 D-214 Form - - 9 KL 04/01/25 - 12/10/24 - - - 10 YR 06/01/24 - 05/04/24 - - - 11 SJL 07/01/25 - 04/04/25 - 36 - 12 GJA 07/01/25 - 03/11/25 - (151) 151 13 RJ 04/01/25 Not signed Not signed Self-certification of Assets 49 (210) Finding No.: 2025-014, continued Condition, continued: For item #s 1 and 2, no documentation was on file (e.g. sexual registry clearance form) to support if the PHA verified for lifetime sex offender registration requirements. For item # 3, eligibility determinations were not adequately supported, as the required sex offender checks was not conducted at annual reexamination. For item # 13, the sexual registry clearance form was not certified by the PHA, resulting in insufficient support for eligibility determination. For item #s 4 and 5, the newly admitted participants’ Enterprise Income Verification (EIV) report used to support income eligibility was not processed within 120 days after move in. For item # 6, no documentation was on file to support that the PHA processed the participant’s EIV report. For item # 13, the participant’s EIV report was not certified by the PHA, resulting in insufficient support for income eligibility determination. For item #s 7 and 13, documentation indicating verification of assets (e.g. self-certification forms, tenant declaration, and third-party bank statements) were not on file to support eligibility determination. For item #s 8 and 9, no documentation (e.g. declaration of eligible immigration status form) was on file to support whether non-citizen household members are eligible to receive housing assistance. For item #s 10 through 13, discrepancies which affect eligibility determination and assistance amounts were identified. For item # 10, the tenant rent amount that was agreed to and documented in the lease agreement was lower than the amount calculated by the PHA before annual recertification. For item #s 11 through 13, independently calculated tenant rent and utility allowance amounts differed from the amounts recorded in the PHA’s system and received by participants. Finding No.: 2025-014, continued Condition, continued: For item # 13, the participant’s verified income was understated by the PHA when determining eligibility and calculating housing assistance amounts. Cause: GHURA did not effectively implement monitoring controls to ensure compliance with applicable eligibility requirements. Effect or potential effect: GHURA is in noncompliance with applicable eligibility requirements. Questioned costs: $0 Identification as a repeat finding: Not applicable. Recommendation: Responsible personnel should enforce monitoring controls over compliance with applicable eligibility requirements. Specifically, procedures should be enforced requiring staff to obtain and properly document all required verification documentation prior to the recertification of benefits. In addition, supervisory personnel should perform periodic reviews to verify that these procedures are consistently followed and that all required verification activities have been completed and properly documented. Views of Responsible Officials: Management partially concurs with the finding. Refer to Management’s position as outlined in the Corrective Action Plan. Conclusion: Management submitted additional information on June 28, 2026; however, due to time constraints, we were unable to sufficiently corroborate and evaluate the documentation provided. Accordingly, the finding remains, as there was insufficient evidence to support a determination of compliance as of the audit date.

Finding No.: 2025-016 Identification of Federal Program: Federal Agency: U.S. Department of Housing and Urban Development (HUD) AL Program: 14.850 Public Housing Operating Fund Federal Award No.: GQ00100000125D, GQ00100000225D, GQ00100000325D, GQ00100000425D Area: Special Tests and Provisions – UEL (Utility Expense Level) Formula Criteria or specific requirement (including statutory, regulatory or other citation): GHURA is required to maintain and annually submit the Utility Expense Level (UEL) Formula Report (HUD Form 52722) for each project to HUD. 24 CFR 990.170(f)(1) states: 1. Appropriate utility records, satisfactory to HUD, shall be developed and maintained, so that consumption and rate data can be determined. 2 CFR 200.303 requires the implementation and monitoring of effective internal controls to provide reasonable assurance that data reported to HUD is accurate, complete, and compliant with Federal requirements. Condition: We examined the 4 reports required to be submitted during the fiscal year. For eight (14%) of total 56 key line reporting items required for testing within the Utility Expense Level (UEL) Formula Report (HUD Form 52722), the amounts were inconsistent from prior audited report submissions as follows: Item No. Project Line No. Utility Expense Level Formula Reported Utilities Reported Amount Per Audited Submission Variance Over (Under) Reported Variance Over (Under) Reported (%) 1 GQ001000001 03 Water and Sewer (Gal) 8,874 8,035 839 9% 2 GQ001000001 04 Water and Sewer (Gal) 5,647 6,486 (839) 15% 3 GQ001000002 03 Water and Sewer (Gal) 410,885 374,845 36,040 9% 4 GQ001000002 04 Water and Sewer (Gal) 383,707 419,747 (36,040) 9% 5 GQ001000003 03 Water and Sewer (Gal) 1,824,296 1,671,242 153,054 8% 6 GQ001000003 04 Water and Sewer (Gal) 2,719,307 2,872,361 (153,054) 6% 7 GQ001000003 03 Water and Sewer (Gal) 3,585,789 3,094,259 491,530 14% 8 GQ001000004 04 Water and Sewer (Gal) 2,663,490 3,155,020 (491,530) 18% Finding No.: 2025-016, continued Condition, continued: For items #s 1 and 2, the Asset Management Project (AMP) 1 reported in excess of amounts for key line items in Rolling base year 2 - actual consumption (12- month period 7/1/2021 to 6/30/2022) for water and sewer gallon consumption, and underreported for Rolling base year 3 - actual consumption (12-month period 7/1/2020 to 6/30/2021) for water gallon consumption than prior year amounts as reported on HUD Form 5722, respectively. For items #s 2 through 4, the Asset Management Project (AMP) 2 reported in excess of amounts for key line items in Rolling base year 2 - actual consumption (12- month period 7/1/2021 to 6/30/2022) for water and sewer gallon consumption, and underreported for Rolling base year 3 - actual consumption (12-month period 7/1/2020 to 6/30/2021) for water gallon consumption than prior year amounts as reported on HUD Form 5722, respectively. For items #s 3 through 6, the Asset Management Project (AMP) 3 reported in excess of amounts for key line items in Rolling base year 2 - actual consumption (12- month period 7/1/2021 to 6/30/2022) for water and sewer gallon consumption, and underreported for Rolling base year 3 - actual consumption (12-month period 7/1/2020 to 6/30/2021) for water gallon consumption than prior year amounts as reported on HUD Form 5722, respectively. For items #$ 7 and 8, the Asset Management Project (AMP) 4 reported in excess of amounts for key line items in Rolling base year 2 - actual consumption (12- month period 7/1/2021 to 6/30/2022) for water and sewer gallon consumption, and underreported for Rolling base year 3 - actual consumption (12-month period 7/1/2020 to 6/30/2021) for water gallon consumption than prior year amounts as reported on HUD Form 5722, respectively. Cause: Management did not implement adequate procedures to agree corrections on the Utility Expense Level (UEL) reporting submissions with underlying utility consumption and cost records prior to submission to HUD. In addition, supervisory review procedures were not sufficient to identify discrepancies, omissions, or reporting-period errors in the data accumulated for UEL reporting purposes. Effect or potential effect: GHURA is in noncompliance with applicable special tests and provisions for UEL Formula requirements. Questioned costs: $0 Finding No.: 2025-016, continued Identification as a repeat finding: Not applicable. Recommendation: Management should implement formal procedures to reconcile UEL reporting submissions to underlying utility consumption and cost records prior to submission to HUD. This should include preparing documented roll-forward reconciliations that ensure current-year reported amounts agree with prior submissions and are accurately carried forward. In addition, management should strengthen supervisory review controls by requiring an independent review of compiled UEL data to verify completeness, accuracy, and proper reporting period classification, with evidence of review retained. Views of Responsible Officials: Management did not provide a response to the finding. The finding was not included in management’s corrective action plan.

Inadequate Tenant File Documentation in MTW Housing Choice Vouchers (ALN 14.881) (Repeat of Finding 2024-005) Condition: During tenant file testing for the Housing Choice Voucher (HCV) component of the MTW Demonstration Program, we identified the following deficiencies. This condition is a repeat of prior year finding 2024-005: 1. For one port-out tenant, the tenant file did not contain the required HUD Form 50058 or the Enterprise Income Verification (EIV) documentation. As a result, the family’s eligibility, income determination, and assistance could not be substantiated from the file. 2. For one tenant, the Authority was unable to provide the HUD Form 50058; the form was not retained in the tenant file and only tenant balances from the Authority’s housing software were available. The data is reportedly retrievable from HUD’s IMS/PIC system but could not be reproduced from the Authority’s records. 3. For one tenant, the income determination was incorrect. Social Security income was not recalculated based on the prior-year recertification; although an updated Social Security benefit letter was received indicating a change in the monthly benefit, the income reported on the HUD Form 50058 was not updated accordingly, resulting in an inaccurate rent and housing assistance payment (HAP) calculation. Criteria: Under 2 CFR §200.302 and §200.303, the Authority must maintain financial management systems and internal controls sufficient to ensure that costs are allowable, supported, and compliant with program requirements. The 2025 Compliance Supplement (4-14.881) identifies Eligibility (Type E) as subject to audit and requires that the HUD Form 50058-MTW key line items be “documented in the recipient’s file.” HUD program rules require PHAs to complete and retain accurate HUD Forms 50058, to verify income through HUD’s EIV system, and to recalculate income upon receipt of updated benefit information. Records supporting federal program compliance must be retained and accessible (2 CFR §200.334). Cause: The Authority lacked effective internal controls over tenant file documentation, income verification (including use of EIV and updated benefit information), HUD Form 50058 completion and retention, and reexamination procedures. Effect: Missing Forms 50058 and EIV documentation leave family eligibility and assistance payments unsupported; the failure to recalculate income based on updated Social Security benefit information resulted in an inaccurate income determination and rent/HAP calculation. These deficiencies increase the risk of over- or under-payment of housing assistance and questioned costs under the MTW program. Questioned Costs: $395,581 Recommendation: The Authority should ensure the executed HUD Form 50058 (and supporting income/EIV documentation) is completed and retained in each tenant file; recalculate income promptly upon receipt of updated benefit information and reflect the change on the Form 50058; perform EIV verification and reconciliation at each admission and reexamination; conduct a file-completeness review before sign-off; provide staff training on income determination, EIV, and federal recordkeeping; and, where forms were not retained, download and refile them from IMS/PIC. Reply and Corrective Action Plan: The Authority concurs with the finding and questioned costs of $395,581 and acknowledges it is a repeat of finding 2024-005. Ensure Forms 50058 and supporting documentation are retained; recalculate household income when required; retrieve or reconstruct missing records; resolve questioned costs with HUD; conduct file reviews; and provide staff training.

ompliance Deficiencies Identified in HUD Monitoring Review (ALN 14.881) Condition: The compliance deficiencies identified in the U.S. Department of Housing and Urban Development (HUD) Compliance Monitoring Review conducted June 24–28, 2024 (formalized in HUD’s letter dated March 24, 2025) remained unresolved as of September 30, 2025. The open items span multiple program areas, including governance and internal controls, Housing Choice Voucher (HCV) program compliance, Project-Based Voucher (PBV) documentation, Public Housing operations, ROSS grant administration, Violence Against Women Act (VAWA) policy, and Section 3 compliance. This condition is a repeat of prior year finding 2024-006. Criteria: The HUD findings cite noncompliance with various federal regulations, including 2 CFR Part 200 and 24 CFR Parts 5, 35, 75, 960, 982, and 983, as well as HUD Notices PIH 2016-22, 2017-13, 2022-10, and 2023-03. Under 2 CFR §200.303 and §200.521, the Authority is responsible for taking timely and appropriate corrective action on identified deficiencies. Cause: The Authority had not fully implemented or updated the policies, procedures, and documentation necessary to resolve the open HUD monitoring findings and align with current HUD requirements. Effect: Failure to resolve these deficiencies on a timely basis results in continued noncompliance with federal program requirements, may lead to disallowed costs or HUD sanctions, and increases the risk of recurring audit findings in future periods. Questioned Costs: None. Recommendation: The Authority should prioritize timely resolution of all open HUD monitoring findings; implement the corrective actions outlined in HUD’s letter (policy updates, staff training, file reviews, and required certifications); assign responsibility and target completion dates for each open item; and maintain ongoing communication with HUD to confirm closure. Reply and Corrective Action Plan: The Authority concurs with the finding and acknowledges it is a repeat of finding 2024-006. Maintain a remediation tracker; implement corrective actions identified by HUD; conduct training and file reviews; submit required certifications; and provide progress updates until all items are closed.

Finding Number 2025-002: Inadequate Tenant File Documentation in MTW Housing Choice Vouchers (ALN 14.881) (Repeat of Finding 2024-005) Condition: During tenant file testing for the Housing Choice Voucher (HCV) component of the MTW Demonstration Program, we identified the following deficiencies. This condition is a repeat of prior year finding 2024-005: 1. For one port-out tenant, the tenant file did not contain the required HUD Form 50058 or the Enterprise Income Verification (EIV) documentation. As a result, the family’s eligibility, income determination, and assistance could not be substantiated from the file. 2. For one tenant, the Authority was unable to provide the HUD Form 50058; the form was not retained in the tenant file and only tenant balances from the Authority’s housing software were available. The data is reportedly retrievable from HUD’s IMS/PIC system but could not be reproduced from the Authority’s records. 3. For one tenant, the income determination was incorrect. Social Security income was not recalculated based on the prior-year recertification; although an updated Social Security benefit letter was received indicating a change in the monthly benefit, the income reported on the HUD Form 50058 was not updated accordingly, resulting in an inaccurate rent and housing assistance payment (HAP) calculation. Criteria: Under 2 CFR §200.302 and §200.303, the Authority must maintain financial management systems and internal controls sufficient to ensure that costs are allowable, supported, and compliant with program requirements. The 2025 Compliance Supplement (4-14.881) identifies Eligibility (Type E) as subject to audit and requires that the HUD Form 50058-MTW key line items be “documented in the recipient’s file.” HUD program rules require PHAs to complete and retain accurate HUD Forms 50058, to verify income through HUD’s EIV system, and to recalculate income upon receipt of updated benefit information. Records supporting federal program compliance must be retained and accessible (2 CFR §200.334). Cause: The Authority lacked effective internal controls over tenant file documentation, income verification (including use of EIV and updated benefit information), HUD Form 50058 completion and retention, and reexamination procedures. Effect: Missing Forms 50058 and EIV documentation leave family eligibility and assistance payments unsupported; the failure to recalculate income based on updated Social Security benefit information resulted in an inaccurate income determination and rent/HAP calculation. These deficiencies increase the risk of over- or under-payment of housing assistance and questioned costs under the MTW program. Questioned Costs: $395,581 Recommendation: The Authority should ensure the executed HUD Form 50058 (and supporting income/EIV documentation) is completed and retained in each tenant file; recalculate income promptly upon receipt of updated benefit information and reflect the change on the Form 50058; perform EIV verification and reconciliation at each admission and reexamination; conduct a file-completeness review before sign-off; provide staff training on income determination, EIV, and federal recordkeeping; and, where forms were not retained, download and refile them from IMS/PIC. Reply and Corrective Action Plan: The Authority concurs with the finding and questioned costs of $395,581 and acknowledges it is a repeat of finding 2024-005. Ensure Forms 50058 and supporting documentation are retained; recalculate household income when required; retrieve or reconstruct missing records; resolve questioned costs with HUD; conduct file reviews; and provide staff training.

Compliance Deficiencies Identified in HUD Monitoring Review (ALN 14.881) Condition: The compliance deficiencies identified in the U.S. Department of Housing and Urban Development (HUD) Compliance Monitoring Review conducted June 24–28, 2024 (formalized in HUD’s letter dated March 24, 2025) remained unresolved as of September 30, 2025. The open items span multiple program areas, including governance and internal controls, Housing Choice Voucher (HCV) program compliance, Project-Based Voucher (PBV) documentation, Public Housing operations, ROSS grant administration, Violence Against Women Act (VAWA) policy, and Section 3 compliance. This condition is a repeat of prior year finding 2024-006. Criteria: The HUD findings cite noncompliance with various federal regulations, including 2 CFR Part 200 and 24 CFR Parts 5, 35, 75, 960, 982, and 983, as well as HUD Notices PIH 2016-22, 2017-13, 2022-10, and 2023-03. Under 2 CFR §200.303 and §200.521, the Authority is responsible for taking timely and appropriate corrective action on identified deficiencies. Cause: The Authority had not fully implemented or updated the policies, procedures, and documentation necessary to resolve the open HUD monitoring findings and align with current HUD requirements. Effect: Failure to resolve these deficiencies on a timely basis results in continued noncompliance with federal program requirements, may lead to disallowed costs or HUD sanctions, and increases the risk of recurring audit findings in future periods. Questioned Costs: None. Recommendation: The Authority should prioritize timely resolution of all open HUD monitoring findings; implement the corrective actions outlined in HUD’s letter (policy updates, staff training, file reviews, and required certifications); assign responsibility and target completion dates for each open item; and maintain ongoing communication with HUD to confirm closure. Reply and Corrective Action Plan: The Authority concurs with the finding and acknowledges it is a repeat of finding 2024-006. Maintain a remediation tracker; implement corrective actions identified by HUD; conduct training and file reviews; submit required certifications; and provide progress updates until all items are closed.

2025-001 Compliance and Internal Controls over Reporting (Significant Deficiency) Assistance Listing Number 17.259 – Workplace Innovation and Opportunity Act Cluster / WIOA Youth Activities 2024-2025 Funding U.S. Department of Labor Passed through Texas Workforce Commission / Houston Galveston Area Council Contract No. 206-25 Criteria: Under 2 CFR Section 200.303(a), the recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, per the Subrecipient Contract Scope of Work 13.1, a monthly report to the Board and H-GAC contract liaison is due by the 10th of each month. Monthly reports are required to be submitted to the grantor to properly track grant progress, which allows the grantor to determine if further action is needed to fulfill the purpose of the grant. Condition: Monthly reports for October 2024, December 2024 and May 2025 were not submitted timely. SER-Jobs’ established controls over the reporting process did not work effectively to detect and/or correct non-compliance over the reporting process. Cause: Monthly reports were submitted late due to delays in accounting period close, which delayed the submission process to include the financial information in the required reports. Effect: Failure to submit the required reports as stipulated in the scope of work by the grantor may constitute a breach of contract and potential loss of funding. Questioned Costs: None. Perspective: 3 out of the 4 reports selected for our testing were not submitted timely. Repeat Finding: No Recommendation: Ser-Jobs should establish procedures to ensure that controls related to reporting are consistently implemented which should include prompt completion of the accounting period close to allow for timely submissions. Views of Responsible Officials: We concur with the recommendation, please see Corrective Action Plan.

2025-001: Accounting Records and Documentation (Significant Deficiency) Federal Program: Child Nutrition Cluster – School Breakfast Program (AL No. 10.553) and National School Lunch Program (AL No. 10.555) Condition: During our audit of compliance with federal program requirements, we noted that the District did not consistently maintain accounting records and supporting documentation for Child Nutrition Program reimbursement transactions in a manner that ensured timely accessibility for audit testing. Certain reimbursement requests and related supporting documentation were not readily available during audit fieldwork. As a result, we were required to perform expanded audit procedures, including additional reconciliations and alternative testing, to obtain sufficient appropriate audit evidence supporting the reported reimbursement amounts. Criteria: Uniform Guidance (2 CFR §200.302 and §200.303) requires nonfederal entities to maintain accurate, complete, and adequately supported financial records and to establish effective internal controls to ensure compliance with federal program requirements. Cause: The deficiency appears to be attributable to weaknesses in the District’s documentation retention, organization, and supervisory review procedures related to Child Nutrition reimbursement reporting. Effect: Although documentation was not fully sufficient at the outset of audit testing, expanded audit procedures allowed us to obtain reliable support for the reimbursement amounts tested. No questioned costs or audit differences were identified as a result of this condition. Testing of reimbursement activity disclosed no variances between amounts reported and amounts received, based on a tested population totaling $793,987.13. Recommendation: We recommend that the District strengthen its internal controls over the preparation, review, organization, and retention of Child Nutrition Program reimbursement documentation to ensure that complete and accurate supporting records are maintained and readily available for audit and monitoring purposes. Views of Responsible Officials: The District’s management concurs with the finding and plans to implement procedures to improve the completeness and accessibility of accounting records and supporting documentation related to federal program reimbursements.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Suspension and Debarment, Reporting, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) Federal Program Title: Food Distribution Cluster Texas 1944 Water Treaty Grant ALN: 10.565, 10.568, 10.560 10.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Food Distribution Cluster 246TX816Y8105, 256TX816Y7105, 246TX818Y8613, 238TX000I1003, 246TX816Q2204 October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, November 3, 2023 - November 2, 2024, May 23, 2023 - June 30, 2025, October 1, 2023 - September 30, 2024 Texas 1944 Water Treaty Grant FSA25GRA0012028 March 19, 2025 - March 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Department of Agriculture (TDA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user termination controls, we identified two instances, out of a sample of 14 terminated users, in which access was not removed within the timeframe required by TDA’s System Administrator separation process (i.e., application access removed on the date of the ticket/same day of termination and network access within one business day): Application (TX‑UNPS): User A was terminated on 06/13/2025. Network access was removed on 06/16/2025 (within one business day), but TX‑UNPS application access remained active until 06/19/2025 (removed after four business days), which does not meet the same‑day requirement for application access. Network: User B was terminated on 09/13/2024. Network access was removed on 09/17/2024 (removed after one business day due to weekend/holiday schedule), which does not meet the requirement for removal within one business day. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that TDA: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: TDA agrees with the finding. TDA acknowledges that improvements can be made to the separation process.

Cash Management, Eligibility, Matching and Earmarking, Period of Performance, Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – Change Management Federal Agency: U.S. Department of Justice Federal Program Title: Crime Victim Assistance ALN: 16.575 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 15POVC-25-GG-00366-ASSI, 15POVC-24-GG-00728-ASSI, 15POVC-23-GG- 00468-ASSI, 15POVC-22-GG-00468-ASSI, 2020-V2-GX-0040 October 1, 2024 – September 30, 2028, October 1, 2023 – September 30, 2027, October 1, 2022 – September 30, 2026, October 1, 2021 – September 30, 2025, October 1, 2020 – September 30, 2025, October 1, 2019 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Office of the Governor must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our review of information technology general controls related to network change management, we noted that the organization does not have a formal, documented change control process governing changes and approvals to the network hardware components and systems. As a result, network changes may not be consistently documented, reviewed, or formally approved. For purposes of this control, network changes include any additions, modifications, or removals affecting the network infrastructure, including but not limited to: • Network hardware (e.g., routers, switches, firewalls, wireless devices) • Network device configurations • Network related software, firmware, or operating system components Questioned costs: None. Context: See “Condition.” Cause: Management is aware of this matter and a draft policy initiative is already underway and targeted for completion during fiscal year 2026. Effect: In the absence of a formal documented change management process, there is an increased risk that unauthorized or untested network changes could adversely impact the confidentiality, integrity, or availability of systems and data. Repeat Finding: No Recommendation: We recommend that management finalize and implement the formal, documented network change management process to ensure all changes to network hardware, configurations, and related software are properly requested, reviewed, approved, tested, and documented. Views of responsible officials: A formal but not documented process has been utilized which requires CIO approval of all changes. A Project was instigated in 2024 to formalize and embed the verbal process into a written process with auditable execution logs. The project is in its final stages

Reporting – Financial, Performance and Special Reporting Federal Agency: U.S. Department of Labor (DOL) Federal Program Title: Unemployment Insurance (UI) ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: UI372522255A48, UI380082260A48, UI382492255A48, 23A03UI0389351, 23A60UR000007, 23A60UB000060, 24A55UI000051, 24A55UT000017, 24A60UR000091, 24A60UD000038, 25A55UE000005, 25A60UB000137, 25A60UB000149, 25A60UB000176, 25A60UB000187, 25A60UD000047, 25A55UI000094, 25A55UT000066, 25A60UR000102 October 1, 2021 – December 31, 2024, January 1, 2022 – September 30, 2024, January 1, 2022 – March 31, 2025, October 1, 2022 – December 31, 2025, January 1, 2023 – September 30, 2025, April 1, 2023 – May 22, 2025, October 1, 2023 – December 31, 2026, October 1, 2023 – September 30, 2024, January 1, 2024 – September 30, 2026, May 17, 2024 – May 17, 2027, July 1, 2024 – December 31, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 9, 2024 – July 9, 2027, October 1, 2024 – December 31, 2027, October 1, 2024 – September 30, 2025, January 1, 2025 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of financial, performance, and special reporting, we identified gaps in TWC’s documentation and oversight of its reporting processes. Specifically, for the ETA 2112 – UI Financial Transaction Summary, we tested three monthly reports, and none contained evidence of review or approval prior to submission. Similarly, for the ETA 9050 – Time Lapse of All First Payments Except Workshare and the ETA 9052 – Nonmonetary Determination Time Lapse Detection performance reports, we tested three monthly submissions for each report type, and all lacked documentation demonstrating that a formal accuracy and completeness review was performed. In addition, our testing of two quarterly ETA 2208A – Quarterly UI Above-Base Reports identified a lack of segregation of duties. For both reports tested, the individual responsible for preparing the report also performed the review function. Questioned costs: None. Context: See “Condition.” Cause: The absence of documented reviews and approvals appears to result from insufficient internal controls over the reporting process, including unclear staff responsibilities. These control gaps contributed to inconsistent application of review procedures and allowed instances where documentation of required oversight did not occur or was performed by the same individual responsible for report preparation. Repeat Finding: No Recommendation: TWC should strengthen internal controls over the reporting process by establishing clear roles and responsibilities for the preparation, review, and approval of all required ETA reports. Management should ensure that each report undergoes a documented, independent review to verify accuracy and completeness before submission. Additionally, TWC should provide targeted training to staff on reporting requirements and internal control expectations to reinforce consistent application of review procedures and prevent situations where the preparer and reviewer are the same individual. Views of responsible officials: Management agrees on the importance of the ETA reports and the accuracy of the information in the reports.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Reporting – Information Technology – User Access Federal Agency: U.S. Department of Veterans Affairs Federal Program Title: Veteran's State Nursing Home Care ALN: 64.015 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: N/A Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), The General Land Office (GLO) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our assessment of access controls, we noted that while GLO performs user access reviews for accounts with privileged (elevated) access to the network. No periodic user access review is performed for all network users (non‑privileged/general users) within the audit period. As a result, there is no documented verification that standard user accounts retain only appropriate, job‑related access. Questioned costs: None. Context: See “Condition.” Cause: The condition appears to result from policy and process gaps that focus review efforts primarily on privileged accounts, coupled with the absence of a formalized, agency‑wide schedule and procedure for reviewing all network users’ access and retaining evidence of those reviews. Effect: Failure to conduct and document periodic access reviews for all network users increases the risk that: • Excessive or outdated access persists undetected; • Unauthorized access to systems or data may occur; • Potential security, operational, and compliance exposures are elevated. No instances of misuse were identified during our procedures; however, the lack of comprehensive reviews represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that GLO: • Establish a formal, documented access review program that covers all network users (privileged and non‑privileged) on at least an annual cadence. • Implement standardized templates and a central repository to capture review date, reviewer, population, exceptions identified, and remediation actions taken. • Periodically monitor adherence to the review schedule and report completion status and exceptions to management governance (e.g., IT leadership or an information security committee). Views of responsible officials: Management of the Texas General Land Office (GLO), Information Technology Services (ITS) Department, concurs with the audit finding and agrees that formalizing and documenting a periodic user access review process for all non-privileged network users will further strengthen the agency’s internal control framework and cybersecurity posture in alignment with 2 CFR §200.303 and applicable federal internal control standards.

Procurement and Suspension and Debarment Federal Agency: U.S. Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) ALN: 66.468 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2521902915 September 1, 2024 - August 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Commission on Environmental Quality (TCEQ) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.318, the recipient or subrecipient must maintain and use documented procedures for procurement transactions under a federal award or subaward, including for acquisition of property or services. These documented procurement procedures must be consistent with State, local, and tribal laws and regulations and the standards identified in §§ 200.317 through 200.327. Per 2 CFR §200.214, recipients and subrecipients are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, as well as 2 CFR part 180. The regulations in 2 CFR part 180 restrict making Federal awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from receiving or participating in Federal awards. Condition: Audit procedures included a review of five procurements conducted during the fiscal year to assess whether TCEQ adhered to required procurement procedures and performed vendor eligibility verifications prior to entering into covered transactions. For one procurement, totaling $16,175, the required procurement processes were not followed, and the necessary vendor compliance checks, including verification of suspension and debarment status, were not completed before executing the transaction. Questioned costs: None. Context: See “Condition.” Cause: The procurement was initiated directly by the program area without notifying or coordinating with the Procurement and Contracts Section. Program staff proceeded with the purchase under the assumption that procurement involvement was unnecessary because the selected vendor was the sole provider of the required item. As a result, established procurement procedures and vendor compliance verification processes were not followed. Effect: Failure to follow procurement procedures and complete proper vendor compliance checks prior to entering into a covered transaction may lead to entering contracts with suspended or debarred vendors that could result in noncompliance and questioned costs. Repeat Finding: No Recommendation: TCEQ should provide targeted training to program staff on federal procurement requirements, including the necessity of coordinating all purchases through the P&C Section and completing required vendor compliance checks. Training should emphasize procedures for sole‑source or limited‑source procurements and reinforce staff responsibilities under 2 CFR procurement and internal control standards. Regular refresher sessions and documented guidance will help ensure consistent understanding and adherence to required procurement practices across all program areas. Views of responsible officials: The Financial Administration Division (FAD) will implement the audit’s recommendations. FAD will reinforce the guidance provided through continuous training, documentation, and improved internal controls.

Cash Management, Eligibility, Level of Effort, Earmarking, Period of Performance, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Education (USDE) Federal Program Title: Career and Technical Education - Basic Grants to States ALN: 84.048 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: V048A220043, V048A230043, V048A240043 July 1, 2022 - September 30, 2023, July 1, 2023 - September 30, 2024, July 1, 2024 - September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Higher Education Coordinating Board (THECB) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of access controls, we noted that while THECB performs user access reviews for individuals with network access, the reviews were not documented. The absence of documented evidence prevents verification that the reviews were completed, who performed them, when they were performed, and whether identified issues were appropriately resolved. Questioned costs: None. Context: See “Condition.” Cause: The lack of documented access reviews appears to result from informal review processes and insufficient procedures requiring reviewers to maintain written evidence of the review. Additionally, there may be no standardized template or centralized repository for retention of such documentation. Effect: Without documentation of the network access review, THECB cannot demonstrate that: • Reviews were performed within the applicable audit period • Access rights were validated for appropriateness • Unauthorized or outdated access was identified and removed This lack of documentation increases the risk of unauthorized system access, potential misuse of systems or data, and noncompliance with federal internal control requirements. Repeat Finding: No Recommendation: We recommend that THECB: • Develop and implement a standardized documentation process for all user access reviews, including a required template documenting review date, reviewer identity, scope, results, and remediation actions. • Maintain all documentation in a centralized repository accessible to IT management and audit personnel. • Implement periodic monitoring to ensure reviews are performed timely and documentation is consistently retained. • Consider using automated access review tools to support completeness, timeliness, and auditability of reviews. Views of responsible officials: THECB ITS agrees with the finding.

Reporting – ACF-196R Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF October 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR §265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. The ACF-204 report (Annual Report on State Maintenance-of-Effort Programs) must be completed and submitted in accordance with the requirements at 45 CFR §265.9(c). The report includes several line items that contain critical information, including “Total State MOE Expenditures.” Input for the Total State MOE expenditures line item is provided by the Texas Education Agency (TEA), the Texas Workforce Commission (TWC), and HHSC. The MOE amounts in the ACF-204 report are to agree to the amounts in the final ACF-196R report. For the FY2024 ACF-196R report, the contributing agencies reported State MOE expenditures on various line items including but not limited to: HHSC – Line 6a (Basic Assistance (excluding Relative Foster Care Maintenance Payments and Adoption and Guardianship Subsidies) TEA – Line 11b (Pre-Kindergarten/Head Start) Condition: All key line items in the FY 2024 ACF‑204 report were tested and agreed to supporting documentation without exception. However, the Total State Maintenance of Effort (MOE) Expenditures reported in the ACF‑204 by HHSC and the Texas Education Agency (TEA) did not reconcile to the amounts reported in the ACF‑196R as shown below: Amounts reported in the ACF‑204 were accurate and supported; the variances occurred because the ACF‑196R reflected higher MOE expenditures than those reported on the ACF‑204. Questioned costs: None. Context: See “Condition.” Cause: The variance in line 11b was due to miscommunication between the relevant HHSC personnel regarding revisions to an initial submission. The variance in line 6a was due to the HHSC Federal Reporting Team incorrectly including period 1 of 2025 in the MOE calculation. The agency did not perform a complete reconciliation between the ACF‑204 and ACF‑196R prior to submission, resulting in inconsistent MOE reporting across the required reports. Effect: Inaccurate or inconsistent reporting of MOE expenditures increases the risk of noncompliance with federal reporting requirements under 2 CFR §200.302 (financial management) and 2 CFR §200.329 (performance and financial reporting). These discrepancies may impair the federal awarding agency’s ability to evaluate program performance, assess State MOE compliance, and rely on the accuracy of reported financial information. Repeat Finding: No. Recommendation: HHSC should strengthen their financial reporting controls to ensure consistency between the ACF‑204 and ACF‑196R reports. Specifically, the agency should implement a formal reconciliation process that: • Compares all MOE expenditure amounts reported on the ACF‑204 to those reported on the ACF‑196R prior to submission; • Requires documented review and approval of the reconciliation by management; and • Ensures any discrepancies are researched, resolved, and corrected before the reports are finalized. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Child Support Non-Cooperation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 608 (a)(2), if the agency responsible for administering the State plan approved under part D determines that an individual is not cooperating with the State in establishing paternity or in establishing, modifying, or enforcing a support order with respect to a child of the individual, and the individual does not qualify for any good cause or other exception established by the State pursuant to section 654(29) of this title, then the State: (1) shall deduct from the assistance that would otherwise be provided to the family of the individual under the State program funded under this part an amount equal to not less than 25 percent of the amount of such assistance; and (2) may deny the family any assistance under the State program. The State’s policy is to reduce benefits 100% for non-cooperation. HHSC policy requires that when the Office of the Attorney General (OAG) identifies a TANF recipient who has failed to cooperate with child support requirements, OAG must notify HHSC within seven days of the non‑cooperation date. Upon receipt, HHSC must apply the sanction within five working days. Condition: A sample of 40 TANF beneficiaries who were reported as non‑cooperating with program requirements during fiscal year 2025 was selected for testing. Two instances of untimely sanction application were identified: • One case in which HHSC reduced benefits one month late, resulting in an overpayment of $320. • One case in which HHSC reduced benefits two months late, resulting in an overpayment of $890. Questioned costs: $1,210 Context: See “Condition.” Cause: HHSC’s internal controls did not consistently ensure timely processing of sanctions upon receipt of non‑cooperation referrals from OAG. Existing monitoring and workflow procedures were insufficient to detect or prevent delays in applying benefit reductions. Effect: Failure to apply sanctions within required timeframes can lead to inaccurate benefit issuance, questioned costs, and weakened program integrity. Repeat Finding: No. Recommendation: HHSC should strengthen internal controls over the processing of TANF non‑cooperation sanctions to ensure timely application in accordance with program requirements. Specifically, HHSC should: • Implement an automated or workflow‑based tracking mechanism to monitor the timeliness of sanctions received from OAG. • Provide refresher training to eligibility staff on timely sanction procedures and the importance of preventing improper payments. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §261.60(a)-(c), a State must report the actual hours that an individual participates in an activity. It is not sufficient to report the hours an individual is scheduled to participate in an activity. For unsubsidized employment, subsidized employment, and on-the-job training, the State may report projected actual hours of employment participation for up to six months based on current, documented actual hours of work. Any time the State receives information that the client's actual hours of work have changed, or no later than the end of any six-month period, the agency must re-verify the client's current actual average hours of work and may report these projected actual hours of participation for another six-month period. Condition: Audit procedures included independently recalculating average work participation hours for a sample of 40 TANF cases and comparing those results to the hours reported to the U.S. Department of Health and Human Services on the ACF‑199 report. For one of the 40 cases tested, the recalculated average work hours did not agree with the hours reported on the ACF‑199. This discrepancy resulted in a net overstatement of 9 hours on the ACF‑199 report. Questioned costs: No. Context: See “Condition.” Cause: The variance in reported hours for the affected case resulted from a system processing error by the third‑party vendor. During extraction from the WorkInTexas (WIT) system, TWC’s case management system, and file creation for transmission to HHSC, certain hour entries were inadvertently duplicated, leading to the double‑counting of participation hours and, consequently, an overstatement in the ACF‑199 reporting. Effect: Inaccurate reporting of work participation hours affects the reliability of the State’s TANF data submitted to the federal government and may compromise the accuracy of the State’s calculated work participation rates. Such reporting inaccuracies increase the risk of noncompliance with federal work verification requirements and may expose the State to potential penalties if similar errors are systemic or not promptly addressed. Repeat Finding: No. Recommendation: TWC, in coordination with the system vendor, should strengthen controls over the extraction, translation, and transmission of work participation hour data used in the ACF‑199 report. Specifically, TWC should: • Require the third-party vendor to implement system safeguards that prevent the duplication of hour entries during data extraction from the WIT system and subsequent file creation. • Establish automated validation checks to detect anomalies such as duplicate lines, unexpected variances, or irregular hour totals prior to ingesting vendor files into TWC systems. • Enhance supervisory review procedures to ensure that data received from third‑party vendors is reconciled to source records and verified for completeness and accuracy before inclusion in federal reporting. Views of responsible officials: TWC’s Divisions of Workforce Development, Information Technology, and Information, Innovation and Insight agree with the recommendations.

Cash Management – Cash Management Improvement Act Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXLIEA, 2301TXLIEE, 2401TXLIEA, 2401TXLIEI, 2501TXLIEA, 2501TXLIEI October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 31 CFR §205.20, states use clearance patterns to project when funds are paid out, given a known dollar amount and a known date of disbursement. A state must ensure that clearance patterns meet the following standards: (a) A clearance pattern must be auditable. (b) A clearance pattern must accurately represent the flow of Federal funds under the Federal assistance programs to which it is applied. (c) A clearance pattern must include seasonal or other periodic variations in clearance activity. (d) A clearance pattern must be based on at least three consecutive months of disbursement data, unless additional data is required to accurately represent the flow of Federal funds. (e) If a State uses statistical sampling to develop a clearance pattern, the sample size must be sufficient to ensure a 96 percent confidence interval no more than plus or minus 0.25 weighted days above or below the estimated mean. (f) A clearance pattern must extend, at a minimum, until 99 percent of the dollars in a disbursement have been paid out for Federal assistance program purposes. (g) We and a State may agree to other procedures, such as estimates to project when funds are paid out when the dollar amount and/or the timing of disbursements are not known. Condition: The LIHEAP program is included in the Treasury-State Agreement effective for the fiscal year ending August 31, 2025, and it meets the threshold for inclusion under the Cash Management Improvement Act (CMIA). As such, TDHCA is required to prepare Period 1 clearance pattern calculations supported by verifiable disbursement data to ensure federal funds are drawn in accordance with the program’s required average clearance pattern of three days. TDHCA did not prepare a Period 1 clearance pattern calculation for LIHEAP based on at least three consecutive months of disbursement data as required. Although the Treasury-State Agreement specifies a three‑day average clearance pattern for the program, TDHCA did not maintain or provide documentation supporting how this clearance pattern was developed. As a result, the clearance pattern was not auditable, and we were unable to determine whether TDHCA’s practices for drawing federal funds aligned with the CMIA requirements. Questioned costs: None. Context: See “Condition.” Cause: Management noted their clearance pattern reflected their established funding techniques and prior reports; therefore, they overlooked the specific Treasury-State Agreement documentation requirements. Effect: Although we were able to perform testing over TDHCA’s cash management practices for LIHEAP and concluded that no federal interest was earned as a result of timing differences, the absence of a documented Period 1 clearance pattern calculation prevented us from validating the accuracy of the three‑day clearance pattern prescribed in the Treasury–State Agreement. Without an auditable calculation, TDHCA cannot demonstrate that the established clearance pattern is supported by actual disbursement data, which limits assurance that the methodology used for federal draws fully complies with CMIA requirements. Repeat Finding: No Recommendation: TDHCA should establish and implement procedures to ensure that a Period 1 clearance pattern calculation is completed and retained for LIHEAP in accordance with CMIA and Treasury–State Agreement requirements. This calculation should be based on at least three consecutive months of actual disbursement data and documented in a manner that is readily auditable. TDHCA should also provide training to staff responsible for CMIA compliance to ensure they are aware of the requirement to prepare and maintain this calculation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Reporting – Quarterly Performance and Management Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2501TXLIEI October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §96.82(a), each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Key Line Items containing critical information include: 1. Section 1 – Total Households Assisted 2. Section 2 – Performance Management 3. Section 3 – Estimated Use of Funds 4. Section 4 – LIHEAP Program Implementation and Support Condition: As part of our testing of the Quarterly Performance and Management Report for award 2501TXLIEI, we selected 2 of the 4 reports submitted during the fiscal year. During our review, we identified a discrepancy in the quarter 1 report (October 1 – December 31). The report stated that $159,463,428 in LIHEAP funds had been obligated by funding source in Section 3 – Estimated Use of Funds; however, supporting documentation reflected obligated funds totaling $174,447,109, resulting in a variance of $(14,983,681). Questioned costs: None. Context: See “Condition.” Cause: An error was made when TDHCA staff entered the amount of funds obligated into the report, and existing internal controls did not detect the error before the report was submitted to U.S. Department of Health and Human Services (HHS) Effect: Inaccurate reporting may lead to misstated financial information at the federal level, hinder management’s ability to make informed decisions, and could affect federal oversight and monitoring of program activity. These discrepancies increase the risk of noncompliance with federal reporting requirements and may impact the integrity of cumulative statewide LIHEAP reporting. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its review and reconciliation procedures for quarterly LIHEAP reporting to ensure that amounts reported are fully supported by accurate and complete documentation. This should include implementing a formal review process that requires verification of reported obligation amounts against source records prior to submission, as well as enhanced training for staff responsible for report preparation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Period of Performance, Reporting, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Temporary Assistance for Needy Families 2401TXTANF, 2501TXTANF October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2025 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Department of Family and Protective Services (DFPS) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user access termination controls, we identified two instances, out of a sample of 25 terminated users, in which individuals were not removed from the Network and IMPACT in a timely manner. In both cases, the users’ accounts remained active well beyond their documented termination dates, resulting in unauthorized active credentials during the post‑termination period. The two exceptions were as follows: User A: Termination date 11/05/2024; access not removed until 11/22/2024. User B: Termination date 11/17/2024; access not removed until 02/20/2025. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend DFPS: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: Management agrees with the findings.

Reporting – Post-Expenditure Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: • TANF Funds Transferred into SSBG –Amount reported on this line item should be consistent with the TANF federal financial report (ACF-196R). The Federal Funds Office (FFO) is responsible for the completeness, accuracy, and timely submission of the Post Expenditure Report. Federal Reporting Fiscal Management personnel are responsible for proper reporting and submission of the ACF-196R Report. Condition: During testing of key line items for the FY2024 Post Expenditure Report submitted in March 2025, we noted that TANF Funds Transferred into SSBG was reported as $41,623,634. However, the amount reported on the ACF-196R report was $38,778,521, resulting in a variance of $2,845,113. Questioned costs: None Context: See “Condition.” Cause: FFO did not properly coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196R report were consistent with the amount on the Post Expenditure Report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: 2023-013, 2024-008 Recommendation: We recommend the FFO coordinate with the appropriate Federal Reporting Team personnel regarding amounts noted for the TANF Funds Transferred into SSBG to ensure the amount in the Post Expenditure Report matches with the amount in the ACF-196R. Views of responsible officials: HHSC concurs with the recommendation.

Earmarking – Administrative Expenses Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM087322 October 17, 2022 – October 16, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 300x-5(b), a funding agreement for a grant under section 300x of this title is that the State involved will not expend more than 5 percent of the grant for administrative expenses with respect to the grant. Condition: HHSC expended $1,069,086 of the total grant award amount of $3,690,918 as of the end of the project period. Administrative expenditures for the grant totaled $54,672, which represents 5.11 percent of the federal funds expended, exceeding the allowable 5 percent threshold. Questioned costs: $1,217. Context: See “Condition.” Cause: The overage resulted from a delay in the grant’s start date, which subsequently postponed the initiation of related projects and led to lower overall expenditures. Effect: By exceeding the 5 percent administrative cap, HHSC did not comply with the statutory limitation on administrative costs, resulting in unallowable administrative expenditures charged to the grant. This noncompliance may require reimbursement to the federal agency and increases the risk of future questioned costs. Repeat Finding: No Recommendation: We recommend HHSC make necessary adjustments to federal expenditures in the event of program delays to ensure the agency stays within required percentage maximums. Views of responsible officials: HHSC concurs with the recommendation.

Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Special Education – Grants for Infants and Families Temporary Assistance for Needy Families (TANF) Block Grants for Prevention and Treatment of Substance Abuse ALN: 84.181 93.558 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Special Education – Grants for Infants and Families H181A200171, H181A210171, H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024, July 1, 2024 – September 30, 2025, July 1, 2025 – September 30, 2026 TANF 2001TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF and 2501TXTANF October 1, 2019 – September 30, 2020, October 1, 2020 – September 30, 2021, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI083054, 1B08TI083478, 1B08I084673, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2019 – September 30, 2021, October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), assistance listings numbers (ALN), and title of the program. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Special Education – Grants for Infants and Families (SEGIF) –The UEI was not included in the base subaward agreement for seven of the eight agreements selected for testing. The last amendment to the original agreement included the UEI number, however, it did not reference the ALN and title of the program. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Temporary Assistance for Needy Families – The ALN and title of the program was not included in four of the seven subaward agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Block Grants for Prevention and Treatment of Substance Abuse –The UEI was not included in one of the 18 agreements selected for testing. The start and end dates for the agreement was September 1, 2020 – August 31, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR §200.332 prior to execution is not at the correct precision level. Effect: Because required subaward information was omitted, HHSC increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing UEI, ALN, and program titles may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: HHSC concurs with the recommendation.

Level of Effort - Supplement not Supplant Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster ALN: 93.044, 93.045, 93.053 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD October 1, 2021 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §1321.9(c)(2)(xvi), funds awarded under Title III of the Older Americans Act for services provided under section 321(d) (42 U.S.C 3030d(d)) must be used to supplement, not supplant existing Federal, State, and local funds expended to support those activities. Condition: A comparison of supportive services and senior center funding between fiscal years 2023 and 2024 showed that total service levels increased by approximately 5 percent, rising from $40,354,713 in FY2023 to $42,267,130 in FY2024. During the same period, federal expenditures increased by 8 percent, from $31,170,863 to $33,755,005, while non‑federal expenditures decreased by 7 percent, from $9,183,850 to $8,512,125. Because the increase in federal funding outpaced the increase in total services, and was accompanied by a reduction in non‑federal contributions, federal funds effectively replaced rather than supplemented state or other non‑federal resources. Accordingly, HHSC supplanted non‑federal funds with federal funds for the 2024 grant. To quantify the financial impact, total services increased by 5 percent; therefore, the federal contribution would be expected to increase proportionally by 5 percent. Applying a 5 percent growth rate to the FY2023 federal amount of $31,170,863 yields an expected level of $32,729,406 for FY2024. However, actual federal expenditures totaled $33,755,005, resulting in excess federal funding of $1,025,599 beyond what would be needed to support the observed service increase. Questioned costs: $1,025,599. Context: See “Condition.” Cause: HHSC has followed supplement not supplant policies and procedures that were implemented based on compliance with total level of services (i.e., all services) and not specifically for supportive services and senior centers, as required. Effect: HHSC has supplanted non-federal funds used for supportive services and senior centers, resulting in questioned costs and noncompliance. Repeat Finding: No Recommendation: HHSC should revise existing policies and procedures to ensure they are not supplanting nonfederal funds specifically related to supportive services and senior centers. Views of responsible officials: HHSC concurs with the recommendation.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.044, 93.045, 93.053 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXSSC6, 2101TXCMC6, 2101TXHDC6, 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD, 2201TXSTPH, 2301TXOAHD, 2301TXOACM, 2301TXOASS, 2301TXOANS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS, 2501TXOASS, 2501TXOAHD, 2501TXOACM, 2501TXOANS April 1, 2021 – September 30, 2025, October 1, 2021 – September 30, 2024, January 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 TANF 2401TXTANF and 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Block Grants for Community Mental Health Services 1B09SM085913, 1B09SM085385, 1B09SM087345, 1B09SM087322, 1B09SM089380, 1B09SM089610, 1B09SM089984 September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, September 30, 2023 – September 29, 2025, October 1, 2023 – September 30, 2025, September 30, 2024 – September 29, 2026 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Nonmajor programs Opioid STR 6H79TI083288, 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. As of March 8, 2025, fsrs.gov was retired, and all subaward reporting data and functionality are now on SAM.gov. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards on FSRS.gov or SAM.gov. A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligation at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS.gov or SAM.gov. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2024-005, 2023-010, 2022-013, 2021-007 Views of responsible officials: HHSC concurs with the recommendation.

Special Provisions- Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Cluster (CCDF) ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCDC6, 2201TXCCDD, 2201TXCCDF, 2301TXCCDF, 2301TXCCDD, 2501TXCCDF, 2401TXCCDM, 2401TXCCDF, 2401TXCCDD, 2501TXCCDD, 2501TXCCDM, 2501TXCCDY October 1, 2020 – September 30, 2024, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026, October 1, 2024 – September 30, 2026, October 1, 2024 – September 30, 2027, and December 21, 2024 – September 30, 2028. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing fraud. In order to identify and recover payments, pursuant to TWC’s Childcare Services Guide (November 2024), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. TWC must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: According to the TWC Division of Fraud Deterrence and Compliance Monitoring’s Standard Operating Procedures for Workforce Board PIRTS Audits, when a Workforce Development Board identifies an improper payment, the Board is required to issue a Notice of Determination informing the participant of their ineligibility, the amount and time period of the improper payment, and the reason for the determination. If the improper payment results from fraud, the Board must issue a first collection letter within 30 days of sending the determination notice to initiate recoupment of the ineligible amount. If repayment is not received or an active payment plan is not established, the Board must issue a final collection letter and refer the participant to TWC for a warrant hold, which restricts the individual from receiving future services until the outstanding amount is recovered. All correspondence is to be documented and maintained in the Program Integrity Reporting Tracking System (PIRTS), the system used by Boards to report and track childcare fact‑finding, fraud determinations, and recoupment activities. As part of our audit procedures, we tested 40 of the 297 closed cases reported to TWC in fiscal year 2025 to verify that TWC followed its procedures related to authenticating that a payment was fraudulent and subsequently recovered payment, if applicable. Of the 40 cases tested, 12 cases did not follow the prescribed procedures and lacked evidence that the Workforce Boards issued the required 1st collection letter within the 30‑day timeframe. Questioned costs: None. Context: See “Condition.” Cause: The exceptions identified occurred because TWC did not provide adequate oversight or monitoring of Workforce Board compliance with established PIRTS procedures. Without routine monitoring, follow‑up, or enforcement mechanisms to ensure Boards issued collection letters within required timeframes, lapses in adherence to the 30‑day requirement went undetected. This lack of oversight contributed to inconsistent application of required fraud‑recovery processes across Boards. Effect: Failure to ensure that Workforce Development Boards issued required first collection letters within the prescribed 30‑day timeframe impeded timely initiation of recoupment efforts for fraudulent childcare payments. This condition increases the risk that improper payments resulting from fraud may not be recovered in a timely manner and that individuals with outstanding fraudulent overpayments may continue to seek or receive services. Repeat Finding: No Recommendation: TWC should strengthen its oversight of Workforce Board compliance with PIRTS requirements by implementing routine monitoring procedures to verify that Boards issue first collection letters within the required 30‑day timeframe. This may include periodic reviews of PIRTS documentation, automated tracking or alerts for timeliness, and follow‑up with Boards when deadlines are missed. Additionally, TWC should provide guidance or refresher training to reinforce expectations and ensure consistent application of improper payment recovery procedures across all Boards. Strengthening these oversight mechanisms will help reduce the risk of delayed collection efforts and improve adherence to established fraud‑deterrence processes. Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. TWC’s Division of Fraud Deterrence and Compliance Monitoring’s Office of Investigations (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. Additionally, TWC’s Subrecipient Monitoring Department (SRM) tests Board compliance with respect to childcare improper payment reporting and recoupment. TWC currently conducts routine monitoring and follow-up to ensure Boards issue collections letters in a timely fashion. That being said, TWC does agree that our objectives would be better served with more robust measures. Currently, FDCM/OI investigators review a sample of PIRTS reports on a monthly basis to ensure that Boards are uploading all required documentation related to childcare improper payments and undertaking collection efforts. Investigators review two randomly selected cases for each Board per month on a rolling basis for the prior three months. FDCM/OI also conducts periodic PIRTS training and retraining with Board staff. Additionally, the PIRTS system sends automated reminder notifications for Board staff to issue collection letters. FDCM/OI realizes the importance of issuing collection letters in a timely matter. Doing so not only increases the likelihood that important child care funds are remitted, but also assists with additional enforcement activities including prosecution of substantiated fraud. FDCM/OI takes the integrity of child care funds very seriously and will aid prosecution where appropriate.

Special Tests and Provisions – ADP Risk Analysis and System Security Review Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5001, 2505TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 – September 30, 2024, October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2024, October 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – December 31, 2024, October 1, 2024 – December 31, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §95.621, State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. Condition: HHSC maintains a total of 35 in-house and third-party systems that are used in the administration of Medicaid, which are required to be reviewed each biennial period. During the fiscal year 2024-2025 biennial, only 15 risk assessments were executed based on internal methodology or third-party assessments. HHSC did not perform risk assessments over the remaining 20 systems during the two-year period. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to it’s current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2024-012, 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5001, 2505TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 – September 30, 2024, October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2024, October 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – December 31, 2024, October 1, 2024 – December 31, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC policies require the completion of Form 2567 Statement of Deficiencies and Plan of Correction to include the prefix tag, the deficiency that contains the code of federal regulations (CFR) or life safety code (LSC) reference for each health and safety survey conducted. HHSC is required to mail a copy of the completed form to the provider within ten business days after the exit date of the survey to ensure any deficiencies noted are addressed timely. For one of 40 health surveys conducted during the fiscal year, Form 2567 was mailed out to the provider 162 business days after the exit date of the survey. While the form was mailed after the required timeline per HHSC policy, it did not include any cited deficiencies. Questioned costs: None. Context: See “Condition.” Cause: After the provider's exit date, HHSC regional staff subsequently determined, several months later, that the required notice had not been issued to the facility. This oversight occurred during a period of transition within the ICF team. Effect: Failure to notify a provider of identified deficiencies in a timely manner may prevent the provider from implementing corrective actions within the required timeframe to meet compliance deadlines. Such delays increase the risk of continued noncompliance and may result in inappropriate payments for new admissions before the provider agreement is terminated. Repeat Finding: No. Recommendation: HHSC should enhance and/or reinforce existing internal controls to ensure timely completion and mailing of Form 2567 to meet standards in 42 CFR Part 442 and related policy requirements. This could include developing automated tracking systems or checklists to monitor survey deadlines and/or providing refresher training for all regional staff involved in the survey and notification process. Views of responsible officials: HHSC concurs with the recommendation.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Equipment and Real Property Management, Matching, Level of Effort and Earmarking, Period of Performance, Procurement and Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) U.S. Department of Education (USDE) U.S. Department of Health and Human Services Social Security Administration Federal Program Title: SNAP Cluster Special Education Grants for Infants and Families Temporary Assistance for Needy Families Social Services Block Grant Block Grants Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse Aging Cluster Medicaid Cluster Disability Insurance/ SSI Cluster ALN: 10.551, 10.561 84.181 93.558 93.667 93.958 93.959 93.044, 93.045, 93.053 93.775, 93.777, 93.778 96.001, 96.006 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SNAP Cluster 6TX400105, 6TX400106, USDA-FNS-SNAP-24-EVS-TX October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, September 25, 2024 - September 30, 2025 Special Education Grants for Infants and Families H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2022 - September 30, 2023, July 1, 2023 - September 30, 2024, July 1, 2024 - September 30, 2025, July 1, 2025 - September 30, 2025 Temporary Assistance for Needy Families 1601TXTANF, 1801TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF, 2501TXTANF October 1, 2015 - September 30, 2016, October 1, 2017 - September 30, 2018, October 1, 2020 - September 30, 2022, October 1, 2021 – September 30, 2022, October 1, 2022 - September 30, 2023, October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2025 - September 30, 2026 Block Grants Community Mental Health Services B09SM089610, B09SM087322, B09SM087345, B09SM085385, B09SM089380, B09SM089984, B09SM085913 October 1, 2023 - September 30, 2025, October 17, 2022 - October 16, 2024, October 1, 2022 - September 30, 2024, September 1, 2021 - March 24, 2025, September 30, 2023 - September 29, 2025, September 30, 2024 - September 29, 2026, September 1, 2021 - March 24, 2025 Block Grants For Prevention and Treatment of Substance Abuse B08TI087067, B08TI085835, B08TI084609, B08TI088134, B08TI083969 October 1, 2023 - September 30, 2025, October 1, 2022 - September 30, 2024, September 1, 2021 - March 24, 2025, October 1, 2024 - September 30, 2026, September 1, 2021 - March 24, 2025 Aging Cluster 2101TXSSC6, 2101TXCMC6, 2101TXHDC6, 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD, 2201TXSTPH, 2301TXOAHD, 2301TXOACM, 2301TXOASS, 2301TXOANS, 2401TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2501TXOASS, 2501TXOAHD, 2501TXOAHD, 2501TXOANS April 1, 2021 - September 30, 2025, October 1, 2021 - September 30, 2024, January 1, 2022 - September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 - September 30, 2025, October 1, 2024 - September 30, 2026 Medicaid Cluster 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2024, October 1, 2024 - September 30, 2024, October 1, 2024 – September 30, 2025, October 1, 2023 - September 30, 2025, October 1, 2024 - December 31, 2024 Disability Insurance/ SSI Cluster 2304TXDI00, 2404TXDI00, 2504TXDI00 October 1, 2023 - February 2, 2024, October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user access within the CAPPS FIN (PeopleSoft Financials) system, we identified two user accounts, out of 17 tested, that had been granted inappropriate access to the PeopleSoft Administrator role. This role provides elevated privileges beyond those required for their job duties and should be limited to authorized system administrators. Management remediated the inappropriate access on November 10, 2025. Questioned costs: None. Context: See “Condition.” Cause: The inappropriate access assignments appear to result from gaps in privileged access provisioning and periodic re‑certification controls within the CAPPS FIN environment. Effect: Improper assignment of elevated PeopleSoft Administrator access in CAPPS FIN increases the risk of: • Unauthorized changes to system configuration, accounting rules, or financial data; • Data modification or exposure, including information related to federal program expenditures; • Bypassing of compensating controls intended to maintain data integrity and separation of duties; Although management removed access on 11/10/2025, the presence of improper administrator‑level access before remediation represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend HHSC: • Strengthen privileged access provisioning by requiring documented approval, business justification, and periodic revalidation for all elevated roles in CAPPS FIN. • Implement a formal, recurring privileged access review across all CAPPS FIN modules, with documented results and timely remediation of exceptions. • Utilize identity governance tools or CAPPS FIN security reporting to automatically flag unauthorized assignments of administrator roles. Views of responsible officials: HHSC concurs with the recommendation.