Findings Citing § 200.303

Finding Number: 2025-022 Prior Year Finding Number: 2024-026 Compliance Requirement: Special Tests and Provisions – Payment Rate Setting and Application Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per CFSA’s internal policies and procedures, providers must submit quarterly reports within 45 days of the end of each Federal fiscal year quarter. Upon receipt of quarterly reports from the provider, the Business Services Administration Program Manager reviews each Expenditure Detail Spreadsheet for compliance, accuracy and reasonableness. Condition – Our assessment of the special tests and provisions requirement revealed that while the selected providers’ quarterly reports displayed no deficiencies, CFSA was unable to provide documentation evidencing the review and approval of the quarterly reports relating to all sixty (60) transactions that were tested. Questioned Costs – Not determinable. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – The absence of documentation specifying who reviews and approves the quarterly reports compromises accountability and creates ambiguity in identifying the responsible parties in instances of errors or discrepancies. Cause – CFSA does not have adequate controls in place to ensure that review and approval of provider’s quarterly reports are documented. Recommendation - We recommend CFSA strengthen its policies and procedures to address the review and approval process for the provider’s quarterly reports. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-023 Prior Year Finding Number: 2024-027 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CFR Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CFR Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CFR Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CFR Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination during the fiscal year 2025 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exceptions: • For four (4) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-024 Prior Year Finding Number: 2024-030 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Years: 09/30/2022 – 09/29/2025 09/30/2024 – 09/29/2027 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal Funding Accountability and Transparency Act (FFATA) Reporting Compliance: In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025, onwards. FFATA reports are submitted no later than the month following the month in which this Federal award is made, and annually after that. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, 2 CFR Section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – During our testing of the reporting compliance requirement, we noted the following: • FFATA Reporting Compliance: During our testing of FFATA reporting, it was noted that reports were submitted late by the DBH program management due to staffing shortage. The FFATA reporting for all nine subawards selected for testing was submitted late, i.e., beyond the deadline of within 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: During our testing of the SEFA, we noted that DBH incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2025, DBH incurred $12.4 million in subrecipient expenditures for this program and incorrectly reported $11.7 million subrecipient expenditures on the preliminary SEFA. While the subrecipient expenditure amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with specified reporting requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure timely reporting and that correct amounts were reported and were properly reviewed as it relates to the Opioid STR program: • FFATA Reporting Compliance: Failure to submit FFATA reports within the deadline of 30 days of the subaward or subaward modification date results in noncompliance for the DBH program. • SEFA Reporting Compliance: The effect of the condition is that the SEFA was not accurately prepared. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that FFATA reports were submitted timely and the amounts on the SEFA were properly reported. Recommendation – We recommend the following: • FFATA Reporting Compliance: We recommend DBH to strengthen its internal control and procedures to ensure submission of FFATA reports within the deadline of 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: We recommend DBH to ensure that agency personnel receive proper training on subrecipient versus vendor determination; as well as review existing policies and procedures for preparing the SEFA to ensure that it is complete and accurate. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-025 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Key Employees Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Years: 09/30/2022 – 09/29/2025 09/30/2024 – 09/29/2027 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.508(d) says an auditee must “provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part.” The grant agreements provide that the State must maintain certain key personnel. Key personnel are organization staff members or consultants/subrecipients who must be part of the project regardless of whether they receive a salary or compensation from the project. These individuals must make a substantial contribution to the execution of the project. Key personnel for this program are the Project Director, Project Coordinator, and Data Coordinator. The Project Director, Project Coordinator, and Data Coordinator cannot be the same person. No more than two people can share a position. The Project Director is responsible for oversight of the entire project, including overseeing, monitoring, and managing the award, with a level of effort of 100% (1.0 FTE). The Project Coordinator is responsible for the day-to-day operations of the project, with a level of effort of 100% (1.0 FTE). The Data Coordinator is responsible for all aspects of data collection and reporting, ensuring complete, accurate, and timely data entry into SPARS and/or other data systems as directed by SAMHSA. The Data Coordinator is also responsible for monitoring client-level intake and follow-up rates, to ensure that recipients are meeting the target numbers reported in the application. The level of effort is 100% (1.0 FTE) for all awards $4 million and above, and 50% (0.5 FTE) for all awards less than $4 million. Any changes to key personnel, including level of effort involving separation from the project for more than three months or a 25 percent reduction in time dedicated to the project, requires prior approval, and must be submitted as a post-award amendment. Condition – During our testing of the key personnel requirement, we noted that for all four (4) samples selected for testing, we were unable to obtain and review documentation to support that the key personnel met the level of effort on the awards as required by the grant agreement. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with specified requirements using a statistically valid sample. Effect – There is a risk that employees are working on the program that are not approved by the granting agency. Cause – Management has not established internal control policies and procedures to ensure that key personnel met the level of effort on the awards as required by the grant agreement. Recommendation – We recommend that DBH develop and implement policies, procedures and controls to ensure proper documentation of the required and actual time and effort from key personnel in accordance with grant requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH agrees with the findings and will put controls into place to resolve the issues. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-026 Prior Year Finding Number: 2024-036 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2025; 09/01/2021 – 09/30/2025; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal Funding Accountability and Transparency Act (FFATA) Reporting Compliance: In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025, onwards. FFATA reports are submitted no later than the month following the month in which this Federal award is made, and annually after that. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, 2 CFR Section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – During our testing of the reporting compliance requirement, we noted the following: • FFATA Reporting Compliance: During our testing of FFATA reporting, it was noted that reports were submitted late by the DBH program management due to staffing shortage. The FFATA reporting for all four subawards selected for testing was submitted late, i.e., beyond the deadline of within 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: During our testing of the SEFA, we noted that DBH incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2025, DBH incurred $1.2 million in subrecipient expenditures for this program and incorrectly reported $1.4 million subrecipient expenditures on the preliminary SEFA. While the subrecipient expenditure amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with specified reporting requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure timely reporting and that correct amounts were reported and were properly reviewed as it relates to the Block Grants for Substance Use Prevention, Treatment, and Recovery Services program: • FFATA Reporting Compliance: Failure to submit FFATA reports within the deadline of 30 days of the subaward or subaward modification date results in noncompliance for the DBH program. • SEFA Reporting Compliance: The effect of the condition is that the SEFA was not accurately prepared. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that FFATA reports were submitted timely and the amounts on the SEFA were properly reported. Recommendation – We recommend the following: • FFATA Reporting Compliance: We recommend DBH to strengthen its internal control and procedures to ensure submission of FFATA reports within the deadline of 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: We recommend DBH to ensure that agency personnel receive proper training on subrecipient versus vendor determination; as well as review existing policies and procedures for preparing the SEFA to ensure that it is complete and accurate. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-027 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Homeland Security COVID-19 – Disaster Grants - Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Homeland Security and Emergency Management Agency (HSEMA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, 2 CFR Section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – During our testing of federal reporting and the Schedule of Expenditures of Federal Awards (SEFA), we noted that the cumulative federal expenditures reported on two (2) quarterly Federal Financial Report (SF-425) did not reconcile the total expenditures claimed on the SEFA for the life of the award. Specifically, the SF-425 submitted for the period ended September 30, 2025 reported a cumulative total of approximately $924 million, whereas the SEFA recorded lifetime expenditures of approximately $1.051 billion, resulting in an unreconciled variance of approximately $127 million. Additionally, during our testing of the SEFA, we noted that HSEMA incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2025, HSEMA had a negative $0.7 million in subrecipient expenditures for this program and incorrectly reported $37.9 million subrecipient expenditures on the preliminary SEFA. While the subrecipient expenditure amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of HSEMA’s compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – HSEMA did not comply with their policies and procedures to ensure accuracy of the SEFA and other reports necessary to meet compliance requirements. Recommendation – We recommend that HSEMA adheres to instituted policies and procedures to ensure the accuracy of the SF-425 and the SEFA. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – HSEMA agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Department of Treasury, State of Indiana Office of Community and Rural Affairs, Federal Financial Assistance Listing 21.029, AL192-23-NLC-23-103, AL192-23-NLC-25-104 A, AL192-23-NLC-25-104 B Coronavirus Capital Projects Fund Procurement, Suspension & Debarment Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR 200.318 maintains that recipients must have and use documented procurement policies and must conform procurement standards to Uniform Guidance standards in sections 2 CFR 200.317 through 200.327. 2 CFR 200 Appendix II requires certain provisions be included in contracts if criteria are applicable. Additionally, 2 CFR 200.214 requires recipients to restrict the subawards and contract with certain parties that are debarred, suspended, or excluded from ineligible participation in Federal assistance programs or activities. Condition: Testing of the federal program identified the following: • The Entity’s formally documented procurement policy was missing the required elements detailed under Uniform Guidance • Four instances where the Entity did not follow the procurement process and did not have any formal documentation in place with the vendors. • Four instances where the Entity entered into a contract with a vendor over $25,000 and there was no review performed to ensure the vendor was not suspended or debarred. Cause: The Entity was not aware of the federal procurement requirements. Contract provisions were not evaluated compared to Uniform Guidance contract requirements. Contracts entered were not evaluated in accordance with Uniform Guidance as it relates to suspension and debarment. Effect: Ineffective controls over this area of compliance could result in a reasonable possibility the Entity would be noncompliant with the compliance requirements outlined above. Additionally, the Entity may enter into a covered transaction with a vendor that is suspended or debarred. Questioned Costs: None reported. Context/Sampling: A nonstatistical sample of 4 out of 10 vendors were selected for testing. Repeat Finding form Prior Year: No Recommendation: We recommend the Entity update their procurement policy to ensure it includes all the required elements in accordance with Uniform Guidance. In addition, we suggest that management implement procedures and control processes related to the review of procurement to ensure the procurement methods are being followed and documentation is retained to support compliance. Also, management should ensure vendors are not suspended or debarred from doing business with the federal government prior to entering into a procurement transaction. Views of Responsible Officials: Management agrees with the finding.

Finding 2025-001 MATERIAL WEAKNESS IN INTERNAL CONTROLS OVER COMPLIANCE, MATERIAL NONCOMPLIANCE -REPORTING Federal Program: COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Agency: US Department of Treasury Pass- Through Agencies: Various Assistance Listing Number: 21.027 Criteria: Management is required to submit various annual, quarterly, and monthly reports to the grantor in accordance with the grant agreement. Additionally, 2 CFR 200.303 requires management to have appropriate controls such that appropriate preparation, reviews, and evidence of those reviews are in place. Condition/Perspective: Based on the results of the testing we noted the following: • Out of a total of 4 Annual reports sampled, 3 did not have proof of submission or review. • Out of a total of 16 Quarterly reports sampled, 10 did not have proof of submission or review and 5 had proof of submission, but no proof of review. Of the 6 reports with proof of submission, 2 were submitted late. • Out of a total of 13 Monthly reports sampled, 1 did not have proof of submission or review. Of the reports with proof of submission 7 were submitted late. Cause: Management continued to experience high turnover during the fiscal year and the documentation pertaining to the evidence of reviews and the evidence of report submission was not retained. Effect: Without appropriate controls in place there is a risk that the Division could have submitted a report that is incomplete, contained inaccurate information, past the reporting requirement due date, or could have failed to submit the report entirely. Noncompliance with such grant requirements could result in a loss of funding. Questioned Cost: None. Repeat Finding: Yes. See 2024-001 in prior year report. Recommendation: Division management should review all applicable grant compliance requirements and ensure that the requirements are being met, including that reports are submitted on a timely basis. Additionally, the Division should continue to address and enhance their control procedures such that the appropriate individuals review all required reports in a timely manner prior to submission to the granting agency(ies); and, maintain documentation evidencing such reviews and submission dates. View of Responsible Officials: See Corrective Action Plan.

Finding 2025-003 SIGNIFICANT DEFICIENCY IN IN INTERNAL CONTROLS OVER COMPLIANCE – Allowable Costs and Cost Principles and Activities Allowed and Unallowed Federal Program: COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Federal Agency: US Department of Health and Human Services Pass- Through Agencies: City & County of Denver Assistance Listing Number: 93.498 Criteria: In accordance with 2 CFR 200.303 the recipient and subrecipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition/Perspective: On a monthly basis management reviews costs for allowability and submits draw-down requests for reimbursement to the pass-through agency. From 3 selections of reimbursement requests, management could not provide documentation to evidence a review was performed prior to submission for 1 draw-down request. Cause: Documentation pertaining to the evidence of expenditure review was not retained as management was not aware that such documentation should be retained. Effect: Without appropriate review controls in place there is a risk that the Division could submit costs that are not allowed. Noncompliance with allowability criteria could result in the Division having to refund the granting agency or a loss of funding. Questioned Cost: None. Recommendation: The Division should enhance their control procedures such that documentation of review is retained. View of Responsible Officials: See Corrective Action Plan.

Item 2025-003: Material Weakness in Internal Control Over Compliance - Cash Management Federal agency: • U.S. Department of Agriculture • U.S. Department of Commerce Federal program: • Environmental Quality Incentives Program (ALN 10.912) • Habitat Conservation (ALN 11.463) Pass-through Entity: None Federal Award Year: Year ended September 30, 2025 Type of Finding: Material Weakness in Internal Control over Compliance Criteria: The Uniform Guidance (2 CFR 200.303) requires nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to review reimbursement requests. Condition: During our testing of cash management requirements, we noted that a review of the reimbursement requests sampled for testing was not performed prior to submission. Cause: The Band does not have a procedure for a review of the reimbursement requests prior to submission for the identified programs. Currently, the same employee prepares and submits the reimbursement requests. Effect: Likelihood of inaccurate reimbursement requests is increased when they are not thoroughly reviewed. Questioned costs: None Context: • ALN 10.912 – The population of reimbursement requests subject to cash management requirements included one request. Our sample included one reimbursement request which did not have documentation showing it was reviewed. • ALN 11.463 – The population of reimbursement requests subject to cash management requirements included eight requests. Our sample included two reimbursement requests which did not have documentation showing they were reviewed. Repeat finding: No Recommendation: We recommend that the Band review their processes to ensure all reimbursement requests have review a process documented indicating that a secondary review was performed prior to submission. Views of responsible officials: The Band agrees with the above finding and its response is included in the corrective action plan.

Finding 2025-002: U.S. Department of the Treasury Federal Financial Assistance Listing 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Compliance Requirement: Procurement, Suspension, and Debarment Type of Finding: Significant Deficiency in Internal Controls over Compliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Per 31 CFR 19.300, prior to enter in subawards and contracts with award funds, recipients must verify that such contractors and subrecipients are not suspended, debarred, or otherwise excluded pursuant to 31 CFR § 19.300. Condition: The County did not retain documentation of verifying that vendors were not suspended, debarred, or otherwise excluded prior to entering into a transaction with them. Cause: The County performed the verification but did not retain documentation, and we were unable to verify that it was performed prior to the transaction. Effect: Vendors could be suspended, debarred, or otherwise excluded, and the County would not be aware. Questioned Costs: None Context / Sampling: We tested four of 14 contracts subject to suspension and debarment in the SLFRF program. Repeat Finding from Prior Year: Yes, prior year finding 2024-003 Recommendation: The County should retain documentation of the review of all vendors. Views of Responsible Officials: Management agrees with the noted finding. Refer to Corrective Action Plan.

Finding No.: 2025-001 Federal Agency: U.S. Department of Education AL Program: 84.063/84.033/84.007 Student Financial Assistance Cluster Federal Award No.: Title IV HEA Program OPE ID 01034300 Area: Eligibility Questioned Costs: None Criteria: 2 CFR 200.303 (a) states the recipient and subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The College is required to establish internal control to ensure compliance with the following requirements: 34 CFR 676.20 (s) states that: Minimum and maximum Federal Supplemental Educational Opportunity Grants (FSEOG) awards requires: (a) An institution may award an FSEOG for an academic year in an amount it determines a student needs to continue his or her studies. However, except as provided in paragraph (c) of this section, an FSEOG may not be awarded for a full academic year that is— (1) Less than $100; or (2) More than $4,000. Condition: We noted that seven students were awarded amounts exceeding the maximum allowable limit of $4,000, while one student received an award below the minimum allowable amount of $100. Cause: The condition was primarily due to the College’s limited familiarity with FSEOG requirements, as this represents its first year administering the program. As a result, management did not have adequate procedures or guidance in place to ensure compliance with the minimum and maximum award limits prescribed under federal regulations. Effect or potential effect: The College is in noncompliance with applicable requirements. Identification as a Repeat Finding: Not applicable. Recommendation: We recommend that management establish and implement formal policies and procedures for the administration of the FSEOG program, including clear guidance on the minimum and maximum award limits in accordance with federal regulations. Management should also provide adequate training to Financial Aid Office personnel on applicable federal requirements, perform supervisory reviews of award calculations prior to disbursement, and conduct periodic monitoring to ensure ongoing compliance with established limits. Views of responsible officials The College acknowledges the finding. Refer to corrective action plan.

2025-003 (Repeat Finding) Retaining Sliding Scale Determination Documentation Special Tests and Provisions ALN 93.224 Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care) US Department of Health and Human Services Contract Numbers H80CS30749-06 and H80CS30749-07 Contract Periods April 1, 2022 – March 31, 2023 and April 1, 2023 – March 31, 2024 Conditions and Criteria: The requirement under 45 CFR 75.361 provides requirements for the retention of records for grantees. In addition, 2 CFR 200.303 provides requirements to establish and maintain effective internal controls over Federal awards. Specifically, it states that financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Health and Human Services awarding agency of pass-through entity in the case of a subrecipient. In the 2023 audit, for 5 out of 40 samples selected for testing, it was noted that OCHS did not retain the proper documents that the patients had submitted that included their income and family size or the documents completed by OCHS showing the sliding fee discount determination for these patients. Effect: The effect is that records that are required to be retained were not retained and evidence of how the sliding fee discount was determined could not be examined. Questioned Costs: Any likely questioned costs could not be determined since compliance testing was unable to be performed due to the lack of documentation. It should be noted that there were no exceptions for 35 samples that were able to be tested, and for 5 samples with insufficient documentation, 3 had partial documentation of income (i.e., pay stubs) and 2 had no documentation of income as it was not maintained. However, the sliding scale calculation was completed for all 40 samples. Cause: Determining the sliding fee discount level for each patient is reassessed on an annual basis. During the year, there was employee turnover in the compliance department. Although OCHS has a records retention policy, there was a lack of monitoring in place to ensure that the requirement under 45 CFR 75.361 was adhered to. Auditor Recommendation: A procedure should be put in place to monitor whether the record retention policy is followed. Current Status: During the current year, fiscal 2025 audit testing, no samples lacked support for the sliding fee scale determination. However, there is a three-year documentation retention requirement per 45 CFR 200.303. If asked to produce documentation for fiscal year 2023, OCHS would not be able to do so, therefore, the 2023 fiscal year finding was repeated. Planned Corrective Action: See the following Corrective Action Plan section for management’s planned corrective action.

Finding 2025-001 Fixed Asset Reconciliations and Management of Federally Funded Equipment - Significant Deficiency in Financial Reporting and Internal Control over Equipment and Compliance Finding Federal Agency(ies): United States Agency for Global Media Federal Program(s): International Broadcasting Independent Grantee Organizations Assistance Listing Number(s): 90.500 Pass-through Entity (if applicable): N/A Award Identification Number and Year: MN01-25-GO-00001 (2025) Criteria or Specific Requirement: 2 CFR 200.313(d) requires recipients to maintain property records for equipment acquired with Federal funds. Such records should include, among other items, a description of the property, serial number or other identification number, source of funding, acquisition date, cost, location, use and condition, and ultimate disposition data. Additionally, recipients are required to conduct physical inventories of equipment and reconcile the results of those inventories to the property records. Further, 2 CFR 200.303 requires recipients to establish and maintain effective internal controls over Federal awards that provide reasonable assurance of compliance with applicable Federal requirements. Condition: MBN maintains equipment records in its accounting records and in its inventory management system (BarCloud). At the time of testing, MBN was completing a planned transition of those records from physical binder-based files to a centralized BarCloud system; a related inventory review and reconciliation was still in progress. Because the accounting fixed asset schedule consists of a combination of grouped asset additions and individual assets, while the inventory management system maintains records at the individual asset level, and because the inventory management system did not yet contain information necessary to reconcile inventory records to the accounting record (including asset classifications and in-service dates), the records maintained within the two systems are not yet fully reconciled. During audit testing performed while this reconciliation was ongoing, discrepancies were identified between the systems, including assets recorded in one system but not the other. Cause: The discrepancies noted relate primarily to the timing of audit testing in relation to the organization-wide reconciliation effort then already underway. During fiscal year 2025, MBN began a comprehensive reconciliation of equipment records, transitioning from manual, binder-based files maintained at field locations to a centralized BarCloud inventory management system and the fixed asset schedule. At the same time, the company was engaged in a detailed review and reconciliation of its property and equipment records, and had begun implementing more stringent controls over management of Federally funded equipment. This substantial undertaking was conducted during a period of reduced staffing within the finance and accounting function. Given the volume of records, the level of effort required, and the fact that records originating in prior years (especially those overseas where offices had been closed and access was limited) required significant enhancement before they could be reconciled, the reconciliation effort remained in progress at the time of audit testing, and additional time was needed to complete it.Effect or Potential Effect: Because management’s reconciliation effort was still in progress at the time of testing, there was a temporary, transitional risk that Federally funded equipment records maintained in the two systems were not yet fully aligned, and that some discrepancies between accounting and inventory records had not yet been identified and resolved. This risk is inherent to the period during which legacy binder-based records are consolidated into a centralized system and reconciled, and is expected to diminish as management completes its remediation efforts. Questioned Costs: None Context: As part of our testing of equipment management requirements, the Organization reviewed its equipment tracking processes and the records maintained within both the accounting system and the BarCloud inventory management system. Testing was performed during a period in which management was actively reconciling records - including records maintained at closed overseas locations - into BarCloud, while also reconciling the two systems. We noted that the systems maintained different levels of detail which, at the time of testing, had not yet been fully reconciled. Limited testing of vehicle records identified assets recorded in one system that were not reflected in the other, which is consistent with the transitional state of the records. Identification as a Repeat Finding, if Applicable: N/A Recommendation: We recommend that management continue establishing and implementing procedures to maintain equipment records in a manner permitting reconciliation between the accounting records and the inventory management system. The procedures should include the establishment of a common asset identification methodology, the reconciliation of equipment records between systems on a periodic basis, the investigation and resolution of any discrepancies, and the maintenance of documentation supporting the reconciliation process. Additionally, management should continue evaluating whether additional information should be maintained within the inventory management system to facilitate reconciliation and support compliance with Federal equipment management requirements.

Segregation of Duties Condition and criteria: During our audit of the Authority’s Financial Statements, we noted that the Authority does not have adequate segregation of duties in place. Specifically, the same individual is responsible for initiating and recording journal entries and disbursements and reconciling the bank accounts. In addition, in accordance with 2 CFR § 200.303(a), the non Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Cause and Effect: The Authority is a small entity with limited administrative and accounting staff, which makes it difficult to achieve a complete segregation of duties. Due to resource constraints, individual staff members are assigned multiple roles that overlap key financial processes. Without proper segregation of duties, there is an increased risk that errors or irregularities, including potential misappropriation of assets or fraud, could occur and remain undetected. This condition could lead to noncompliance with applicable grant requirements and inaccuracies in financial reporting. Auditor’s Recommendations: We recommend that the Authority assess the current structure and implement compensating controls where full segregation of duties is not feasible due to staffing limitations. These may include enhanced supervisory review, periodic oversight by the board or executive leadership, documentation of independent reviews, and rotation of duties when possible. Authority’s Response: The board reviews the reports monthly. A printed payroll report and checks written from meeting to meeting are provided and are approved and initialed. Also provided is a report of the bank statements for the board to review what has been received and what has been paid. Before any bills are paid they are approved at the meeting. If an error is made when inputting a deposit received into the software, the correction is printed and initialed approving the correction.

Federal Agency: Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Identification Number and Year: SLFRP02236 - 2025 Pass-Through Agency: Ramsey County Pass-Through Number: SLFRP0236 Award Period: March 3, 2021 – December 31, 2026 Type of Finding: Material Weakness over Internal Controls Criteria or specific requirement: 2 CFR 200.303 requires that recipients and subrecipients receiving federal awards establish, document and maintain effective internal control over the federal awards that provides reasonable assurance that the recipient or subrecipient is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition: The rental units supported by the grant can only be occupied by households whose annual income does not exceed certain thresholds. Annual income is documented for purposes of eligibility and applications are maintained supporting that tenants are eligible. From our discussions with management there are no documented internal controls surrounding the eligibility process. Context: No instances of non-eligible tenants were noted in our testing, and this finding relates only to implementation of a documented internal control process. Cause: The program was new during the fiscal year, and management was not aware of the requirement for a documented internal control process. Effect: Errors in the eligibility process could occur without a documented internal control process. No errors were noted in our testing. Repeat Finding: No Recommendation: We recommend the Organization implement a review process for eligibility determination for the program. Views of responsible officials: There is no disagreement with the audit finding.

Program Information: U.S. Department of the Interior Single Agreement – Assistance Listing #15.036 Award Number: A18AV00341 Award Period: 10/01/2024 – 9/30/2025 Criteria: Reporting requirements are contained in the following: Monitoring and reporting program performance, 2 CFR Section 200.329. • Per the award documents, the grantee shall prepare and provide an Annual Narrative Report. Per 2 CFR § 200.303, recipients must establish and maintain effective internal controls over federal awards to ensure compliance with applicable regulations. Condition/Context: NWIFC did not complete and obtain management approval of the FY25 Annual Narrative Report prior to the required submission date. As a result, the FY24 Annual Narrative Report was submitted to the funding agency in its place. [ X ] Compliance Finding [ X ] Significant Deficiency [ ] Material Weakness Cause: Internal controls were not sufficient to ensure the FY25 Annual Narrative Report was completed, reviewed, approved, and submitted in accordance with award requirements. Effect: Failure to comply with required reporting requirements may result in increased scrutiny by the funding agency and could adversely affect future funding decisions. Questioned Costs: N/A. This finding relates to reporting requirements and does not affect the allowability, support, or eligibility of program expenditures. Therefore, no questioned costs were identified. Repeat Finding: No. Recommendation: We recommend that NWIFC ensure required annual narrative reports are completed, reviewed, approved, and submitted timely, and that evidence of review and approval is maintained. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding and has prepared corrective action as detailed in its Corrective Action Plan.

Type: Significant deficiency in internal control over compliance and noncompliance. Criteria: The Uniform Guidance as described in 2 CFR, Part 200.303, non-federal entities receiving federal awards to establish and maintain effective internal control over federal awards that provides reasonable assurance that the entity is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Road Commission did not have formal written federal policies and procedures that document the processes and controls used to administer federal awards, including procedures for compliance with applicable federal program requirements under Uniform Guidance (2 CFR, Part 200.303). Cause: The Road Commission has historically relied on state compliance requirements and MDOT oversight, and has not formalized Federal Uniform Guidance requirements into its written policies and procedures. Management was not fully aware that Uniform Guidance requires entity-specific documented procedures in addition to compliance with state procurement laws. Effect: Without written federal policies and procedures, there is an increased risk that federal award requirements may not be consistently applied, monitored, or retained as institutional knowledge, particularly during changes in personnel or program responsibilities. Perspective: As a condition of accepting a federal award, the Road Commission should have required policies and procedures in place. Questioned Costs: None noted. Initial Year of Finding: 2025 Recommendation: We recommend the Road Commission develop and implement written federal policies and procedures addressing the administration of federal awards to ensure compliance with Uniform Guidance (2 CFR, Part 200). The policies should address the following key compliance areas; allowable costs, cash management, procurement, and conflicts of interest. In addition, we recommend that management review and modify the procedure policy to include all the necessary items outlined in the Uniform Guidance. View of Responsible Officials and Planned Corrective Plan: See corrective action plan.

Item 2025-001 Reporting (Repeat 2024-002) Head Start and Early Head Start Assistance Listing #93.600 Head Start Grant No. 04CH0127807 U.S. Department of Health and Human Services Federal Award Year - 2025 Condition – Adequate controls were not in place to review and approve grant reports prior to their submission to the grantor. The Federal Financial Reports (SF-425) for the Head Start Cluster grants were not reviewed and approved prior to submission to the Payment Management System. Criteria – Grantees should have controls in place to ensure that grant reports are being reviewed and approved by management prior to being submitted to the grantor. 2 CFR 200.303 requires the non‐Federal entity to “(a) establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non‐Federal entity is managing the Federal statutes, regulations, and the terms and conditions of the Federal award.” Cause – Lack of sufficient controls over the review and approval of grant reports to ensure the accuracy and completeness of the report being submitted to the grantor. Questioned Costs – None noted. This finding is a deficiency in internal control over compliance for reporting that does not affect amounts expended or received from the Federal award. Effect – Lack of proper review and approval could result in improper reporting which could lead to disallowed costs. However, our audit disclosed no instances of unallowable costs. Recommendation – We recommend the implementation of controls to ensure there is evidence of review and approval of the quarterly grant reports prior to submission to the grantor. Management’s Response – The Agency will implement controls to ensure proper review and approval is obtained on required grant reports prior to submission to the grantor.

Finding 2025-003: Reporting Review Process Information on the Federal Programs: Assistance Listing Number 93.550 - Transitional Living Program, U.S. Department of Health and Human Services. Award Number: 90CX7428-03-00 Compliance Requirements: Reporting Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria Uniform Guidance (2 CFR 200.303) requires non-Federal entities to establish and maintain effective internal control over federal awards to provide reasonable assurance of compliance with reporting requirements. This includes controls to ensure required reports are prepared accurately, reviewed, approved by an authorized individual, and submitted timely. Condition The submission process for federal financial reports requires that report data be entered into the applicable federal reporting system and certified by an authorized individual who performs a final review prior to submission. During the audit, we noted that certain required SF-425 Federal Financial Reports had been prepared, but were not certified by an authorized signer and, as a result, were not submitted by the applicable due dates. The reports were subsequently reviewed, certified, and submitted. Cause During the year, the Organization experienced transitions in financial leadership and in personnel responsible for federal reporting. As a result of these transitions, the responsibility for certifying required federal financial reports was not formally reassigned, which contributed to the reports not being timely certified and submitted. Effect Reports were not certified or submitted in accordance with reporting requirements. Although subsequently corrected, this reflects a deficiency in internal control over compliance that increases the risk of noncompliance from delinquent or inaccurate reporting. Questioned Costs None. Recommendation The Organization should implement formal controls over federal reporting, including a documented review by a qualified individual independent of preparation prior to submission, and procedures to track and monitor reporting deadlines.

S3800-010 Finding Reference Number – 2025-004 S3800-011 Title and CFDA Number of Federal Program – Section 202 Supportive Housing for the Elderly, Capital Advance and Project Rental Assistance Contract, ALN 14.157 S3800-015 Type of Finding – Federal Award Finding; Other Matters S3800-016 Finding Resolution Status – Resolved S3800-017 Information on Universe Population Size The total population was all disbursements from the bank accounts, 155 checks or transfers totaling $205,900. S3800-018 Sample Size Information The sample size was 40 disbursements totaling $60,503. Errors were found on 5 out of the 40 disbursements tested totaling $1,425. S3800-019 Identification of Repeat Finding and Finding Reference Number – N/A S3800-020 Criteria – Per 2 CFR sections 200.302 and 200.303 of the Uniform Guidance, an entity must establish and maintain effective internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. Allowable cost controls of Sessions Village 202 require the location and general ledger account coding to be written on each invoice to be reviewed by the Executive Director/ Administrator before the invoice is processed to be paid. In addition, all checks are required to have two signatures. S3800-030 Statement of Condition – During our audit, we noted four invoices whereby the amounts paid for by Sessions Village 202 did not match the split by location on the campus or the invoice was not for the business purpose of Sessions Village 202. This resulted in Sessions Village 202 paying for expenditures that were unrelated to the project. In addition, we noted one instance where the check only contained one signature. S3800-032 Cause – During the year ended September 30, 2025, there was turnover in the accounts payable position. As a result, errors were made during the cash disbursement process that were not caught by management’s review and monitoring procedures. S3800-033 Effect or Potential Effect – Failure to maintain effective internal controls over compliance with federal requirements increases the risk of unauthorized or unallowable transactions occurring. S3800-035 Auditor Non-Compliance Code –S (Internal Controls) S3800-037 FHA/Contract Number – 171-EE015 S3800-038 Questioned Costs – $0 S3800-040 Questioned Costs – $0 S3800-045 Reporting Views of Responsible Officials – Sessions Village 202 is in agreement with the findings, and the recommendations have been implemented. S3800-050 Context A sample of 40 checks totaling $60,503 was selected for audit from a population of 155 checks totaling $205,900. The test found 5 checks that were not in compliance with Sessions Village 202’s allowable cost controls totaling $1,425. Our sample was a statistically valid sample. S3800-080 Recommendation – We recommend the related parties reimburse Sessions Village 202 for the expenditures paid on their behalf. In addition, we recommend management review the disbursements made during the periods of turnover to confirm there were no other unallowable payments made. We also recommend management of Sessions Village 202 review their internal controls over the cash disbursement process with the necessary individuals involved in the process to ensure the controls are consistently performed going forward. S3800-090 Auditor’s Summary of Auditee Comments on the Findings and Recommendations – The related parties reimbursed Sessions Village 202 for the expenditures paid on their behalf. Since the new accounts payable clerk started in the Summer of 2025, they have been reviewing all of the supporting documentation for disbursements made during the period of turnover, and accumulating any additional corrections that need to be made. They will continue this process for all disbursements from the period of turnover. The Executive Director/Administrator and Accountant at the management agent will review the process and procedures in place with the new accounts payable clerk, and implement controls to ensure the appropriate facility and general ledger account coding are made going forward. In addition, they will review the review and monitoring controls in place and revise as needed to ensure the proper checks are in place to catch errors. S3800-130 Response Indicator – Agree S3800-140 Completion Date – June 11, 2026 S3800-150 Response – The related parties reimbursed Sessions Village 202 for the expenditures paid on their behalf. Since the new accounts payable clerk started in the Summer of 2025, they have been reviewing all of the supporting documentation for disbursements made during the period of turnover, and accumulating any additional corrections that need to be made. They will continue this process for all disbursements from the period of turnover. The Executive Director/Administrator and Accountant at the management agent will review the process and procedures in place with the new accounts payable clerk, and implement controls to ensure the appropriate facility and general ledger account coding are made going forward. In addition, they will review the review and monitoring controls in place and revise as needed to ensure the proper checks are in place to catch errors.

S3800-010 Finding Reference Number – 2025-003 S3800-011 Title and CFDA Number of Federal Program – Section 232 Loan – Mortgage Insurance Nursing Homes, Intermediate Care Facilities, Board and Care Homes and Assisted Living Facilities Loan, ALN 14.129 S3800-015 Type of Finding – Federal Award Finding; Other Matters S3800-016 Finding Resolution Status – Resolved S3800-017 Information on Universe Population Size The total population was all disbursements from the bank accounts, 1,166 checks or transfers totaling $9,963,223. S3800-018 Sample Size Information The sample size was 59 disbursements totaling $421,877. Errors were found on 2 out of the 59 disbursements tested totaling $2,071. S3800-019 Identification of Repeat Finding and Finding Reference Number – N/A S3800-020 Criteria – Per 2 CFR sections 200.302 and 200.303 of the Uniform Guidance, an entity must establish and maintain effective internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. Allowable cost controls of Cheney Care Community require general ledger account coding to be written on each invoice to be reviewed by the Executive Director before the invoice is processed to be paid. S3800-030 Statement of Condition – During our audit, we noted two invoices whereby the amounts paid for by Cheney Care Community did not match the split by location on the campus or the invoice was not for the business purpose of Cheney Care Community. This resulted in Cheney Care Community paying for expenditures that were unrelated to the project. In addition, we noted one invoice where the invoice did not include the general ledger account coding. S3800-032 Cause – During the year ended September 30, 2025, there was turnover in the accounts payable position. As a result, errors were made during the cash disbursement process that were not caught by management’s review and monitoring procedures. S3800-033 Effect or Potential Effect – Failure to maintain effective internal controls over compliance with federal requirements increases the risk of unauthorized or unallowable transactions occurring. S3800-035 Auditor Non-Compliance Code – S (Internal Controls) S3800-037 FHA/Contract Number – 171-22029 S3800-038 Questioned Costs – $0 S3800-040 Questioned Costs – $0 S3800-045 Reporting Views of Responsible Officials – Cheney Care Community is in agreement with the findings, and the recommendations will be implemented. S3800-050 Context – A sample of 59 checks totaling $421,877 was selected for audit from a population of 1,166 checks totaling $9,963,223. The test found 2 checks that were not in compliance with Cheney Care Community’s allowable cost controls totaling $2,071. Our sample was a statistically valid sample. S3800-080 Recommendation – We recommend the related parties reimburse Cheney Care Community for the expenditures paid on their behalf. In addition, we recommend management review the disbursements made during the periods of turnover to confirm there were no other unallowable payments made. We also recommend management of Cheney Care Community review their internal controls over the cash disbursement process with the necessary individuals involved in the process to ensure the controls are consistently performed going forward. S3800-090 Auditor’s Summary of Auditee Comments on the Findings and Recommendations - The related parties reimbursed Cheney Care Community for the expenditures paid on their behalf. Since the new accounts payable clerk started in the Summer of 2025, they have been reviewing all of the supporting documentation for disbursements made during the period of turnover, and accumulating any additional corrections that need to be made. They will continue this process for all disbursements from the period of turnover. The Executive Director/Administrator and Accountant will review the process and procedures in place with the new accounts payable clerk, and implement controls to ensure the appropriate facility and general ledger account coding are made going forward. In addition, they will review the review and monitoring controls in place and revise as needed to ensure the proper checks are in place to catch errors. S3800-130 Response Indicator – Agree S3800-140 Completion Date – November 20, 2025 S3800-150 Response – The related parties reimbursed Cheney Care Community for the expenditures paid on their behalf. Since the new accounts payable clerk started in the Summer of 2025, they have been reviewing all of the supporting documentation for disbursements made during the period of turnover, and accumulating any additional corrections that need to be made. They will continue this process for all disbursements from the period of turnover. The Executive Director/Administrator and Accountant will review the process and procedures in place with the new accounts payable clerk, and implement controls to ensure the appropriate facility and general ledger account coding are made going forward. In addition, they will review the review and monitoring controls in place and revise as needed to ensure the proper checks are in place to catch errors.

REPORTING – COMPLIANCE AND CONTROLS REPEAT FINDING: NO FEDERAL AGENCY: U.S. DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT; PASSED THROUGH FLORIDA DEPARTMENT OF COMMERCE PROGRAM: COMMUNITY DEVELOPMENT BLOCK GRANTS, ALN 14.228 GRANT NUMBERS: H2494, H2384, M0043, M0024, M0150, M0154, MT151 FINDING TYPE: SIGNIFICANT DEFICIENCY CRITERIA: Under 29 CFR sections 5.5 and 5.6; the A-102 Common Rule (section 36(i)(5)), OMB Circular A-110 (2 CFR Part 215, Appendix A, Contract Provisions); 2 CFR Part 176, Subpart C; and 2 CFR section 200.326; the County’s contractor is required to submit a copy of the payroll and a statement of compliance (certified payrolls) weekly for each week in which any contract work is performed. The grant agreements outline the reports required to be submitted and their due dates. Additionally, 2 CFR 200.303(a) of the Uniform Guidance requires non-federal entities to establish and maintain effective internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. CONDITION: 18 of 135 total reports required under the grants were tested for compliance with this requirement. This was not a statistically valid sample. The auditor noted the following which affected 7 of the reports tested: - For 5 reports, there was no evidence of a second review - For 1 monthly progress report, the report was submitted later than the due date - For 1 quarterly progress report, the funds used through the report date were not included at the correct amount and there were other mathematical errors - For 2 reports, the client could not show when the reports were submitted to the grantor CAUSE: Management has not established procedures for reviewing all program reports and/or the reviews failed to identify reporting errors and ensure reports were submitted timely. EFFECT: Certain reports were not submitted timely or may not have been submitted to the grantor, and certain reports were inaccurate. QUESTIONED COSTS: None. The finding is over the reporting compliance requirement. Amounts expended and received from federal awards were not affected. RECOMMENDATION: We recommend procedures be established for review of all program reports prior to submission to the grantors and that the review be documented; procedures be established to ensure reports are submitted timely; and a reconciliations of reported amounts to the accounting records be performed. VIEW OF RESPONSIBLE OFFICIALS: See Management’s Response and Corrective Action Plan beginning on page 122.

SPECIAL TESTS AND PROVISIONS, WAGE RATE REQUIREMENTS – COMPLIANCE AND CONTROLS REPEAT FINDING: NO FEDERAL AGENCY: U.S. DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT; PASSED THROUGH FLORIDA DEPARTMENT OF COMMERCE PROGRAM: COMMUNITY DEVELOPMENT BLOCK GRANTS, ALN 14.228 GRANT NUMBERS: H2494, H2384, M0043, M0024, M0150, M0154, MT151 FINDING TYPE: SIGNIFICANT DEFICIENCY CRITERIA: 2 CFR 200.303(a) of the Uniform Guidance requires non-federal entities to establish and maintain effective internal control over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. CONDITION: The County relies on third-party consultants to obtain and review construction contractors’ weekly certified payrolls, and the consultants report the information to the County. In some cases, the County does not review the certified payrolls until the end of the construction contract. Additionally, the auditor tested 2 of 3 grants that had construction performed during the fiscal year for compliance with this requirement and for 1 grant tested, the County could not provide evidence that the consultant verified that the certified payrolls were submitted. The sample was not statistically valid. CAUSE: Management has not established procedures for regular monitoring of consultants’ performance related to obtaining and reviewing evidence of certified payrolls. EFFECT: Certified payrolls for a construction contract subject to wage rate requirements under the Davis-Bacon Act were not reviewed by the County during the fiscal year. QUESTIONED COSTS: None. The auditor is not aware of any amounts paid in violation of Federal statutes as a result of this finding. RECOMMENDATION: We recommend procedures be established for the County to obtain and review of certified payrolls for the construction projects on a more frequent basis to ensure compliance with the wage rate requirements. VIEW OF RESPONSIBLE OFFICIALS: See Management’s Response and Corrective Action Plan beginning on page 122.

Material Weakness in Internal Control over Compliance and Material Instance of Noncompliance (Scope Limitation) Federal Agency: U.S. Department of Health and Human Services Federal Program: Centers for Independent Living Assistance Listing Number: 93.432 Direct Award Numbers: 2322CAILCL-00 and 2338CAILCL-00 Pass-Through Entity: California Department of Rehabilitation Grant Identifying Number: 32594 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles and Period of Performance – Payroll Expenditures, Cash Management and Reporting Criteria: Pursuant to 2 CFR §200.303, the Organization is required to establish and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Under 2 CFR §200.403 and 2 CFR §200.405, costs charged to the Federal award must be allowable, allocable, reasonable, and adequately documented. Under 2 CFR §200.403(h) and 2 CFR §200.309, costs must be incurred within the approved period of performance. Under 2 CFR §200.305, for cash management using the reimbursement method, the Organization must maintain records sufficient to support amounts requested for reimbursement and demonstrate that reimbursement requests are based on allowable program expenditures. Under 2 CFR §200.328 (financial reporting) and §200.329 (performance reporting) recipients are responsible for monitoring activities under federal awards and must submit required performance and financial reports at the intervals required by the federal award, which may be no more frequent than quarterly and no less frequent than annually. Condition and Context: The Organization did not have adequately designed internal controls over the review and approval of allowable payroll activities and payroll expenditures, cash management activities and federal reporting requirements. Specifically, there were no documented review and approval procedures or supervisory controls in place to ensure the accuracy and completeness of time and effort tracking of payroll expenditures, reimbursement requests or financial reports under the federal program. Additionally, sufficient appropriate audit evidence was not available to support compliance with the Activities Allowed or Unallowed and Allowable Costs/Cost Principles-Payroll Expenditures, Cash Management and Reporting compliance requirements. The lack of documentation and supporting records resulted in a scope limitation that prevented the auditors from performing necessary procedures to determine whether the Organization complied with applicable federal requirements related to allowed or unallowed payroll activities and allowable costs/cost principles for payroll expenditures, cash management transactions and financial reporting submissions for the population selected for testing. The condition affected the administration of the Centers for Independent Living federal program for the fiscal year ended September 30, 2025.Cause: Management did not design and implement documented internal controls requiring supervisory review and approval of allowable payroll activities and payroll expenditures, cash management activities and federal financial reporting. In addition, management did not maintain adequate supporting documentation to demonstrate compliance with federal requirements. Effect: The lack of effective internal controls increased the risk that errors, omissions, or noncompliance related to allowed or unallowed payroll activities and allowable costs/cost principles for payroll expenditures, cash management and reporting could occur and not be detected in a timely manner. Furthermore, because sufficient appropriate audit evidence was unavailable, the auditors were unable to determine whether the auditee complied with applicable federal compliance requirements related to - allowable payroll activities and payroll expenditures, cash management and reporting. Questioned Costs: Questioned costs could not be determined due to the scope limitation. Repeat Finding: No Recommendation: We recommend that management design and implement formal internal controls over - allowable payroll activities and payroll expenditures, cash management and reporting activities, including documented supervisory review and approval procedures for all time and effort tracking of payroll expenditures, federal reimbursement requests and financial reports. Management should also establish policies and procedures to ensure adequate supporting documentation is retained and readily available to support compliance with federal program requirements and facilitate audit testing. This should include comprehensive training for staff involved in federal program administration, regular monitoring to ensure controls are consistently applied, and periodic internal audits to assess the effectiveness of compliance systems. Views of Responsible Officials: Management Position: Management agrees with this finding. Adequate internal controls over payroll, cash management, and federal reporting were not in place during FY2025 as a direct result of inconsistencies in procedures and internal controls.Corrective Actions:  Accountability & Role Clarity: The Executive Director and Program Manager have mapped compliance requirements for each federal award—including expenditure review, reporting, receivables, and deliverables—and assigned clear ownership across management positions to eliminate single points of failure and reinforce segregation of duties.  Training & Ongoing Monitoring: All management staff will receive annual training on federal grant requirements (allowable/unallowable costs, period of performance, cash management, and reporting) at the start of each fiscal year. Monthly monitoring meetings among the Executive Director, Program Manager, and Accountant will precede Finance Committee meetings to review grant spending. Periodic internal reviews and a final year-end reconciliation will be conducted. Documentation & Continuity: All grant-related records will be maintained on a shared organizational drive accessible to all responsible staff. Formal onboarding and off boarding procedures for federal grant management will be developed to ensure continuity regardless of personnel changes. The Finance Manual will be updated to reflect all procedures.  Hood & Strong has been retained suggests proper internal controls necessary to achieve full federal compliance. All federal award information will be regularly reported to the Board of Directors.

Material Weakness in Internal Control Over Compliance and Instance of Noncompliance - Missing Supporting Documentation for Tested Expenditures Federal Agency: U.S. Department of Health and Human Services Federal Program: Centers for Independent Living Assistance Listing Number: 93.432 Direct Award Numbers: 2322CAILCL-00 and 2338CAILCL-00 Pass-Through Entity: California Department of Rehabilitation Grant Identifying Number: 32594 Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance – Nonpayroll Expenditures Criteria: Pursuant to 2 CFR §200.303, the Organization is required to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Organization is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Under 2 CFR §200.403 and 2 CFR §200.405, costs charged to the Federal award must be allowable, allocable, reasonable, and adequately documented. Under 2 CFR §200.403(h) and 2 CFR §200.309, costs must be incurred within the approved period of performance. Condition and Context: The Organization lacked documented review and approval controls over activities allowed or unallowed, allowable costs/cost principles, and period of performance for nonpayroll expenditures. In addition, 3 of 40 nonpayroll expenditure transactions tested were not supported by adequate documentation to demonstrate the costs were allowable and incurred within the approved period of performance. Cause: Management did not design and implement documented review and approval controls over the applicable compliance requirements or procedures to ensure supporting documentation was obtained and retained for Federal expenditures. Effect: The lack of effective internal controls increased the risk that errors, omissions, or noncompliance related to activities allowed or unallowed, allowable costs/cost principles, and period of performance for nonpayroll expenditures could occur and not be detected in a timely manner, resulting in questioned costs and potential repayment of Federal funds. Questioned Costs: Undetermined. Repeat Finding: Yes. Reference number 2024-002. Recommendation: We recommend management design and implement documented review and approval controls over the applicable compliance requirements and require supporting documentation for Federal expenditures before costs are charged to the Federal award. This should include comprehensive training for staff involved in federal program administration, regular monitoring to ensure controls are consistently applied, and periodic internal audits to assess the effectiveness of compliance systems. Views of Responsible Officials: Management Position: Management agrees with this finding and acknowledges it as a repeat of Finding 2024-002. Systemic gaps in documentation practices under prior financial management resulted in insufficient supporting documentation for three of forty transactions tested. Corrective Actions:  Immediate Control Reinforcement & Training: The Executive Director and Program Manager reviewed each federal award to identify allowable cost categories, applicable periods of performance, and required documentation standards. Funders were engaged directly to clarify documentation requirements; at the April 14 all-staff meeting, a funder provided comprehensive training on reporting and compliance. Additional funder-led training sessions for management and all staff are underway.  Monitoring & Internal Audit: Monthly meetings among the Executive Director, Program Manager, and Accountant review grant spending and federal compliance. Written corrective action plans are developed for each identified noncompliance area. The Accountant will maintain current budget tracking with immediate notification to the Executive Director of discrepancies. All findings are reported to the Board monthly or by special session. Federal grant compliance is incorporated into relevant staff performance evaluations.  Documentation & Formalization: CID will implement a dual-storage documentation methodology combining a shared drive and a document management system (DMS) to ensure that all grantrelated expenditures are fully supported and readily retrievable. All financial files will be organized within a confidential folder structure using a standardized naming convention that includes vendor name, date, and grant code, with subfolders categorized by expense type. Copies of all supporting documentation including invoices, receipts, timesheets, and allocation records will be maintained in both the shared drive and the DMS to ensure redundancy and accessibility. The Executive Director, Accountant, and Program Manager will share responsibility for filing grant documentation in accordance with each grant's reporting deadline, with no costs posted to a grant prior to confirmation that adequate support has been filed and is retrievable. This structured methodology will ensure that CID can readily produce complete documentation for any audited expenditure and that unsupported costs are not charged against any grant funding source.  Finance documentation processes have been reviewed with the Accountant; Hood & Strong is providing Executive Director training on the FundEZ cloud platform. All updated procedures will be reflected in the Finance Manual.

Reporting – HUD 50058 Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Housing Voucher Cluster ALN: 14.871 14.879 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: October 1, 2024 – September 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per HUD PIH guidance (e.g., Notice PIH 2011 65), Public Housing Agencies are required to submit Form HUD 50058 data to HUD’s PIC system in a timely manner, within 60 days of the effective date of the transaction, to ensure accurate and current program reporting. Condition: Of the 40 HUD 50058 transactions tested, three were not submitted to the HUD Public and Indian Housing Information Center (PIC) system within 60 days of the effective date, as required by HUD PIH guidance (e.g., Notice PIH 2011 65), resulting in untimely reporting of program data. Questioned costs: None. Context: See “Condition.” Cause: Lack of automated controls and monitoring over submission deadlines, combined with insufficient staff awareness and resource constraints, resulted in untimely HUD 50058 submissions. Effect: Untimely submission of HUD 50058 reports results in outdated or inaccurate data in HUD’s PIC system, which may impair HUD’s ability to effectively monitor program performance and compliance, and increases the risk of noncompliance with HUD PIH reporting requirements. Repeat Finding: No Recommendation: The City should implement procedures and controls to ensure timely submission of HUD 50058 transactions, including establishing a tracking mechanism for due dates, enhancing supervisory review of submission timeliness, and providing training to staff on HUD PIH reporting requirements to ensure compliance with the 60 day standard. Views of responsible officials: See management response on corrective action plan.

Reporting - SEMAP Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Housing Voucher Cluster ALN: 14.871 14.879 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: October 1, 2024 – September 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 24 CFR 985.101(a), SEMAP certifications must be formally approved by the City’s governing board (or authorized official) and signed by appropriate management prior to submission. Additionally, in accordance with 2 CFR 200.303(a), the City must maintain effective internal controls, including documented review and approval, to ensure the accuracy and completeness of reports submitted to HUD. Condition: The City did not maintain documentation evidencing that the SEMAP certification report was reviewed and approved prior to submission to HUD; therefore, we were unable to determine whether the review and approval controls were performed before submission. Questioned costs: None. Context: See “Condition.” Cause: The condition occurred because the City had not formalized procedures requiring documentation and retention of SEMAP review and approval prior to submission. Effect: Without documented review and approval, there is an increased risk that inaccurate, incomplete, or unsupported SEMAP certifications could be submitted to HUD, which could affect HUD’s assessment of the City’s Housing Choice Voucher program performance and result in noncompliance with SEMAP certification requirements. Repeat Finding: No. Recommendation: The City should formalize SEMAP review and approval procedures, require documented evidence of supervisory or authorized official approval prior to submission, and retain such documentation to support compliance with SEMAP certification and internal control requirements. Views of responsible officials: See management response on corrective action plan.

Special Test – Reasonable Rent Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Housing Voucher Cluster ALN: 14.871 14.879 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: October 1, 2024 – September 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 24 CFR 982.507(a)(1), the City must determine that the rent to owner is reasonable prior to approving the lease and executing the HAP contract; therefore, housing assistance payments should not be made before a rent reasonableness determination is completed. Condition: For one of 40 samples tested, the City issued a housing assistance payment before completing and documenting the required rent reasonableness determination. As a result, the City did not demonstrate compliance with Housing Choice Voucher program requirements requiring rent reasonableness to be determined prior to approval of the lease and execution of the HAP contract. Questioned costs: None. Context: See “Condition.” Cause: The City did not have sufficient control procedures in place to ensure rent reasonableness determinations were completed, documented, and reviewed before housing assistance payments were issued. Effect: Failure to complete rent reasonableness determinations prior to payment increases the risk that housing assistance payments may be made for units with rents that are not properly supported as reasonable, which could result in improper payments and noncompliance with Housing Choice Voucher program requirements. Repeat Finding: No. Recommendation: The City should strengthen controls over the lease-up and payment process to ensure rent reasonableness determinations are completed, documented, and reviewed before lease approval, HAP contract execution, and issuance of housing assistance payments. This may include using a formal checklist or workflow control, requiring supervisory review, and providing staff training on program requirements. Views of responsible officials: See management response on corrective action plan.

Special Test – Utility Allowance Schedule Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Housing Voucher Cluster ALN: 14.871 14.879 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: October 1, 2024 – September 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 24 CFR 982.517 requires the City to maintain and update utility allowance schedules based on current data, further implying the need for accurate and reliable calculations supported by effective internal controls. Condition: The City updated and finalized the utility allowance schedule without documented independent review of the underlying utility rate data, assumptions, and calculations. As a result, duties over preparation and approval of the schedule were not adequately segregated. Questioned costs: None. Context: See “Condition.” Cause: The City had not established a formal control requiring documented independent review and approval of the utility allowance schedule prior to finalization. Effect: Without documented independent review, errors in utility rate data, assumptions, or calculations may not be prevented or detected timely, increasing the risk of inaccurate utility allowances, improper housing assistance payments, and noncompliance with Housing Choice Voucher program requirements. Repeat Finding: No. Recommendation: The City should establish and implement a formal review and approval control over the utility allowance schedule. The review should be performed by an individual independent of preparation, documented prior to finalization, and include verification of utility rate data, assumptions, calculations, and compliance with applicable Housing Choice Voucher program requirements. Views of responsible officials: See management response on corrective action plan.

Equipment and Real Property Management Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-0007-056-2024, 3-48-0007-057-2024, 3-48-0007-058-2024, 3-48-0007-059-2024, 3-48-0007-060-2025, 3-48-0007-061-2025 December 29, 2023 – December 29, 2027, December 27, 2023 – December 27, 2027, August 16, 2024 – August 16, 2028, August 16, 2024 – August 16, 2028, September 18, 2025 – September 18, 2029, September 10, 2025 – September 10, 2029 Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 2 CFR 200.313(d), the City is required to maintain property records for equipment acquired with federal funds that include, among other elements, the source of funding and the percentage of federal participation. Condition: The City’s fixed asset ledger does not identify or distinguish assets acquired with federal award funds from assets acquired with other funding sources. As a result, the City’s property records do not readily identify the source of funding or percentage of federal participation for individual assets, as required by 2 CFR 200.313(d). Questioned costs: None. Context: See “Condition.” Cause: The City’s fixed asset system was not configured to capture funding source and federal participation information, and related procedures did not require this information to be recorded when assets were added to the ledger. Effect: Without complete property records, the City cannot readily demonstrate compliance with federal property management requirements. This increases the risk that federally funded assets may not be properly identified, safeguarded, reported, or disposed of in accordance with federal requirements. Repeat Finding: No Recommendation: The City should configure its fixed asset system, or implement an equivalent tracking mechanism, to identify assets acquired with federal award funds and document the related funding source and percentage of federal participation. The City should also update written procedures and perform periodic reviews to ensure property records remain complete, accurate, and compliant with federal requirements. Views of responsible officials: See management response on corrective action plan.

Reporting – FAA Form 5100-127 Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-0007-056-2024, 3-48-0007-057-2024, 3-48-0007-058-2024, 3-48-0007-059-2024 December 29, 2023 – December 29, 2027, December 27, 2023 – December 27, 2027, August 16, 2024 – August 16, 2028, August 16, 2024 – August 16, 2028 Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 49 U.S.C. § 47107(a)(15) and Federal Aviation Administration (FAA) guidance, including AC 150/5100-19, requires airport sponsors to prepare FAA Form 5100-127 using financial information that is accurate, complete, and supported by underlying accounting records. Additionally, in accordance with 2 CFR 200.302(b)(3), the City must maintain financial management systems and internal controls that ensure reported data is complete, accurate, and reconcilable to the general ledger. Condition: During testing of FAA Form 5100-127 submitted in March 2025, which reported financial information for the fiscal year ended September 30, 2024, with comparative amounts for the fiscal year ended September 30, 2023, we noted that several line items did not agree to the City’s general ledger or supporting documentation. As a result, certain amounts reported on the form were not fully supported by the underlying accounting records. The specific line items and variances are summarized in the table below. The large variances noted were attributable primarily to reporting input/mapping errors and did not result in questioned costs; however, the errors indicate that the reconciliation and review controls did not operate at a sufficient level of precision. Questioned costs: None. Context: See “Condition.” Cause: The condition occurred because reconciliation procedures were not sufficiently detailed or consistently documented, supporting general ledger documentation was not maintained for all reported amounts, and the review process was not performed at a level of precision sufficient to identify variances prior to submission. Effect: As a result, the FAA may rely on financial information that is inaccurate or not fully supported by the City’s accounting records, which could impair monitoring of airport financial operations and compliance with grant assurances. The condition also increases the risk of future reporting errors and additional FAA oversight. Repeat Finding: No. Recommendation: The City should enhance its existing reconciliation and review procedures by requiring documented tie-outs of FAA Form 5100-127 amounts to the general ledger, retention of supporting documentation for all reported amounts, and evidence of supervisory review prior to submission. Views of responsible officials: See management response on corrective action plan.

Special Tests and Provisions – Revenue Diversion Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-0007-056-2024, 3-48-0007-057-2024, 3-48-0007-058-2024, 3-48-0007-059-2024, 3-48-0007-060-2025, 3-48-0007-061-2025 December 29, 2023 – December 29, 2027, December 27, 2023 – December 27, 2027, August 16, 2024 – August 16, 2028, August 16, 2024 – August 16, 2028, September 18, 2025 – September 18, 2029, September 10, 2025 – September 10, 2029 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 49 U.S.C.47107(b), The Secretary of Transportation may approve a project grant application under this subchapter for an airport development project only if the Secretary receives written assurances, satisfactory to the Secretary, that local taxes on aviation fuel (except taxes in effect on December 30, 1987) and the revenues generated by a public airport will be expended for the capital or operating costs of— • the airport; • the local airport system; or • other local facilities owned or operated by the airport owner or operator and directly and substantially related to the air transportation of passengers or property. Condition: The City did not maintain a formal written policy or documented procedure to ensure airport-generated revenues are used only for allowable airport-related purposes in accordance with federal revenue-use restrictions. Questioned costs: None. Context: See “Condition.” Cause: The City had not formalized its process for translating federal airport revenue-use requirements into written policies and control procedures. Effect: The absence of a written policy increases the risk that airport revenues could be used for unallowable purposes or that federal revenue-use requirements may be applied inconsistently. Although no specific instances of revenue diversion were identified, the lack of formalized guidance and related controls increases the risk of noncompliance with 49 U.S.C. § 47107(b). Repeat Finding: No Recommendation: The City should develop, formally adopt, and implement a written airport revenue policy that defines allowable and unallowable uses of airport-generated revenues, aligns with federal revenue-use requirements and applicable FAA guidance, establishes expenditure review and approval procedures, and requires periodic monitoring for compliance. Relevant personnel should be trained on the policy. Views of responsible officials: See management response on corrective action plan.

Reporting – Semi-Annual Performance Report Federal Agency: U.S. Department of Homeland Security Federal Program Title: Staffing for Adequate Fire and Emergency Response (SAFER) ALN: 97.083 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: EMW-2022-FF-01428 February 26, 2024 – February 25, 2027 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The City should have controls designed to ensure proper financial and performance reporting, including adequate review prior to submission. Condition: The City did not maintain documented evidence of an independent review and approval of the semi-annual SAFER Hiring Performance Progress Report prior to submission. The same individual prepared, reviewed, and submitted the report, which limited segregation of duties and independent oversight over the reporting process. Questioned costs: None. Context: See “Condition.” Cause: The City had not established a formal review and approval procedure requiring independent supervisory review of SAFER performance reports prior to submission. Effect: Without documented independent review, there is an increased risk that errors, omissions, or unsupported information in the SAFER performance report may not be detected and corrected before submission, which could reduce the reliability of information reported to FEMA. Repeat Finding: No. Recommendation: The City should establish and document a formal review and approval process for SAFER performance reports prior to submission. The process should require independent review by an individual other than the preparer, or, if staffing limitations prevent full segregation of duties, a documented compensating supervisory review. Views of responsible officials: See management response on corrective action plan.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/Entitlements Grants ALN: 14.218 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B-18-MC-48-0002, B-19-MC-48-0002, B-20-MC-48-0002, B-21-MC-48-0002, B-22-MC-48-0002, B-23-MC-48-0002, B-24-MC-48-0002 October 1, 2018 – September 1, 2025, October 1, 2019 – September 1, 2026, October 1, 2020 – September 1, 2027, October 1, 2021 – September 1, 2028, October 1, 2022 – September 1, 2029, October 1, 2023 – September 1, 2030, October 1, 2024 – September 1, 2031 Type of Finding: Material Weakness in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), the City of Amarillo (the City) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). As of March 8, 2025, fsrs.gov was retired, and all subaward reporting data and functionality are now on SAM.gov. Condition: During the fiscal year, the City issued multiple first-tier subawards under the Community Development Block Grants/Entitlement Grants program that exceeded the $30,000 reporting threshold. However, the City did not report any of the applicable subawards in the FFATA Subaward Reporting System/SAM.gov as required. Questioned costs: None. Context: See “Condition.” Cause: The City had not established sufficient procedures or oversight controls to identify first-tier subawards subject to FFATA reporting requirements and ensure the required subaward information was submitted timely. Additionally, personnel responsible for grant administration were not sufficiently aware of the applicable FFATA reporting requirements. Effect: Failure to report required subaward information resulted in noncompliance with federal transparency reporting requirements and reduced public visibility into the use of federal funds. The lack of reporting may also subject the City to increased federal monitoring, enforcement actions, or other administrative remedies. Repeat Finding: No. Recommendation: The City should establish and implement formal procedures to identify subawards subject to FFATA reporting, track applicable reporting deadlines, and ensure required submissions are completed timely in SAM.gov. The City should also provide training to grant administration personnel and perform corrective reporting for previously omitted subawards, as applicable. Views of responsible officials: See management response on corrective action plan.

Criteria 2 CFR 200.303 requires that the non-Federal entity must "(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States and the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Uniform Guidance 2 CFR Section 200.320 (a)(2) states regarding the applicability of simplified acquisition procedures: "The aggregate dollar amount of the procurement transaction is higher than the micro_x0002_purchase threshold but does not exceed the simplified acquisition threshold. If simplified acquisition procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources. Unless specified by the Federal agency, the recipient or subrecipient may exercise judgment in determining what number is adequate." AIHEC's procurement policy requires that for procurement by small purchase ($10,000 - $249,000), where the aggregate dollar amount is higher than the micro-purchase threshold, price or rate quotations must be obtained from three qualified sources. If three separate qualified sources cannot be obtained the reason needs to be formally documented. Condition/Context During our testing of procurement transactions, we noted that AIHEC did not provide supporting procurement documentation for certain sampled transactions. In addition, for procurements identified as sole-source, AIHEC did not provide approved sole-source justification documentation. As a result, we were unable to verify compliance with the applicable federal procurement requirements. Cause Management does not have sufficient internal controls in place to ensure that AIHEC's procurement policies are followed for all procurement transactions prior to entering the procurement. Effect AIHEC entered into a procurement that did not go through a competitive solicitation process. Recommendation Management should review its policies and procedures to ensure all procurement transactions are in accordance with AIHEC's procurement policies and have the appropriate supporting documentation.

Finding No.: 2025-014 Identification of Federal Program: Federal Agency: U.S. Department of Housing and Urban Development (HUD) AL Program: 14.850 Public Housing Operating Fund Federal Award No.: GQ00100000125D, GQ00100000225D, GQ00100000325D, GQ00100000425D Area: Eligibility Criteria or specific requirement (including statutory, regulatory or other citation): 24 CFR 5.905(a)(1) states: A PHA that administers a Section 8 or public housing program under an Annual Contributions Contract with HUD must carry out background checks necessary to determine whether a member of a household applying for admission to any federally assisted housing program is subject to a lifetime sex offender registration requirement under a State sex offender registration program. This check must be carried out with respect to the State in which the housing is located and with respect to States where members of the applicant household are known to have resided. Section 9 I.E, Other Considerations – Criminal Background Checks, of GHURA Admissions and Continued Occupancy Policy (ACOP) states: Each household member age 18 and over will be required to execute a consent form for a criminal background check as part of the annual reexamination process. Additionally, HUD recommends that at annual reexaminations PHAs ask whether the tenant, or any member of the tenant’s household, is subject to a lifetime sex offender registration requirement in any state [Notice PIH 2012-28]. At the annual reexamination, the PHA will ask whether the tenant, or any member of the tenant’s household, is subject to a lifetime sex offender registration requirement in any state. The PHA will use the Dru Sjodin National Sex Offender database to verify the information provided by the tenant. Finding No.: 2025-014, continued Criteria or specific requirement (including statutory, regulatory or other citation), continued: Section 3‑II.E, EIV System Searches – EIV Income Report of GHURA Admissions and Continued Occupancy Policy (ACOP) states: For each new admission, the PHA is required to review income information in EIV to confirm and validate family reported income within 120 days after the move-in information is transmitted to HUD. The PHA must print and maintain copies of the reports in the tenant file and resolve any discrepancies with the family EIV Income Report. Section 7-I.E. Level 5 and 6 Verifications: Up-Front Income Verification (UIV) of GHURA Admissions and Continued Occupancy Policy (ACOP) states: PHAs are required to obtain an EIV Income report for each family anytime the PHA conducts an annual reexamination. However, PHAs are not required to use the EIV Income report: • At annual reexamination if the PHA used Safe Harbor verification from another means-test federal assistance program to determine the family’s income; or • During any interim reexaminations. The EIV Income Report is also not available for program applicants at admission. When required to use the EIV Income Report, in order for the report to be considered current, the PHA must pull the report within 120 days of the effective date of the annual reexamination. 24 CFR 5.618(b), Acceptable documentation; confidentiality, states: (i) A PHA or owner may determine the net assets of a family based on a certification by the family that the net family assets (as defined in § 5.603) do not exceed $50,000, which amount will be adjusted annually in accordance with the Consumer Price Index for Urban Wage Earners and Clerical Workers, without taking additional steps to verify the accuracy of the declaration. The declaration must state the amount of income the family expects to receive from such assets; this amount must be included in the family's income. (ii) A PHA or owner may determine compliance with paragraph (a)(1)(ii) of this section based on a certification by a family that certifies that such family does not have any present ownership interest in any real property at the time of the income determination or review. Finding No.: 2025-014, continued Criteria or specific requirement (including statutory, regulatory or other citation), continued: Section 7 I.F. of GHURA’s Admissions and Continued Occupancy Policy (ACOP) states: When HUD requires third-party verification, self-certification, or “tenant declaration,” is used as a last resort when the PHA is unable to obtain third-party verification. Self-certification, however, is an acceptable form of verification when: 1. A source of income is fully excluded 2. Net family assets total $5,000 or less and the PHA has adopted a policy to accept self-certification at annual recertification, when applicable 3. The PHA has adopted a policy to implement streamlined annual recertifications for fixed sources of income 24 CFR 5.508(b)(2-3), Evidence of citizenship or eligible immigration status, states: For noncitizens who are 62 years of age or older or who will be 62 years of age or older and receiving assistance under a Section 214 covered program on September 30, 1996 or applying for assistance on or after that date, the evidence consists of: (i) A signed declaration of eligible immigration status; and (ii) Proof of age document For all other noncitizens, the evidence consists of: (i) A signed declaration of eligible immigration status; (ii) One of the INS documents referred to in § 5.510; and (iii) A signed verification consent form. 24 CFR 960.259(c)(1), PHA responsibility for reexamination and verification, states: Except as provided in paragraph (c)(2) of this section, the PHA must obtain and document in the family file third-party verification of the following factors, or must document in the file why third-party verification was not available: (i) Reported family annual income; (ii) The value of assets; (iii) Expenses related to deductions from annual income; and (iv) Other factors that affect the determination of adjusted income or income-based rent 24 CFR 960.253(b) requires Public Housing Agencies (PHAs) to accurately calculate tenant rent by applying the appropriate rent formula based on verified family income and ensuring the tenant’s rent share is correctly determined in accordance with HUD requirements. Finding No.: 2025-014, continued Criteria or specific requirement (including statutory, regulatory or other citation), continued: 24 CFR 908.101 requires PHAs to maintain complete, accurate, and current records to comply with HUD requirements. Specifically, PHAs must retain complete and accurate data for the most recent three years, including the HUD 50058 (Family Report) and all supporting documentation. 2 CFR 200.303 requires the implementation and monitoring of effective internal controls to provide reasonable assurance that data reported to HUD is accurate, complete, and compliant with Federal requirements. Condition: For thirteen (33%) of forty participants tested, deficiencies were noted, as follows: Item No. Unit Certification Effective Date Criminal History/Sex Offender Registry Search Enterprise Income Verification (EIV) Report Date Other Required PHA Forms Variance (HUD-50058 - Tenant Register) Utility Allowance Variance (HUD-50058 - Register) 1 ALC 05/01/25 Not in file - - - - 2 LTJ 02/01/25 Not in file - - - - 3 EM 09/01/25 10/18/25 - - - - 4 GMM 05/22/25 - 03/19/26 - - - 5 MJA 10/16/24 - 05/30/25 - - - 6 POD 08/27/25 - Not In File - - - 7 SS 08/01/25 - - D-214 Form - - 8 SB 11/01/24 - 09/03/24 D-214 Form - - 9 KL 04/01/25 - 12/10/24 - - - 10 YR 06/01/24 - 05/04/24 - - - 11 SJL 07/01/25 - 04/04/25 - 36 - 12 GJA 07/01/25 - 03/11/25 - (151) 151 13 RJ 04/01/25 Not signed Not signed Self-certification of Assets 49 (210) Finding No.: 2025-014, continued Condition, continued: For item #s 1 and 2, no documentation was on file (e.g. sexual registry clearance form) to support if the PHA verified for lifetime sex offender registration requirements. For item # 3, eligibility determinations were not adequately supported, as the required sex offender checks was not conducted at annual reexamination. For item # 13, the sexual registry clearance form was not certified by the PHA, resulting in insufficient support for eligibility determination. For item #s 4 and 5, the newly admitted participants’ Enterprise Income Verification (EIV) report used to support income eligibility was not processed within 120 days after move in. For item # 6, no documentation was on file to support that the PHA processed the participant’s EIV report. For item # 13, the participant’s EIV report was not certified by the PHA, resulting in insufficient support for income eligibility determination. For item #s 7 and 13, documentation indicating verification of assets (e.g. self-certification forms, tenant declaration, and third-party bank statements) were not on file to support eligibility determination. For item #s 8 and 9, no documentation (e.g. declaration of eligible immigration status form) was on file to support whether non-citizen household members are eligible to receive housing assistance. For item #s 10 through 13, discrepancies which affect eligibility determination and assistance amounts were identified. For item # 10, the tenant rent amount that was agreed to and documented in the lease agreement was lower than the amount calculated by the PHA before annual recertification. For item #s 11 through 13, independently calculated tenant rent and utility allowance amounts differed from the amounts recorded in the PHA’s system and received by participants. Finding No.: 2025-014, continued Condition, continued: For item # 13, the participant’s verified income was understated by the PHA when determining eligibility and calculating housing assistance amounts. Cause: GHURA did not effectively implement monitoring controls to ensure compliance with applicable eligibility requirements. Effect or potential effect: GHURA is in noncompliance with applicable eligibility requirements. Questioned costs: $0 Identification as a repeat finding: Not applicable. Recommendation: Responsible personnel should enforce monitoring controls over compliance with applicable eligibility requirements. Specifically, procedures should be enforced requiring staff to obtain and properly document all required verification documentation prior to the recertification of benefits. In addition, supervisory personnel should perform periodic reviews to verify that these procedures are consistently followed and that all required verification activities have been completed and properly documented. Views of Responsible Officials: Management partially concurs with the finding. Refer to Management’s position as outlined in the Corrective Action Plan. Conclusion: Management submitted additional information on June 28, 2026; however, due to time constraints, we were unable to sufficiently corroborate and evaluate the documentation provided. Accordingly, the finding remains, as there was insufficient evidence to support a determination of compliance as of the audit date.

Finding No.: 2025-016 Identification of Federal Program: Federal Agency: U.S. Department of Housing and Urban Development (HUD) AL Program: 14.850 Public Housing Operating Fund Federal Award No.: GQ00100000125D, GQ00100000225D, GQ00100000325D, GQ00100000425D Area: Special Tests and Provisions – UEL (Utility Expense Level) Formula Criteria or specific requirement (including statutory, regulatory or other citation): GHURA is required to maintain and annually submit the Utility Expense Level (UEL) Formula Report (HUD Form 52722) for each project to HUD. 24 CFR 990.170(f)(1) states: 1. Appropriate utility records, satisfactory to HUD, shall be developed and maintained, so that consumption and rate data can be determined. 2 CFR 200.303 requires the implementation and monitoring of effective internal controls to provide reasonable assurance that data reported to HUD is accurate, complete, and compliant with Federal requirements. Condition: We examined the 4 reports required to be submitted during the fiscal year. For eight (14%) of total 56 key line reporting items required for testing within the Utility Expense Level (UEL) Formula Report (HUD Form 52722), the amounts were inconsistent from prior audited report submissions as follows: Item No. Project Line No. Utility Expense Level Formula Reported Utilities Reported Amount Per Audited Submission Variance Over (Under) Reported Variance Over (Under) Reported (%) 1 GQ001000001 03 Water and Sewer (Gal) 8,874 8,035 839 9% 2 GQ001000001 04 Water and Sewer (Gal) 5,647 6,486 (839) 15% 3 GQ001000002 03 Water and Sewer (Gal) 410,885 374,845 36,040 9% 4 GQ001000002 04 Water and Sewer (Gal) 383,707 419,747 (36,040) 9% 5 GQ001000003 03 Water and Sewer (Gal) 1,824,296 1,671,242 153,054 8% 6 GQ001000003 04 Water and Sewer (Gal) 2,719,307 2,872,361 (153,054) 6% 7 GQ001000003 03 Water and Sewer (Gal) 3,585,789 3,094,259 491,530 14% 8 GQ001000004 04 Water and Sewer (Gal) 2,663,490 3,155,020 (491,530) 18% Finding No.: 2025-016, continued Condition, continued: For items #s 1 and 2, the Asset Management Project (AMP) 1 reported in excess of amounts for key line items in Rolling base year 2 - actual consumption (12- month period 7/1/2021 to 6/30/2022) for water and sewer gallon consumption, and underreported for Rolling base year 3 - actual consumption (12-month period 7/1/2020 to 6/30/2021) for water gallon consumption than prior year amounts as reported on HUD Form 5722, respectively. For items #s 2 through 4, the Asset Management Project (AMP) 2 reported in excess of amounts for key line items in Rolling base year 2 - actual consumption (12- month period 7/1/2021 to 6/30/2022) for water and sewer gallon consumption, and underreported for Rolling base year 3 - actual consumption (12-month period 7/1/2020 to 6/30/2021) for water gallon consumption than prior year amounts as reported on HUD Form 5722, respectively. For items #s 3 through 6, the Asset Management Project (AMP) 3 reported in excess of amounts for key line items in Rolling base year 2 - actual consumption (12- month period 7/1/2021 to 6/30/2022) for water and sewer gallon consumption, and underreported for Rolling base year 3 - actual consumption (12-month period 7/1/2020 to 6/30/2021) for water gallon consumption than prior year amounts as reported on HUD Form 5722, respectively. For items #$ 7 and 8, the Asset Management Project (AMP) 4 reported in excess of amounts for key line items in Rolling base year 2 - actual consumption (12- month period 7/1/2021 to 6/30/2022) for water and sewer gallon consumption, and underreported for Rolling base year 3 - actual consumption (12-month period 7/1/2020 to 6/30/2021) for water gallon consumption than prior year amounts as reported on HUD Form 5722, respectively. Cause: Management did not implement adequate procedures to agree corrections on the Utility Expense Level (UEL) reporting submissions with underlying utility consumption and cost records prior to submission to HUD. In addition, supervisory review procedures were not sufficient to identify discrepancies, omissions, or reporting-period errors in the data accumulated for UEL reporting purposes. Effect or potential effect: GHURA is in noncompliance with applicable special tests and provisions for UEL Formula requirements. Questioned costs: $0 Finding No.: 2025-016, continued Identification as a repeat finding: Not applicable. Recommendation: Management should implement formal procedures to reconcile UEL reporting submissions to underlying utility consumption and cost records prior to submission to HUD. This should include preparing documented roll-forward reconciliations that ensure current-year reported amounts agree with prior submissions and are accurately carried forward. In addition, management should strengthen supervisory review controls by requiring an independent review of compiled UEL data to verify completeness, accuracy, and proper reporting period classification, with evidence of review retained. Views of Responsible Officials: Management did not provide a response to the finding. The finding was not included in management’s corrective action plan.

Inadequate Tenant File Documentation in MTW Housing Choice Vouchers (ALN 14.881) (Repeat of Finding 2024-005) Condition: During tenant file testing for the Housing Choice Voucher (HCV) component of the MTW Demonstration Program, we identified the following deficiencies. This condition is a repeat of prior year finding 2024-005: 1. For one port-out tenant, the tenant file did not contain the required HUD Form 50058 or the Enterprise Income Verification (EIV) documentation. As a result, the family’s eligibility, income determination, and assistance could not be substantiated from the file. 2. For one tenant, the Authority was unable to provide the HUD Form 50058; the form was not retained in the tenant file and only tenant balances from the Authority’s housing software were available. The data is reportedly retrievable from HUD’s IMS/PIC system but could not be reproduced from the Authority’s records. 3. For one tenant, the income determination was incorrect. Social Security income was not recalculated based on the prior-year recertification; although an updated Social Security benefit letter was received indicating a change in the monthly benefit, the income reported on the HUD Form 50058 was not updated accordingly, resulting in an inaccurate rent and housing assistance payment (HAP) calculation. Criteria: Under 2 CFR §200.302 and §200.303, the Authority must maintain financial management systems and internal controls sufficient to ensure that costs are allowable, supported, and compliant with program requirements. The 2025 Compliance Supplement (4-14.881) identifies Eligibility (Type E) as subject to audit and requires that the HUD Form 50058-MTW key line items be “documented in the recipient’s file.” HUD program rules require PHAs to complete and retain accurate HUD Forms 50058, to verify income through HUD’s EIV system, and to recalculate income upon receipt of updated benefit information. Records supporting federal program compliance must be retained and accessible (2 CFR §200.334). Cause: The Authority lacked effective internal controls over tenant file documentation, income verification (including use of EIV and updated benefit information), HUD Form 50058 completion and retention, and reexamination procedures. Effect: Missing Forms 50058 and EIV documentation leave family eligibility and assistance payments unsupported; the failure to recalculate income based on updated Social Security benefit information resulted in an inaccurate income determination and rent/HAP calculation. These deficiencies increase the risk of over- or under-payment of housing assistance and questioned costs under the MTW program. Questioned Costs: $395,581 Recommendation: The Authority should ensure the executed HUD Form 50058 (and supporting income/EIV documentation) is completed and retained in each tenant file; recalculate income promptly upon receipt of updated benefit information and reflect the change on the Form 50058; perform EIV verification and reconciliation at each admission and reexamination; conduct a file-completeness review before sign-off; provide staff training on income determination, EIV, and federal recordkeeping; and, where forms were not retained, download and refile them from IMS/PIC. Reply and Corrective Action Plan: The Authority concurs with the finding and questioned costs of $395,581 and acknowledges it is a repeat of finding 2024-005. Ensure Forms 50058 and supporting documentation are retained; recalculate household income when required; retrieve or reconstruct missing records; resolve questioned costs with HUD; conduct file reviews; and provide staff training.

ompliance Deficiencies Identified in HUD Monitoring Review (ALN 14.881) Condition: The compliance deficiencies identified in the U.S. Department of Housing and Urban Development (HUD) Compliance Monitoring Review conducted June 24–28, 2024 (formalized in HUD’s letter dated March 24, 2025) remained unresolved as of September 30, 2025. The open items span multiple program areas, including governance and internal controls, Housing Choice Voucher (HCV) program compliance, Project-Based Voucher (PBV) documentation, Public Housing operations, ROSS grant administration, Violence Against Women Act (VAWA) policy, and Section 3 compliance. This condition is a repeat of prior year finding 2024-006. Criteria: The HUD findings cite noncompliance with various federal regulations, including 2 CFR Part 200 and 24 CFR Parts 5, 35, 75, 960, 982, and 983, as well as HUD Notices PIH 2016-22, 2017-13, 2022-10, and 2023-03. Under 2 CFR §200.303 and §200.521, the Authority is responsible for taking timely and appropriate corrective action on identified deficiencies. Cause: The Authority had not fully implemented or updated the policies, procedures, and documentation necessary to resolve the open HUD monitoring findings and align with current HUD requirements. Effect: Failure to resolve these deficiencies on a timely basis results in continued noncompliance with federal program requirements, may lead to disallowed costs or HUD sanctions, and increases the risk of recurring audit findings in future periods. Questioned Costs: None. Recommendation: The Authority should prioritize timely resolution of all open HUD monitoring findings; implement the corrective actions outlined in HUD’s letter (policy updates, staff training, file reviews, and required certifications); assign responsibility and target completion dates for each open item; and maintain ongoing communication with HUD to confirm closure. Reply and Corrective Action Plan: The Authority concurs with the finding and acknowledges it is a repeat of finding 2024-006. Maintain a remediation tracker; implement corrective actions identified by HUD; conduct training and file reviews; submit required certifications; and provide progress updates until all items are closed.

Finding Number 2025-002: Inadequate Tenant File Documentation in MTW Housing Choice Vouchers (ALN 14.881) (Repeat of Finding 2024-005) Condition: During tenant file testing for the Housing Choice Voucher (HCV) component of the MTW Demonstration Program, we identified the following deficiencies. This condition is a repeat of prior year finding 2024-005: 1. For one port-out tenant, the tenant file did not contain the required HUD Form 50058 or the Enterprise Income Verification (EIV) documentation. As a result, the family’s eligibility, income determination, and assistance could not be substantiated from the file. 2. For one tenant, the Authority was unable to provide the HUD Form 50058; the form was not retained in the tenant file and only tenant balances from the Authority’s housing software were available. The data is reportedly retrievable from HUD’s IMS/PIC system but could not be reproduced from the Authority’s records. 3. For one tenant, the income determination was incorrect. Social Security income was not recalculated based on the prior-year recertification; although an updated Social Security benefit letter was received indicating a change in the monthly benefit, the income reported on the HUD Form 50058 was not updated accordingly, resulting in an inaccurate rent and housing assistance payment (HAP) calculation. Criteria: Under 2 CFR §200.302 and §200.303, the Authority must maintain financial management systems and internal controls sufficient to ensure that costs are allowable, supported, and compliant with program requirements. The 2025 Compliance Supplement (4-14.881) identifies Eligibility (Type E) as subject to audit and requires that the HUD Form 50058-MTW key line items be “documented in the recipient’s file.” HUD program rules require PHAs to complete and retain accurate HUD Forms 50058, to verify income through HUD’s EIV system, and to recalculate income upon receipt of updated benefit information. Records supporting federal program compliance must be retained and accessible (2 CFR §200.334). Cause: The Authority lacked effective internal controls over tenant file documentation, income verification (including use of EIV and updated benefit information), HUD Form 50058 completion and retention, and reexamination procedures. Effect: Missing Forms 50058 and EIV documentation leave family eligibility and assistance payments unsupported; the failure to recalculate income based on updated Social Security benefit information resulted in an inaccurate income determination and rent/HAP calculation. These deficiencies increase the risk of over- or under-payment of housing assistance and questioned costs under the MTW program. Questioned Costs: $395,581 Recommendation: The Authority should ensure the executed HUD Form 50058 (and supporting income/EIV documentation) is completed and retained in each tenant file; recalculate income promptly upon receipt of updated benefit information and reflect the change on the Form 50058; perform EIV verification and reconciliation at each admission and reexamination; conduct a file-completeness review before sign-off; provide staff training on income determination, EIV, and federal recordkeeping; and, where forms were not retained, download and refile them from IMS/PIC. Reply and Corrective Action Plan: The Authority concurs with the finding and questioned costs of $395,581 and acknowledges it is a repeat of finding 2024-005. Ensure Forms 50058 and supporting documentation are retained; recalculate household income when required; retrieve or reconstruct missing records; resolve questioned costs with HUD; conduct file reviews; and provide staff training.

Compliance Deficiencies Identified in HUD Monitoring Review (ALN 14.881) Condition: The compliance deficiencies identified in the U.S. Department of Housing and Urban Development (HUD) Compliance Monitoring Review conducted June 24–28, 2024 (formalized in HUD’s letter dated March 24, 2025) remained unresolved as of September 30, 2025. The open items span multiple program areas, including governance and internal controls, Housing Choice Voucher (HCV) program compliance, Project-Based Voucher (PBV) documentation, Public Housing operations, ROSS grant administration, Violence Against Women Act (VAWA) policy, and Section 3 compliance. This condition is a repeat of prior year finding 2024-006. Criteria: The HUD findings cite noncompliance with various federal regulations, including 2 CFR Part 200 and 24 CFR Parts 5, 35, 75, 960, 982, and 983, as well as HUD Notices PIH 2016-22, 2017-13, 2022-10, and 2023-03. Under 2 CFR §200.303 and §200.521, the Authority is responsible for taking timely and appropriate corrective action on identified deficiencies. Cause: The Authority had not fully implemented or updated the policies, procedures, and documentation necessary to resolve the open HUD monitoring findings and align with current HUD requirements. Effect: Failure to resolve these deficiencies on a timely basis results in continued noncompliance with federal program requirements, may lead to disallowed costs or HUD sanctions, and increases the risk of recurring audit findings in future periods. Questioned Costs: None. Recommendation: The Authority should prioritize timely resolution of all open HUD monitoring findings; implement the corrective actions outlined in HUD’s letter (policy updates, staff training, file reviews, and required certifications); assign responsibility and target completion dates for each open item; and maintain ongoing communication with HUD to confirm closure. Reply and Corrective Action Plan: The Authority concurs with the finding and acknowledges it is a repeat of finding 2024-006. Maintain a remediation tracker; implement corrective actions identified by HUD; conduct training and file reviews; submit required certifications; and provide progress updates until all items are closed.

Finding 2025-002: Insufficient Documentation of Management Review of Section 3 Quarterly and Annual Reporting Audit Finding: Significant Deficiency Federal Program: Community Development Block Grant Mitigation Program Citywide Drainage Improvements (Assistance Listing 14.228) Compliance Requirement: Reporting and Special Tests and Provisions – Section 3 Requirements Criteria: In accordance with Title 2 of the Code of Federal Regulations (2 CFR) § 200.303, the City must establish and maintain effective internal controls over federal awards that provide reasonable assurance of compliance with federal statutes, regulations, and the terms and conditions of the award. Additionally, 2 CFR § 200.328 requires the City to ensure that reports submitted to the pass-through entity are accurate, complete, and supported by adequate review and oversight. The U.S. Department of Housing and Urban Development’s (HUD) Section 3 regulations at 24 CFR Part 75 require recipients to prepare and submit quarterly and cumulative annual Section 3 reports documenting efforts to provide employment, training, and contracting opportunities to low- and moderate-income persons and businesses within the project area. Condition: The City’s grant administrator is responsible for preparing and submitting the required quarterly and annual Section 3 reports to the Texas General Land Office on behalf of the City. However, there is no documentation demonstrating that City management reviews or approves these reports prior to and after submission. Cause: The City has not established procedures requiring City management to review and document approval of the Section 3 reports prepared and submitted to the Texas General Land Office. Effect: Without documentation of City management review and approval of the Section 3 reports prepared and submitted by the grant administrator, there is an increased risk that reports submitted to the passthrough entity may be inaccurate, incomplete, or not fully compliant with federal reporting requirements. Questioned Costs: None noted. Repeat Finding: This finding is related to the prior year finding 2024-002. Recommendation: The City should strengthen internal controls over federal reporting by establishing and documenting procedures to ensure City management reviews and approves all Section 3 reports prepared and submitted by the grant administrator. Evidence of this review, such as sign-offs or approval correspondence, should be retained in the grant files to demonstrate compliance with Uniform Guidance and HUD Section 3 reporting requirements. View of Responsible Officials: Management concurs with the recommendation. Please refer to the Corrective Action Plan for additional details.

Under the Uniform Guidance (2 CFR 200.512), a non-federal entity that expends $750,000 or more in federal awards during its fiscal year must submit its Single Audit reporting package to the Federal Audit Clearinghouse (FAC) within the earlier of 30 calendar days after receipt of the auditor's report or nine months after the end of the audit period. For the City’s fiscal year ended September 30, 2024, the statutory submission deadline was June 30, 2025. Furthermore, 2 CFR 200.303 requires the City to establish and maintain effective internal control over federal awards to provide reasonable assurance that federal awards are managed in compliance with applicable federal statutes, regulations, and award terms and conditions. The City’s Single Audit reporting package for the fiscal year ended September 30, 2024, was not submitted to the FAC by the June 30, 2025, statutory deadline. The audit could not be initiated in a timely manner due to severe deficiencies in internal control, accounting records, and organizational governance: 1. Unstable General Ledger: The City continued to post transactions to the 2024 fiscal year as late as May 2025, preventing the timely preparation of an auditable trial balance; Breakdown in Organizational Governance: Before audit fieldwork could begin, both the City Manager and City Secretary resigned, leaving the City without administrative management to oversee and coordinate preparation for the financial statement and Single Audit engagements. The City did not maintain an effective and enforceable period-end closing process, and the prior-year general ledger remained open well into the following fiscal cycle. Turnover in the City Manager and City Secretary positions further disrupted administrative continuity and delayed the coordination and record readiness necessary to begin and complete the audit and FAC submission process.

Assistance Listing Number, Federal Agency, and Program Name - 14.128, U.S. Department of Housing and Urban Development (HUD), Mortgage Insurance Hospitals Federal Award Identification Number and Year - N/A (2021) Pass through Entity - N/A Finding Type - Material weakness Repeat Finding - Yes 2024-005 Criteria - Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations (COSO). Condition - Controls were not designed or implemented effectively to ensure the following: a) mortgage and escrow payments were made in accordance with the due dates and amounts specified in the executed mortgage note agreement. b) earnings are retained in the replacement reserve account. c) the Organization completes the required financial reports in accordance with the applicable accounting basis, supported by underlying records representing the activity for the period reported. Questioned Costs - None If Questioned Costs Are Not Determinable, Description of Why Known Questioned Costs Were Undetermined or Otherwise Could Not Be Reported - N/A Identification of How Questioned Costs Were Computed - N/A Context - While gaining an understanding of management's processes and internal controls to ensure compliance with the areas noted above, we noted no effectively designed control in place to ensure compliance. Cause and Effect - Though noncompliance was not identified, a lack of internal controls could result in noncompliance with program requirements. Recommendation - We recommend that management design and implement internal controls to ensure compliance with mortgage escrow payments, reserve account funding, and quarterly financial reporting requirements. Views of Responsible Officials and Corrective Action Plan - Management will design and implement internal controls to ensure compliance with mortgage escrow payments, reserve account funding, and quarterly financial reporting requirements, including a process to ensure that documentation of reviews is retained.

2025-001 Compliance and Internal Controls over Reporting (Significant Deficiency) Assistance Listing Number 17.259 – Workplace Innovation and Opportunity Act Cluster / WIOA Youth Activities 2024-2025 Funding U.S. Department of Labor Passed through Texas Workforce Commission / Houston Galveston Area Council Contract No. 206-25 Criteria: Under 2 CFR Section 200.303(a), the recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, per the Subrecipient Contract Scope of Work 13.1, a monthly report to the Board and H-GAC contract liaison is due by the 10th of each month. Monthly reports are required to be submitted to the grantor to properly track grant progress, which allows the grantor to determine if further action is needed to fulfill the purpose of the grant. Condition: Monthly reports for October 2024, December 2024 and May 2025 were not submitted timely. SER-Jobs’ established controls over the reporting process did not work effectively to detect and/or correct non-compliance over the reporting process. Cause: Monthly reports were submitted late due to delays in accounting period close, which delayed the submission process to include the financial information in the required reports. Effect: Failure to submit the required reports as stipulated in the scope of work by the grantor may constitute a breach of contract and potential loss of funding. Questioned Costs: None. Perspective: 3 out of the 4 reports selected for our testing were not submitted timely. Repeat Finding: No Recommendation: Ser-Jobs should establish procedures to ensure that controls related to reporting are consistently implemented which should include prompt completion of the accounting period close to allow for timely submissions. Views of Responsible Officials: We concur with the recommendation, please see Corrective Action Plan.

2025-001: Accounting Records and Documentation (Significant Deficiency) Federal Program: Child Nutrition Cluster – School Breakfast Program (AL No. 10.553) and National School Lunch Program (AL No. 10.555) Condition: During our audit of compliance with federal program requirements, we noted that the District did not consistently maintain accounting records and supporting documentation for Child Nutrition Program reimbursement transactions in a manner that ensured timely accessibility for audit testing. Certain reimbursement requests and related supporting documentation were not readily available during audit fieldwork. As a result, we were required to perform expanded audit procedures, including additional reconciliations and alternative testing, to obtain sufficient appropriate audit evidence supporting the reported reimbursement amounts. Criteria: Uniform Guidance (2 CFR §200.302 and §200.303) requires nonfederal entities to maintain accurate, complete, and adequately supported financial records and to establish effective internal controls to ensure compliance with federal program requirements. Cause: The deficiency appears to be attributable to weaknesses in the District’s documentation retention, organization, and supervisory review procedures related to Child Nutrition reimbursement reporting. Effect: Although documentation was not fully sufficient at the outset of audit testing, expanded audit procedures allowed us to obtain reliable support for the reimbursement amounts tested. No questioned costs or audit differences were identified as a result of this condition. Testing of reimbursement activity disclosed no variances between amounts reported and amounts received, based on a tested population totaling $793,987.13. Recommendation: We recommend that the District strengthen its internal controls over the preparation, review, organization, and retention of Child Nutrition Program reimbursement documentation to ensure that complete and accurate supporting records are maintained and readily available for audit and monitoring purposes. Views of Responsible Officials: The District’s management concurs with the finding and plans to implement procedures to improve the completeness and accessibility of accounting records and supporting documentation related to federal program reimbursements.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Suspension and Debarment, Reporting, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) Federal Program Title: Food Distribution Cluster Texas 1944 Water Treaty Grant ALN: 10.565, 10.568, 10.560 10.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Food Distribution Cluster 246TX816Y8105, 256TX816Y7105, 246TX818Y8613, 238TX000I1003, 246TX816Q2204 October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, November 3, 2023 - November 2, 2024, May 23, 2023 - June 30, 2025, October 1, 2023 - September 30, 2024 Texas 1944 Water Treaty Grant FSA25GRA0012028 March 19, 2025 - March 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Department of Agriculture (TDA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user termination controls, we identified two instances, out of a sample of 14 terminated users, in which access was not removed within the timeframe required by TDA’s System Administrator separation process (i.e., application access removed on the date of the ticket/same day of termination and network access within one business day): Application (TX‑UNPS): User A was terminated on 06/13/2025. Network access was removed on 06/16/2025 (within one business day), but TX‑UNPS application access remained active until 06/19/2025 (removed after four business days), which does not meet the same‑day requirement for application access. Network: User B was terminated on 09/13/2024. Network access was removed on 09/17/2024 (removed after one business day due to weekend/holiday schedule), which does not meet the requirement for removal within one business day. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that TDA: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: TDA agrees with the finding. TDA acknowledges that improvements can be made to the separation process.

Cash Management, Eligibility, Matching and Earmarking, Period of Performance, Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – Change Management Federal Agency: U.S. Department of Justice Federal Program Title: Crime Victim Assistance ALN: 16.575 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 15POVC-25-GG-00366-ASSI, 15POVC-24-GG-00728-ASSI, 15POVC-23-GG- 00468-ASSI, 15POVC-22-GG-00468-ASSI, 2020-V2-GX-0040 October 1, 2024 – September 30, 2028, October 1, 2023 – September 30, 2027, October 1, 2022 – September 30, 2026, October 1, 2021 – September 30, 2025, October 1, 2020 – September 30, 2025, October 1, 2019 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Office of the Governor must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our review of information technology general controls related to network change management, we noted that the organization does not have a formal, documented change control process governing changes and approvals to the network hardware components and systems. As a result, network changes may not be consistently documented, reviewed, or formally approved. For purposes of this control, network changes include any additions, modifications, or removals affecting the network infrastructure, including but not limited to: • Network hardware (e.g., routers, switches, firewalls, wireless devices) • Network device configurations • Network related software, firmware, or operating system components Questioned costs: None. Context: See “Condition.” Cause: Management is aware of this matter and a draft policy initiative is already underway and targeted for completion during fiscal year 2026. Effect: In the absence of a formal documented change management process, there is an increased risk that unauthorized or untested network changes could adversely impact the confidentiality, integrity, or availability of systems and data. Repeat Finding: No Recommendation: We recommend that management finalize and implement the formal, documented network change management process to ensure all changes to network hardware, configurations, and related software are properly requested, reviewed, approved, tested, and documented. Views of responsible officials: A formal but not documented process has been utilized which requires CIO approval of all changes. A Project was instigated in 2024 to formalize and embed the verbal process into a written process with auditable execution logs. The project is in its final stages

Reporting – Financial, Performance and Special Reporting Federal Agency: U.S. Department of Labor (DOL) Federal Program Title: Unemployment Insurance (UI) ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: UI372522255A48, UI380082260A48, UI382492255A48, 23A03UI0389351, 23A60UR000007, 23A60UB000060, 24A55UI000051, 24A55UT000017, 24A60UR000091, 24A60UD000038, 25A55UE000005, 25A60UB000137, 25A60UB000149, 25A60UB000176, 25A60UB000187, 25A60UD000047, 25A55UI000094, 25A55UT000066, 25A60UR000102 October 1, 2021 – December 31, 2024, January 1, 2022 – September 30, 2024, January 1, 2022 – March 31, 2025, October 1, 2022 – December 31, 2025, January 1, 2023 – September 30, 2025, April 1, 2023 – May 22, 2025, October 1, 2023 – December 31, 2026, October 1, 2023 – September 30, 2024, January 1, 2024 – September 30, 2026, May 17, 2024 – May 17, 2027, July 1, 2024 – December 31, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 9, 2024 – July 9, 2027, October 1, 2024 – December 31, 2027, October 1, 2024 – September 30, 2025, January 1, 2025 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of financial, performance, and special reporting, we identified gaps in TWC’s documentation and oversight of its reporting processes. Specifically, for the ETA 2112 – UI Financial Transaction Summary, we tested three monthly reports, and none contained evidence of review or approval prior to submission. Similarly, for the ETA 9050 – Time Lapse of All First Payments Except Workshare and the ETA 9052 – Nonmonetary Determination Time Lapse Detection performance reports, we tested three monthly submissions for each report type, and all lacked documentation demonstrating that a formal accuracy and completeness review was performed. In addition, our testing of two quarterly ETA 2208A – Quarterly UI Above-Base Reports identified a lack of segregation of duties. For both reports tested, the individual responsible for preparing the report also performed the review function. Questioned costs: None. Context: See “Condition.” Cause: The absence of documented reviews and approvals appears to result from insufficient internal controls over the reporting process, including unclear staff responsibilities. These control gaps contributed to inconsistent application of review procedures and allowed instances where documentation of required oversight did not occur or was performed by the same individual responsible for report preparation. Repeat Finding: No Recommendation: TWC should strengthen internal controls over the reporting process by establishing clear roles and responsibilities for the preparation, review, and approval of all required ETA reports. Management should ensure that each report undergoes a documented, independent review to verify accuracy and completeness before submission. Additionally, TWC should provide targeted training to staff on reporting requirements and internal control expectations to reinforce consistent application of review procedures and prevent situations where the preparer and reviewer are the same individual. Views of responsible officials: Management agrees on the importance of the ETA reports and the accuracy of the information in the reports.