Findings Citing § 200.303

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S Department of Justice Federal Program: Congressionally Recommended Awards Assistance Listing Number: 16.753 Award Number: 15PBJA-23-GG-00920-BRND Compliance Requirement: Cash Management Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Condition The County received reimbursement for the total grant award amount prior to incurring expenditures. Criteria or specific requirement Compliance: Per 2 CFR section 200.305(b) For recipients and subrecipients other than States, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions the Federal award. These internal controls should comply with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Context The County received $2.5 million on July 1, 2024, for the grant, as of that date the general ledger reported no expenditures. The County incurred expenditures of $274,235 in October, $62,247 in November, and $2,160,518 in December. Cause The County’s controls were not operating effectively to ensure reimbursement request were performed in accordance with federal requirements. Effect The County had to return funding of $1,367,790 in November, which was subsequently drawn in December when expenditures were incurred. Questioned Costs None noted. Recommendation We recommend that the County develop internal controls and procedures to ensure drawdowns are performed in a manner to minimize the time between drawing and disbursing federal funds Views of responsible officials and planned corrective actions Fiscal Clerk has been trained on proper drawdown of grant funds and accurate recording of expenditures.

Criteria: 2 CFR 200.303 includes requirements related to internal controls for federal award programs, including that the Organization must, among other things, “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)”. Condition and Context: During 2024, the Organization reconciled the applicable match at the end of the grant period and submitted to the City of Indianapolis. There was no documentation on review of the schedule of the match nor was there a periodic assessment of the match until the reporting date. This is a repeat finding of 2023-003. Cause and Effect: We noted a lack of internal controls surrounding the tracking and review of the match. Errors could have occurred in the annual grant matching report which could have resulted in material non-compliance. Recommendation: We recommend the Organization implement procedures to track the match on a monthly basis with adequate review and approval. Views of Responsible Officials and Planned Corrective Actions: The Organization agrees with the recommendation and has implemented the recommendation noted.

Finding 2024-001 Evidence of Approval for Grant Expenditure Federal Program Name: Economic Adjustment Assistance Assistance Listing Number: 11.307 Type of Finding: Internal Control Deficiency Criteria 2 CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 200.303 specifies that a nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition The Council’s internal control policies do not include a requirement for documented approval of all grant expenditures, and accordingly certain expenditures that were tested during the audit did not show evidence of approval. Questioned Costs None Cause The Council’s internal controls allow for verbal approval or no approval in instances where access is limited to certain authorized individuals. Effect The Council’s internal controls leave them vulnerable to potential improper expenditures and without approvals of each transaction detection of improper expenditures may be limited. Recommendation It is recommended that the Council ensure all grant-funded expenditures have documented approval.

Federal agency: U.S. Department of Health and Human Services Federal Award Project Title: Better Family Life’s Relationship, Education, Advancement, and Development for Youth for Life Project Assistance Listing Number: 93.086 Assistance Listing Program Title: Healthy Marriage Promotion and Responsible Fatherhood Grants Award Period: September 30, 2023 – September 29, 2024 Award Period: September 30, 2024 – September 29, 2025 Federal agency: U.S. Department of Health and Human Services Federal Award Project Title: Better Family Life’s Teen Pregnancy Prevention Education Assistance Listing Number: 93.297 Assistance Listing Program Title: Adolescent Health Programs Award Period: July 1, 2023 – June 30, 2024 Award Period: July 1, 2024 – June 30, 2025 Type of Finding: Significant Deficiency in Compliance and Internal Control over Compliance Criteria: Related to cash management, when entities are funded on a reimbursement basis, program costs must be incurred before the drawdown is requested according to CFR section 200.305. Nonprofits should document the basis, or calculation, used for each drawdown request to show that the amount requested matches the expenses incurred for the period. Additionally, CFR section 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control over the Federal awards that provides reasonable assurance that the Federal expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. Drawdown requests should be reviewed and approved by appropriate personnel prior to submission by reviewing supporting documents to ensure amounts have been incurred.Condition: During audit testing of compliance and internal control over compliance, it was discovered funds were drawn down several times based on estimated bi-monthly expenses. Additionally, drawdown requests were not properly reviewed and approved by appropriate personnel. Cause: Due to staff turnover and timing constraints, the Organization utilized reasonable estimates rather than exact amounts for drawdown requests. Additionally, review and approval procedures related to drawdown requests were not being consistently performed. Effect: The estimated drawdown of funds could be different than actual expenditures incurred for the period, leading to costs being reimbursed prior to costs being incurred. As of December 31, 2024, all funds drawn were for expenses incurred prior to December 31, 2024. Additionally, the inconsistent application of internal controls could result in reimbursement of costs that were not incurred prior to drawdown. Questioned costs: No questioned costs were identified. Context: During audit testing of the Organization’s compliance and internal controls over compliance related to cash management, it was discovered the Organization at times utilized reasonable estimates rather than exact amounts for drawdown requests. Additionally, there was no review and approval of drawdown requests by appropriate personnel after February 2024, due to staff turnover. The audit team did not identify any questioned costs and concluded that the control failure was not indicative of fraud or illegal activities. Due to the compliance finding and lack of control, the audit team concluded the finding to be a significant deficiency in compliance and internal control over compliance. Recommendation: We recommend the Organization implement procedures to monitor drawdowns of funds so that funds are only requested when approved and documented reimbursable expenses have been incurred. Additionally, we recommend that management establish and enforce documented review and approval procedures of all drawdown requests. View of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal Award Project Title: Better Family Life’s Relationship, Education, Advancement, and Development for Youth for Life Project Assistance Listing Number: 93.086 Assistance Listing Program Title: Healthy Marriage Promotion and Responsible Fatherhood Grants Award Period: September 30, 2023 – September 29, 2024 Award Period: September 30, 2024 – September 29, 2025 Federal agency: U.S. Department of Health and Human Services Federal Award Project Title: Better Family Life’s Teen Pregnancy Prevention Education Assistance Listing Number: 93.297 Assistance Listing Program Title: Adolescent Health Programs Award Period: July 1, 2023 – June 30, 2024 Award Period: July 1, 2024 – June 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: CFR section 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control over the Federal awards that provides reasonable assurance that the Federal expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. Required reports should be reviewed and approved by appropriate personnel for completeness and accuracy, including comparing source documentation and any reconciliations between source data to final reporting. Additionally, appropriate personnel should review and approve the application of the indirect cost rate prior to each drawdown request. Condition: During audit testing of internal controls over compliance, it was discovered review and approval procedures were not being consistently performed related to Federal reporting and drawdown requests for payment of indirect costs (allowable costs).Cause: Due to staff turnover and timing constraints, review and approval procedures related to Federal reporting and drawdown requests for indirect costs (allowable costs) were not being consistently performed. Effect: The control failure could result in inaccurate Federal reporting and questioned costs related to payment of indirect costs. Questioned costs: No questioned costs were identified.Context: During audit testing of the Organization’s internal controls over reporting and indirect cost rate (allowable costs), it was discovered there was inconsistent review and approval of Federal reporting and inconsistent review and approval of drawdown requests for indirect costs. The audit team did not identify any questioned costs and concluded that the control failure was not indicative of fraud or illegal activities. Due to the lack of control, the audit team concluded the control failure was a significant deficiency in internal control over compliance. Recommendation: We recommend that management establish and enforce review and approval procedures related to all Federal reporting and indirect cost rate drawdown requests. View of responsible officials: There is no disagreement with the audit finding.

Subrecipient Monitoring U.S. Department of Health and Human Services Special Programs For The Aging, Title III, Part C, Nutrition Services – ALN #93.045 Criterion: Per CFR 200.331 the grantee must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Per CFR 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The County passed through funding to nine subrecipients totaling $3,434,144. During 2024, management did not properly monitor the subrecipients. Specifically, for the nine of the nine subrecipients management was unable to provide any documented evidence of a monitoring being performed although the contract periods are ongoing for all nine subrecipients. Cause and Effect: Management lacks a process to ensure that the monitoring of subrecipients is occurring during the contract period, and evaluation of each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Therefore, subrecipients were not properly monitored in accordance with 2 CFR 200.331 nor in accordance with the County’s Subrecipient Monitoring Policy. Questioned Cost: None Recommendation: We recommend that management enhance the design of its control activities to ensure that subrecipient files are adequately maintained, and perform risk assessment evaluations on all subrecipients to ensure they are effectively monitored during the contract period noted in the contractual agreements and the County’s Subrecipient Monitoring Policy. View of Responsible Officials: The Department of Senior Services agrees with this finding. Senior Services follows the monitoring standards established by the pass-through entity. However, the Department has implemented process improvements to ensure that all Program Year 2024_2025 compliance processes were met. The current period monitoring plan, risk assessments and monitoring have been completed. The Department will maintain an annual monitoring plan to ensure that all subrecipients are monitored in compliance with 2 CFR200 requirements.

Subrecipient Monitoring U.S. Department of Health and Human Services Substance Abuse Prevention – ALN #93.243 Criterion: Per CFR 200.331 the grantee must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Per CFR 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The County passed through funding to three subrecipients totaling $4,324,361. During 2024, management did not properly monitor the subrecipients. Specifically, for one of the three subrecipients management was unable to provide any documented evidence of a monitoring being performed although the contract periods are ongoing for the subrecipient; and all three subrecipient files did not contain risk assessment evaluations. Cause and Effect: Management lacks a process to ensure that the evaluation of each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Therefore, subrecipients were not properly monitored in accordance with 2 CFR 200.331 nor in accordance with the County’s Subrecipient Monitoring Policy. Questioned Cost: None Recommendation: We recommend that management enhance the design of its control activities to ensure that subrecipient files are adequately maintained, and risk assessment evaluations are performed on all subrecipients to ensure they are effectively monitored during the contract period. View of Responsible Officials: The Fulton County Department of Behavioral Health and Developmental Disabilities (DBHDD) concurs with the finding. DBHDD currently performs continuous monitoring activities with program subrecipients by conducting weekly meetings, reviewing monthly reports, invoices, and conducts quarterly performance reviews. DBHDD will strengthen its subrecipient monitoring internal controls by properly documenting these reviews in order to be incompliance with 2 CFR 200.331 and the County’s Subrecipient Monitoring Policy.

Allowable Costs U.S. Department of Justice National Sexual Assault Kit Initiative – ALN #16.833 Criterion: Per 2 CFR 200.303, a non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and terms and conditions of the Federal Award. Costs must be necessary and reasonable for the performance of the Federal Award and allowable thereto under the principles in 2 CFR part 200, subpart E. In addition, when employees work on projects funded by federal grants, the non-federal entity must certify the time and effort the employee dedicated to the grant funded project. This ensures proper tracking and accountability of grant funds. Condition: Based upon our testwork, we noted that 24 out of our sample of 60 payroll expenditures charged to the program were not adequately supported. The total population was $375,901. The 24 payroll samples tested in which adequate support was not provided totaled $80,654. Cause and Effect: Management lacks a process to ensure that payroll costs are properly allocated to federal programs. Therefore, payroll costs were not properly allocated to the federal program in accordance with 2 CFR part 200, subpart E. Questioned Cost: The questioned costs associated with our payroll sample amounted to $80,654. Recommendation: We recommend that management enhance the design of its control activities to ensure that payroll costs are properly allocated to the appropriate Federal programs. View of Responsible Officials: The Fulton County District Attorney concurs with the finding. In July 2024, the Fulton County District Attorney’s Office (FCDAO) was made aware during their Department of Justice monitoring review of the need to strengthen its time and effort supporting documentation for all employees paid with Federal funds in order to be in compliance with the 2 CFR 200 compliance requirement. Effective August 2024, the processes have been revised, documented, and are now included in the FCDAO standard operating procedure for time and effort management.

Finding 2024–001: Reporting – Recordkeeping Federal Department: U.S. Department of Agriculture Federal Award Identification Numbers and Year: 24N1199 Pass-through Agency: Illinois State Board of Education (ISBE) Child Nutrition Cluster: Summer Food Service Program for Children (SFSPC), Federal Assistance Listing Number 10.559 Criteria Federal regulations (7 CFR 225.15(d)) state (1) each sponsor shall hold Program training sessions for its administrative and site personnel and must not allow a site to operate until personnel have attended at least one of these training sessions. (2) Sponsors must conduct pre-operational visits for new sites, sites that experienced operational problems the previous year, and existing sites that are new to non-congregate meal service, to determine that the sites have the capacity to provide meal service for the anticipated number of children in attendance and the capability to conduct the proposed meal service. (3) Sponsors must visit each of their sites, as specified in paragraphs (d)(3)(i) through (iv) of this section, at least once during the first two weeks of program operations and must promptly take such actions as are necessary to correct any deficiencies. (i) Training of site personnel must, at a minimum, include: the purpose of the Program; site eligibility; recordkeeping; site operations, including both congregate and non-congregate meal services; meal pattern requirements; and the duties of a monitor. (ii) Each sponsor must ensure that its administrative personnel attend State agency training provided to sponsors, and sponsors must provide training throughout the summer to ensure that administrative personnel are thoroughly knowledgeable in all required areas of Program administration and operation and are provided with sufficient information to enable them to carry out their Program responsibilities. (iii) Each site must have present at each meal service at least one person who has received this training. (4) Sponsors must conduct a full review of food service operations at each site at least once during the first four weeks of Program operations, and thereafter must maintain a reasonable level of site monitoring. Sponsors must complete a monitoring form developed by the State agency during the conduct of these reviews. Sponsors may conduct a full review of food service operations at the same time they are conducting a site visit required under paragraph (d)(3) of this section. The United States Department of Agriculture, Food and Nutrition Service, The Summer Food Service Program (SFSP), 2024 Introduction to the Summer Food Service Program Administration Guide, Unit 4: Operating the Meal Service for the Summer Food Service Program, states “It is critical that site personnel and monitors understand the importance of accurate point of service meal counts. Only complete meals served to eligible children can be claimed for reimbursement. Meal counts are required for each day and each meal service in which meals and snacks are served. Therefore, meals and snacks must be counted at the actual point of service, as they are served, to ensure that an accurate count of meals served is obtained and reported). Counting meals at the point of service also allows site personnel to ensure that only complete meals are served.” Also, Unit 3: Administering Summer Food Service Program states “sponsors must be able to document that they have met their monitoring requirements. Monitors must submit a report for pre-operational site visits, initial site visits, and full meal service reviews throughout the summer.” Chicago Park District’s (the District) Summer Food Program 2018 Monitor’s Orientation Handbook requires monitors checking site operations to make sure that the site maintains adequate records and that the program is operating in accordance with the requirement. To comply with this requirement, the District utilizes a monitoring checklist that is attached to each site file. The checklist requires documentation of ISBE approved application, ISBE participation detail, the District application, field trip data, authorized signature form, authorized signature form, training sign-in sheets, certificate of training, park enrollment roster and site responsibilities. Per the District’s Summer Food Program Management manual, the District replaced a series of paper forms with two online forms: Summer Food Weekly Summary and Summer Food Program Daily Timesheets. However, two paper documents will continue to exist, the daily receipts and the state mandated Daily Meal Count Form. 2 CFR Part 200, Subpart D – Post Federal Awards Requirements, Section 200.303 Internal Controls states “The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient and subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations and the terms and conditions of Federal awards. Condition During the current audit period, the District did not adequately document its compliance with the special tests and provisions requirements of the SFSPC. This included maintaining adequate controls over required monitoring and meal count forms to ensure forms were properly completed and approved by authorized personnel. Cause Per our discussions with management, the SFSP was administered across 198 sites on a daily basis during the summer months. Specifically, in 2024, the program and the corrective actions planned were interrupted and significantly impacted due to a shortage of staff as positions were not filled successfully. Effect Failure to maintain supporting documentation of the required monitoring and meal count forms and ensure that the forms have been properly completed and approved by authorized personnel is a violation of the program’s requirements and impairs the District’s ability to adequately monitor the federally funded program. This could also result in questioned and disallowed costs, which the District may need to reimburse to its grantor agency. Questioned Costs None. Context During our testing of monitoring at 25 sites (total sites operated under the program during 2024 was 198 sites), we noted the following:  For two sites (8%), the monitoring site review form was not properly completed. The form was either missing the monitor departure time or the monitor departed early (five minutes after the start of the approved mealtime).  For four sites (16%), we were unable to properly identify who signed the site visit or the monitoring site review forms because of illegible signatures, without some assistance from the District’s personnel. For the 25 sites sampled, we tested a total of 10 days (July 8 through July 12 and July 22 through July 26) from a population of 39 days (calculated based on the number of days meals were claimed for reimbursements during the program) to verify that the delivery ticket, daily meal count form, and the Summer Food Weekly Summary form were properly completed and reviewed by authorized personnel. We noted the following:  For six sites (24%), we were unable to properly identify who signed the delivery ticket and/or daily meal count forms due to illegible signature, without some assistance from the District’s personnel. Identification of Repeated Findings Repeated (Prior Finding Numbers 2023-001 and 2022-001). Recommendation We recommend the District continue to implement internal controls to improve compliance with federal regulations over the SFSP. In addition, we recommend the District ensure adequate staff resources and training are in place to ensure accurate reporting of all meals served, as well as all required forms are properly completed. Also, we suggest the District update its policy manual to define “reasonable monitoring” of the SFSP program, including any deviations from its current practice of completing at least two monitoring site reviews forms. Lastly, we suggest the District update its required forms (daily meal count, site visit/monitoring site review) to have authorized personnel include a printed signature, which will assist in easily identifying and verifying that the person is authorized to sign the form(s). Views of Responsible Officials and Planned Corrective Action The District agrees with the finding and recommendation. The District’s corrective action plan is on page 17.

Finding 2024-001 – Reporting (Compliance, Internal Controls Over Compliance) Material Weakness ALN 10.767 Intermediary Relending Program Criteria: Under Intermediary Relending Program (IRP) regulations (7 CFR §4274.338(b)(4)(ii)(A)), recipients must submit quarterly and semiannual financial reports to USDA Rural Development. Additionally, 7 CFR §4274.338(b)(4)(iii), requires submission of an annual proposed budget. Under Uniform Guidance, 2 CFR §200.303, entities are required to establish and maintain effective internal controls over federal awards to ensure compliance, including management review procedures to verify reports are accurate, complete, and timely. Condition: Testing of the reporting requirements disclosed that the quarterly and semiannual IRP reports were not submitted to USDA Rural Development. Questioned Costs: None Cause: BASEC was unaware of the IRP reporting requirements and has not established a formal review and approval process for preparing and submitting the required reports. Effect: The absence of timely submission of required reports results in noncompliance with federal program requirements. Recommendation: We recommend that BASEC establish and document a formal review and approval process for quarterly and semiannual IRP reports, in accordance with 2 CFR §200.303. The process should include supervisory review, documented approval (e.g., sign-offs or electronic authorization), retention of supporting documentation, and a tracking system to ensure timely submission. Views of Responsible Officials: See the corrective action plan that accompanies the schedule of findings and questioned costs.

Assistance Listing Numbers: 10.001, 10.200, 10.215, 10.307, 10.310, 10.311, 10.443 and 10.912 Name of Federal Program or Cluster: Research and Development Cluster Name of Federal Agency: Department of Agriculture Federal Award Identification Numbers: 58-5090-2-037 2022-38624-38368 2021-38640-34714 A0242501X443G026 2022-38640-37486 2023-51300-40959 2021-68012-35917 2019-68012-29852 2020-68012-31934 2021-49400-35592 NR225F48XXXXG006 Direct Award Periods: August 1, 2022 through July 31, 2027, September 1, 2023 through February 28, 2025, September 29, 2022 through September 30, 2027, September 27 2024 through September 26, 2027 and September 27, 2022 through June 30, 2026 Name of Pass-through Entities and Award Periods: Michigan State University-September 1, 2022 through August 31, 2025; Regents of the University of Minnesota-March 1, 2022 through February 28, 2025, April 1, 2023 through March 31, 2025, and September 1, 2020 through August 31, 2025; Board of Regents of the University of Wisconsin System-January 1, 2022 through December 31, 2026 and September 1, 2018 through August 31, 2024. Criteria or Specific Requirement: In accordance with 2 CFR § 200.303, non-federal entities must establish and maintain effective internal control over federal awards to provide reasonable assurance that the entity is managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. Additionally, changes in key personnel typically require prior written approval from the federal awarding agency or pass-through entity, as described in 2 CFR § 200.308(c)(2). Condition: During the audit, we noted that the Organization does not have documented internal controls or formal procedures in place to monitor and manage compliance with the key personnel requirements under its federal awards. Specifically,  There is no control in place to identify or track which personnel are designated as “key personnel” in award documents.  No procedures exist to ensure that required prior approvals are obtained from the federal awarding agency before any changes in key personnel are made.  No review or oversight process is in place to ensure that key personnel are actively participating at the level of effort committed in the approved award. Cause: The Organization has not developed or implemented policies and procedures to ensure compliance with special terms and conditions related to key personnel requirements under federal awards. Effect or Potential Effect: The lack of internal controls over key personnel requirements increases the risk that required prior approvals may not be obtained when changes occur, or that personnel effort commitments are not being met. This could result in noncompliance with the terms and conditions of the award, potential disallowance of costs, or reputational risk with federal awarding agencies. Repeat Finding: This finding is a repeat of Finding 2023-007. Recommendation: The Organization should implement internal controls and written procedures to:  Identify and track key personnel for each award, based on the approved budget or notice of award.  Establish a process to ensure that prior written approval is obtained before any changes to key personnel are made.  Monitor and document key personnel effort to ensure it aligns with award requirements and commitments.  Provide training to relevant staff on the importance of key personnel compliance and the procedures for requesting changes. Views of Responsible Officials: Management agrees with the finding and will implement internal controls and document its policies and procedures related to key personnel.

Type of Finding: Significant deficiency Federal Agencies, Programs, and Assistance Listing Numbers: o U.S. Department of Agriculture:  State of Hawaii, Office of Education, Hawaii Child Nutrition Program: Summer Food Service Program for Children (Assistance Listing No. 10.559) Criteria – In accordance with Title 2, Subtitle A, Chapter II, Section 200.303 (2 CFR § 200.303), non-federal entities must establish and maintain effective internal controls over federal awards that provide reasonable assurance that the entity is managing the award in compliance with federal statutes, regulations, and terms and conditions of the award. Segregation of duties and management oversight are essential components of effective internal control. Condition – During our audit, we noted that the meal reimbursement claims submitted for June and July 2024 reconciled to supporting documentation. However, there was no evidence of management's review and approval of the submitted meal reimbursement claims. Cause – The Organization's meal reimbursement process did not require management review or approval of claims prior to submission. Effect – Insufficient management review increases the risk of unsubstantiated claim reimbursements which could result in noncompliance with program requirements. Questioned Costs – None Identification as a Repeat Finding, if applicable – Not a repeat finding. Recommendation – In addition to existing processes and controls over meal reimbursement claim submissions, we recommend management document their review and approval of meal reimbursement claims with a reviewer sign off. Views of Responsible Official(s) and Planned Corrective Action – See Corrective Action Plan on page 41.

2024-002 - Lack of Independent Review and Approval Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Control over Compliance (Allowable Costs/Cost Principles, Cash Management and Reporting) Program. Environmental and Scientific Partnerships and Programs; U.S. Department of State; ALN Number 19.017; Award Number SAQMIP23CA0021 Criteria. Per 2 CFR 200.303, the recipient must establish, document, and maintain effective internal controls over federal awards that provides reasonable assurance that the recipient is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. Condition. During our testing of Allowable Costs/Cost Principles, of the 12 items tested, we noted all 12 instances where time sheets were missing evidence of review and approval. In addition, there were no evidence of review and approval of the hourly rate or salary for all the employees tested. During Cash Management testing, of the three items tested, all three drawdown requests were missing evidence of review and approval. Finally, during our testing of Reporting, all four of the reports selected for testing lacked evidence of review and approval. Cause. This condition is the result of management not adhering to the Organization's internal control policies and procedures. Effect. The Organization did not comply with the federal requirements as noted per 2 CFR 200.303. Questioned Costs. None Recommendation. We recommend the Organization adheres to their internal control process of an independent review and approval of transactions, cash management and reporting related to federal grant programs. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.

Program Name – STOP Violence Grant- Victim Services CFDA Number – 16.588 Pass-through Entity – Michigan Department of Health and Human Services Finding Type – Significant Deficiency and Noncompliance Criteria – Per 2 CFR § 200.303 (Internal Controls), recipients of federal funds must establish and maintain effective internal controls over compliance. Additionally, the program requires recipients to maintain adequate documentation to support that services are provided to eligible participants. This includes maintaining enrollment forms or other supporting records that verify participant eligibility as required by the applicable federal regulations. Condition and Description – For 4 out of 20 samples tested, during our testing of participant eligibility under the STOP Violence against Women Formula Grants, the Organization was unable to provide enrollment forms or supporting documentation. These forms are necessary to verify that participants met the program’s eligibility criteria. Questioned Costs – Unknown. Id entification of a Repeat Finding- This is not a repeat finding from the immediate previous audit. Cause/Effect – The absence of enrollment documentation appears to result from a lack of internal controls over participant intake and recordkeeping processes. Specifically, procedures were not in place to ensure all required eligibility documentation was collected and retained in participant files. As a result, the Organization was unable to demonstrate that services were provided only to eligible individuals. Recommendation – We recommend that the Organization implement and enforce procedures to ensure all required enrollment and eligibility documentation is consistently collected and retained for each program participant. Staff should be trained on eligibility requirements and federal documentation. View of Responsible Officials and Planned Corrective Action – Procedures exist to ensure all clients are enrolled and eligible for services under the STOP grant. The external audit did not take into account the legal screening process and the intake forms used to determine eligibility and complete client enrollment, outside of the Apricot system. Enforcement of enrollment procedures within Apricot, and oversight from department Directors, has been made a priority.

Criteria: 2 CFR section 200.303 states in part: “The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . .” Additionally, 31 CFR section 205.33 states in part: (a) “…the timing and amount of funds transfers must be as close as is administratively feasible.. .” Condition: An effective internal control system was not in place to ensure compliance with requirements related to the grant agreement and the Cash Management compliance requirements. Cause: The Corporation's management has not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: There was no formal review/approval of claim reimbursements outside of who prepares them. The failure to establish an effective internal control system places the Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of effective reviews could have also allowed noncompliance with the compliance requirements and allowed misuse, mismanagement, and improper period recognition of federal funds and assets. Claim reimbursements were not drawn in a timely or consistent manner. For example, claims were drawn anywhere from six- twelve months after costs were incurred or not at all. A lack of timely claim submission could result in failure to fully expend the grant within the period of performance and proper revenue recognition. Recommendation: We recommend that the Corporation establish policies and procedures to ensure that reimbursement claims prepared are reviewed and approved. The reimbursement claim should be compared to supporting documentation to ensure accuracy of the claim reimbursement form. Reimbursement claims should also be prepared and submitted timely to help ensure proper period recognition and adequate reimbursement. Views of Responsible Officials and Corrective Actions: During 2025, Hamilton County Area Neighborhood Development, Inc. (HAND) hired a controller to assist with the preparation of the parent company and subsidiaries financials while instituting improved internal control policies. As such, HAND with the assistance of its controller will establish effective internal control systems to ensure compliance with the requirements for grant agreements and cash management compliance requirements.

Finding: Item 2024-001 – Internal Controls over Federal Programs Material Weakness Federal Program – COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number – 21.027 Pass-through Grantor's Numbers – CMF 2021125, 2159FR0292, 2159FR0310, 2159FR0317, 2159FR0334, 2159FR0318 Federal Award Year – December 31, 2024 Federal Agency – U.S. Department of Treasury Pass-Through Entity – Tulsa County/City of Tulsa Criteria: 2 CFR 200.303 requires that organizations receiving federal awards must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing federal awards in compliance with federal statutes, regulations and terms and conditions of the federal award. Condition/context: Formal controls were not established or documented surrounding the following compliance requirements specified for this grant under 2 CFR Part 200, Appendix XI: Suspension and Debarment – no established internal control policies to verify that vendors selected for use were not suspended or debarred from use for expenditures of federal awards. Cause: The Foundation and its affiliates have not established internal control policies to ensure compliance with principles established under the Uniform Guidance. Effect: Lack of internal controls could result in instances of noncompliance with federal grant requirements, which could lead to loss of future funding or requests for repayment of federal awards previously distributed by federal agencies. Questioned cost: Not applicable. Repeat finding: Yes, 2023-003. Recommendation: The Foundation and its affiliates should establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should align with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework" issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). View of responsible officials: Management's response is reported in "Corrective Action Plan" at the end of this report.

Finding 2024-002 Journal Entry Approval - Significant Deficiency in Internal Control over Compliance Identification of the Federal Program Department of Health and Human Services ALN 93.600 Head Start Cluster Year – 2024/2025 | FAIN: 90CI010156/90BF000005 Criteria or Specific Requirement The Uniform Guidance in 2 CFR Section 200.303, Internal Controls requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition During our testing of disbursements, we noted the following exceptions: • 3 out of 3 journal entries that were selected did not have adequate supporting documentation. Cause Internal control process for retention of the source documentation was not followed. Effect or potential effect Unallowable costs may have been recorded as grant expenses. Questioned Costs None noted. Context For the testwork for allowable activities over the Head Start Cluster we requested source documentation detailing appropriate review and approval of journal entries. The Organization was unable to provide this documentation. Identification as a Repeat Finding Not a repeat finding. Recommendation We recommend that the Organization comply with the requirements of CFR section 200.303 and establish a documentation retention policy and maintain records of the review and approval process in accordance with the Uniform Guidance. Views of responsible officials Management agrees with the finding. Steps will be taken to correct the retention of source documentation process and enhance internal controls to prevent similar occurrences in the future.

2024-001 U.S. Department of Education, Education Stabilization Fund, Passed Through the State of Nevada Department of Education – Internal Controls System Over Allowable Costs and Allowed Activities Criteria: As defined in 2 CFR 200.303, auditee is required to maintain a system of internal control over compliance designed to provide reasonable assurance that federal award transactions executed are in compliance with the terms and conditions of the federal award. Funds utilized under the Education Stabilization Fund program are required to be expended on costs consistent with those outlined in 2 CRF 200 Subpart E – Cost Principles, and within the core service categories outlined in the grant agreement. Condition: For one pay period selected for testing, three of the thirteen employees charged to the grant did not have an approved Payroll Action Form which assigns the appropriate percentage of payroll and related expenses to be allocated to the grant. Context: Management failed to design and implement consistent internal controls to address the risk of improper payroll amounts being allocated to the grant. Cause: Internal controls over payroll allocations was not performed consistently to ensure all payroll allocations and related expenses were properly reviewed. Effect: Failure to design and implement controls over the approved payroll allocations could result in the grant being overcharged. Recommendations: We recommend management design and implement a system of internal controls whereby all employee time and expenses include the appropriate review and approval when included as part of the Organization’s Request for Reimbursement. Views of Responsible Officials and Planned Corrective Action: CORE, Powered by The Rogers Foundation has discontinued the use of the Payroll Action Forms for tracking labor allocations. As of August 2025, all grant-funded positions have been converted to hourly status, with time and effort now documented directly by employees through Paylocity, the Organization’s timekeeping system. Employees clock in and out and designate the appropriate labor allocations for each portion of their workday. Human Resources pulls the Paylocity timecard reports for all grant-funded positions for each pay period. These timecards undergo a documented, multi-level review and approval process: first by the Program Manager, then by the Grant Manager. Approved timecards are uploaded to a secure shared drive, where the Grant Accountant uses them to prepare Requests for Reimbursement (RFRs). Before submission, the Grant Manager performs a final review of all expenses and supporting documentation and provides written sign-off on the total amount. CORE, Powered by The Rogers Foundation has designed and implemented this documented, multi-level internal control system to ensure all payroll charges are properly authorized, supported, and retained prior to included in RFRs, thereby preventing recurrence of the issue identified in the audit.

Criteria: Per 2 CFR §200.303(a), the non-Federal entity must establish and maintain effective internal controls over Federal awards to provide reasonable assurance that the awards are managed in compliance with Federal statutes, regulations, and the terms and conditions of the award. Condition: During our testing of expenses and invoices submitted for reimbursement under the Community Project Funding and Miscellaneous Grants, we identified invoices that were submitted for reimbursement which did not align with the Organization’s internal grant allocations as recorded in the profit and loss by class. Context and Cause of Condition: The Organization provided incorrect supporting documentation to support certain draw requests. This occurred in part because the Organization is new to managing Federal awards and lacked established procedures for ensuring that documentation submitted matched what was recorded in the accounting system. While errors were noted in the documents provided, the Organization had sufficient allowable expenses and invoices to fully support the draw requests made during the year within all material respects. Questioned Costs: None Potential Effect: These conditions increase the risk of error or fraud in grant reporting and could result in noncompliance with Federal requirements, potential questioned costs, or cash management issues. Recommendation: We recommend that management: • Establish procedures to ensure the correct invoices and expenses are submitted with draw requests. • Ensure all expenses are properly coded in the profit and loss by class to the correct funding source and recorded on the accrual basis of accounting. • Base draw requests on amounts recorded in the accounting system to ensure accuracy, consistency, and compliance with Federal requirements. Views of Responsible Officials: The Organization concurs with the finding and recommendation. See Corrective Action Plan.

Finding 2024-003: Notification of Disbursements to or on Behalf of StudentsIdentification of the federal program: Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans), 84.063 Federal Pell Grant Program, 84.007 Federal Supplemental Education Opportunity Grant Program. Award Periods: July 1, 2023 through June 30, 2024; July 1, 2024 through June 30, 2025. Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:“The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”34 CFR 668.165(a)(1) – Before an institution disburses title IV, HEA program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans. Condition:When Direct Loans are being credited to a student’s account, an institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan; and (3) the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan. Atrium Health CMHA was unable to provide the notification letters sent to the student as they are not maintained. Further, there were three instances where student disbursements were not made timely and one instance where a disbursement resulted in a credit that was not returned timely. Cause:The current IT system does not allow for the letters sent to be saved.Effect or potential effect: The disbursement notification letters may not have be sent in accordance with the regulations.Questioned costs:None.Context:Total expenditures for the Student Financial Assistance Cluster were $2,876,252 for the year ended December 31, 2024. We selected a sample of 40 disbursements and identified 33 that did not have notification of disbursement and one disbursement that resulted in a credit that was not refunded within the time frame.Identification as a repeat finding, if applicable:This finding is a repeat finding of 2023-004 from the prior year. Recommendation:Atrium Health CMHA should implement internal controls to retain all disbursement notification letters sent to students.Views of responsible officials:Atrium Health CMHA management, as part of the 2025 process and procedures consulting engagement, will develop a plan to ensure that the IT systems are changed such that notification letters can be retained or a control exists whereby hard-copies of notification letters are maintained.

Finding 2024-004: Gramm-Leach-Bliley Act (GLBA) – Student Information Security Controls. Identification of the Federal Program:Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans), 84.063 Federal Pell Grant Program, 84.007 Federal Supplemental Education Opportunity Grant ProgramAward Periods: July 1, 2023 through June 30, 2024; July 1, 2024 through June 30, 2025. Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:“The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314).Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. Condition:Atrium Health CMHA did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of certain elements of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program did not address certain required elements per 16 CFR 314.4 to ensure compliance with federal regulations.Cause:Atrium Health CMHA did not retain sufficient documentation of their review procedures over certain elements of the Information Security Program. Atrium Health CMHA did not include certain required elements within its Information Security Program. Effect or Potential Effect:The written Information Security Program is not compliant with federal regulations. Questioned Costs:None. Context:Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule of Expenditures of Federal Awards (Schedule) totaled $2,876,252 for the year ended December 31, 2024.Identification as a Repeat Finding, if Applicable:This finding is a repeat finding of 2023-005 from the prior year. Recommendation:Atrium Health CMHA should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately.Views of Responsible Officials:Atrium Health CMHA management, as part of the 2025 process and procedures consulting engagement, will ensure that all GLBA requirements over the Information Security Program are both documented completely and inclusive in scope of both general CMHA IT systems as well as IT systems specific to the SFA program.

Information on the federal program – 16.575 – Crime Victim Assistance; U.S. Department of Justice; Texas Office of the Governor – Criminal Justice Division; Program years 2023-2024, 2024-2025 21.027 – Coronavirus State and Local Fiscal Recovery Funds; U.S. Department of Treasury; Dallas County; Program years 2023-2024, 2024-2025 93.558 – Temporary Assistance for Needy Families; U.S. Department of Health and Human Services; Texas Health and Human Services Commission; Program years 2023-2024, 2024-2025 Type of Finding – Significant deficiency in internal control over compliance Criteria or specific requirement – The Uniform Guidance and TxGMS require auditees to establish and maintain internal controls to prevent or identify and correct noncompliance with direct and material compliance requirements in a timely fashion (2 CFR 200.303), specifically controls over: Activities Allowed/Allowable Cost (2 CFR 400); Cash Management (2 CFR 305); Reporting (2 CFR 328-330). Condition – The Family Place was unable to provide evidence supporting a review of: Purchase order, invoice, time card, financial report, and performance reports having occurred prior to submission or drawdown. Cause – With turnover and position vacancies, supporting documentation was not available to support evidence of a prior review. Effect or potential effect – Costs may be charged to the grant improperly or inaccurate reports may be submitted to the granting agencies. Questioned costs – None Context – Allowable Costs: Out of a population of 5,120 transactions, a sample of 126 was selected noting 19 did not have evidence of approval of timecards, invoices, or purchase orders prior to drawdown. Cash Management: Out of a population of 28 transactions, a sample of 6 drawdowns was selected noting 6 did not have evidence of approval of drawdowns prior to submission. Reporting: Out of a population of 45 financial and performance reports, a sample of 10 drawdowns was selected noting 10 did not have evidence of approval of drawdowns prior to submission. Identification as a repeat finding, if applicable – Not applicable Recommendation – We recommend management ensure sufficient staffing and oversight to abide by internal processes and procedures which require prior approval of expenditures and reports prior to drawdown or submission. Views of responsible officials and planned corrective actions – See accompanying corrective action plan.

Information on the Federal Program: Assistance Listing Number 81.086— Upper Midwest Inter‐Tribal EV Charging Community Network. Compliance Requirement: Allowable Costs and Cost Principles, Activities Allowed or Unallowed Type of Finding: Significant deficiency in internal control over compliance. Criteria: 2 CFR 200.303 of Subpart D, "Post Federal Award Requirements Standards for Financial and Program Management," of the Uniform Guidance requires a nonfederal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award, including Activities Allowed or Unallowed, Allowable Costs and Cost Principles. Condition: Controls were not operating as designed to ensure that all expenditures charged to the federal program were reviewed and approved. Causes: For two out of ten tested, expenses charged to the federal grant had no documentation of a review and approval prior to the Organization submitting for reimbursement. The Organization relied on a control activity where the Program Director sent an email to the Executive Director for each expense to obtain approval prior to submitting reimbursements. No documented review and approval for this process being performed was available for two expenses upon request by the audit team. Effect or Potential Effect: Unallowable costs or activities could be charged to the grant. Questioned Costs: None Context: There was not sufficient documentation available upon request to support a review and approval process of reimbursement expenses allocated to the grant. The Organization implemented a payment software that includes review and approval features in July of the fiscal year under audit and no errors were found after the implementation. Repeat Finding: No Recommendation: We recommend the organization continue using their payment software for all transactions relating to federal grants and ensure that all expenses are being reviewed and approved through that software. Views of Responsible Officials: Agree.

Information on the Federal Program: Assistance Listing Number 81.086— Upper Midwest Inter‐Tribal EV Charging Community Network. Compliance Requirement: Matching Type of Finding: Significant deficiency in internal control over compliance. Criteria: 2 CFR 200.303 of Subpart D, "Post Federal Award Requirements Standards for Financial and Program Management," of the Uniform Guidance requires a nonfederal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award, including Cost Match principles. Condition: Controls were not implemented to monitor cost match partners’ activities to ensure their expenditures comply with allowable cost activities. Causes: For one of three cost matching amounts recorded in 2024, detail of amounts reported as cost match was not available upon request by auditors. It was obtained from the cost match partner, but the detail had not been obtained, reviewed, and approved by the Organization prior to being requested by auditors. Effect or Potential Effect: Unallowable costs or activities could be counted for cost match by match partners causing Native Sun to fall short of cost match requirements. Questioned Costs: None Context: The Organization did not initially have documentation with sufficient detail for expenses reported by cost match partners during 2024. Repeat Finding: Yes Recommendation: We recommend a control be implemented to monitor cost match partners including obtaining, reviewing and retaining support for reported cost match amounts. Views of Responsible Officials: Agree.

Federal Program: Student Financial Assistance Cluster, ALN No. 84.063 and 84.268 Federal Agency: U.S Department of Education Federal Award Year: July 1, 2023 – June 30, 2024 and July 1, 2024 - June 30, 2025 Criteria or Requirement: Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, (Subpart D, Section 200.303), the nonfederal entity must establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: The Health System, specifically the Covenant School of Nursing and Radiography (the Nursing School), did not follow requirements relative to the Student Financial Assistance program during the year ended December 31, 2024. During our testing, the Nursing School was unable to provide documentation supporting that various eligibility, reporting, special test and provision requirements were completed in accordance with Federal requirements. The Nursing School’s risk assessment and monitoring control activities were not designed at an appropriate level of precision to ensure adequate segregation of duties or evidence of controls operation related to the following direct and material compliance areas: eligibility, reporting, and special tests and provisions including enrollment reporting, return of title IV funds, Gramm-Leach-Bliley Act – student information security, and incentive compensation. The Federal expenditures under the Student Financial Assistance cluster were $2,728,263 during the year ended December 31, 2024. Cause and possible asserted effect: The Nursing School does not have appropriate segregation of duties and documentation of key control activities and their related precision levels related to the Student Financial Assistance cluster. Without appropriate controls in place, the Health System could incur unallowable expenditures or result in noncompliance with the requirements. Identification of questioned costs and how they were computed: None Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number: No. This finding was not a finding in the immediate prior year audit. Recommendations: For eligibility, reporting, and special tests and provisions including enrollment reporting, return of title IV funds, Gramm-Leach-Bliley Act – student information security, and incentive compensation, we recommend that management design and implement internal control procedures at the Nursing School to support the compliance requirements for the program including adequate segregation of duties, reviews at a sufficient level of precision to identify noncompliance, and proper evidence of control operation. Views of responsible officals: Management concurs with KPMG’s assessment that the risk assessment and monitoring control activities were not sufficiently designed to ensure adequate segregation of duties or to provide evidence of control operation. These gaps were primarily due to limited staffing and processes that have not evolved to meet all compliance requirements. Management will implement new control policies and procedures that ensure proper segregation of duties and introduce review mechanisms at a sufficient level of precision to detect and prevent noncompliance. These policies and procedures will be implemented by December 31, 2025.

Federal Program: Crime Victim Assistance – ALN 16.575, National Family Caregiver Support, Title III, Part E – ALN 93.052, Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Heath or Healthcare Crises – ALN 93.391, Hospital Preparedness Program (HPP) Ebola Preparedness and Response Activities – ALN 93.817, Block Grants for Prevention and Treatment of Substance Abuse – ALN 93.959, Non-Profit Security Program – ALN 97.008 Federal Agency: U.S. Department of Justice, U.S Department of Health and Human Services, U.S. Department of Homeland Security Federal Award Year: Various Criteria or Requirement: Per 2 CFR 200.328, The recipient or subrecipient must submit financial reports as required by the Federal award. Reports submitted annually by the recipient or subrecipient must be due no later than 90 calendar days after the reporting period. Reports submitted quarterly or semiannually must be due no later than 30 calendar days after the reporting period. Per 2 CFR 200.329, The recipient or subrecipient must submit performance reports as required by the Federal award. Intervals must be no less frequent than annually nor more frequent than quarterly except if specific conditions are applied (See § 200.208). Reports submitted annually by the recipient or subrecipient must be due no later than 90 calendar days after the reporting period. Reports submitted quarterly or semiannually must be due no later than 30 calendar days after the reporting period. A subrecipient must submit a final performance report to a pass-through entity no later than 90 calendar days after the conclusion of the period of performance. Per the 2024 Compliance Supplement, non-federal entities may be required to submit special reports as required by the terms and conditions of the federal award. Per 2 CFR 200.303, the non-federal entity must establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: Of 20 financial reports tested, 9 were either not submitted timely or documentation was not available to substantiate when the report was submitted. Of 23 performance reports tested, 12 were either not submitted timely or documentation was not available to substantiate when the report was submitted. Of 9 special reports tested, 6 were either not submitted timely or documentation was not available to substantiate when the report was submitted. Cause and possible asserted effect: The Health System does not have an effective process and control to ensure timely submission of required reports per the terms and conditions of federal awards and applicable regulations and retainage of evidence of control operation (i.e. evidence of report submission). Identification of questioned costs and how they were computed: None Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number: No. This finding was not a finding in the immediate prior year audit. Recommendations: We recommend that the Health System review and enhance its current procedures to ensure that all required reporting applicable to federal awards is accurately identified, submission deadlines are met, and documentation of submissions is properly retained. Views of responsible officals: Management acknowledges the audit finding regarding timely submission of reports and retaining documentation of submissions. We will implement a new combined monitoring and record retention internal control process for financial, performance, and special reporting requirements, to ensure timely submission and retention of supporting documentation for required sponsor reporting. This process will be implemented by December 31, 2025.

Finding No: 2024-001 Activities Allowed or Unallowed/Allowable Costs Federal Agency: U.S. Department of Health and Human Services Assistance Listing Number: 93.778 Program: Medicaid Assistance Program/Medicaid Cluster Award Years: January 1, 2024 – December 31, 2024 (a) Criteria or Requirement Per 2 CFR 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, the specific requirements for activities allowed or unallowed are unique to each federal program and are found in the federal statutes, regulations, and the terms and conditions of the federal award pertaining to the program. (b) Condition Found, Including Perspective For one of 40 payroll disbursements tested during the fiscal year 2024 reporting period there was one disbursement totaling $1,988 in which expenditure was approved, requested for reimbursement, and reimbursed by the federal agency, however, per the terms of the grant agreement this disbursement was not allowable. This disbursement was specifically related to a payroll code that was not frequently used by the System and a code typically removed from the reimbursement request before being submitted. (c) Possible Cause While the System performs a review of documentation before payments are requested for reimbursement, controls were not designed or implemented effectively to ensure that unallowable payroll charges were not submitted for reimbursement by the federal agency. (d) Questioned Cost No questioned costs as amounts did not exceed the threshold for reporting. (e) Effect Federal funds were expended for unallowable amounts and evidence of the effective operation of management review controls was not consistently maintained in accordance with Federal requirements. (f) Statistical Validity The sample was not intended to be, and was not, a statistically valid sample. (g) Repeat Finding in the Prior Year This finding is not a repeat finding. (h) Recommendation We recommend that the System strengthen controls over the management review process to prevent unallowable costs from being charged to Federal programs. (i) View of Responsible Officials Management concurs with the finding. While appropriate controls exist relative to management review of expenditures, opportunities exist to retrain staff and further enhance controls related to procedures for submission, review, and approval of expenditures before submission for reimbursement.

Criteria The Uniform Guidance (2 CFR §200.303) requires non-federal entities to establish internal controls to ensure compliance with federal statutes, regulations, and the terms and conditions of federal awards. In addition, federal guidelines require the Organization to supervise the conduct of its volunteers, business partners, contractors and others aiding in administering its federal programs. Condition Internal controls over the SBRL program do not adequately regulate outcomes to grant recipients or provide sufficient disclosure of the Small Business Resiliency Loan program costs, benefits and requirements for participants. • The structure and terms of the grant program are confusing and there is no evidence the loan terms, associated costs and grant benefits were consistently communicated to borrowers. • Loan applications, underwriting materials and borrower training about program features, costs and benefits are decentralized across multiple Small Business Resource Networks (SBRNs), resulting in inconsistent loan and grant application submissions. • Borrowers with equal loan amounts received varying repayment terms, with some receiving longer terms and additional grant income without clear disclosure or equitable access. • Grant recipients were not clearly or consistently informed of the federal income tax consequences resulting from distributions out of the Collateral Account, which was established by the Benefit Distribution Agreement, when such distributions were used to cover missed loan payments and the end-of-loan term distributions. •There is no evidence these disparities were sufficiently explained to borrowers, leading to potential unequal treatment and potential financial harm. Cause The entity lacks standardized procedures for loan term disclosures, centralized underwriting protocols, and consistent communication of borrower grant benefits and federal income tax implications. There is insufficient oversight to ensure equitable treatment and transparency across SBRNs. Effect • Grant recipients may have been misled or disadvantaged due to unclear or unequal loan terms. • Grant funds may have been inequitably distributed, raising concerns about questioned costs and compliance with federal award conditions. Questioned Costs Estimated questioned costs include: • Loan disbursements with varying repayment terms: $4,755,500. Recommendation • Implement standardized loan application and cash flow analysis used to make underwritingdecisions and disclosures across all SBRNs. • Centralize or harmonize program training for SBRN and program administrators to ensureconsistent borrower treatment. • Clearly communicate eligibility for extended repayment terms and grant income Views of Responsible Officials Based on feedback and information available to the GoWest Foundation, the Foundation believes that the structure and terms of the grant program were less confusing to participants who spent time discussing it with the SBRN organizations than to an outside observer without the benefit of such contact. SBRN organizations were provided with uniform training materials and resources and each borrower completed the same application. The program had two primary objectives: 1) provide financial assistance to businesses treated as suffering disproportionate impacts from the pandemic (based on criteria established by the SLFRF program); and 2) help those businesses build or enhance their creditworthiness and their ability to navigate relationships with commercial lenders. The Foundation’s contact with borrowers and feedback from SBRN organizations reveals that a number of participants had a background of avoiding use of credit and suspicion of the financial services industry. Many of those participants self-limited their participation accordingly. In addition, different businesses experienced differing impacts from the pandemic and differing needs for assistance. GoWest worked diligently with the SBRN organizations to be sure that applicants received benefits consistent with their need and with the program terms. It may be that processes and procedures may not have been documented sufficiently to provide assurance to auditors. Similarly, individual case files may not have adequately reflected all of the supporting information that explained differences in levels of participation. However, the Foundation does not believe that these deficiencies had a material impact on equitable distribution of funds or on achievement of the desired results.

Criteria Under the American Rescue Plan Act of 2021, as implemented by the U.S. Department of the Treasury through 31 CFR Part 35 and the 2022 Final Rule, SLFRF recipients must establish and maintain effective internal controls to ensure that funds are used for eligible purposes and that eligibility determinations are based on substantiated, risk-mitigated criteria. The 2024 SLFRF Compliance Supplement designates the program as “higher risk,” requiring enhanced scrutiny of eligibility and fraud prevention measures. Condition The program relied extensively on self-attestation by applicants as the standard method of verifying eligibility, without requiring supporting documentation or conducting verification procedures. These practices were applied broadly and not limited to exceptional cases. Cause Program administrators adopted simplified eligibility procedures including approved use of geographic indicators such as zip codes to expedite benefit delivery. However, they did not implement compensating controls or verification mechanisms to mitigate the increased risk of fraud and ineligible payments associated with self-attestation and geographic proxies. Effect The use of self-attestation as primary eligibility tools may result in: • Ineligible recipients receiving benefits. • Disparate treatment of similarly situated individuals outside designated ZIP codes. • Increased fraud risk, particularly in a program already designated as high-risk. • Noncompliance with federal eligibility and internal control requirements under Uniform Guidance (2 CFR §200.303 and §200.518). Questioned Costs Estimated questioned costs include: • One Hundred Twenty-Six loan disbursements and grant awards using self-attestation eligibility criteria: $1,983,326. Recommendation The entity should: 1. Reassess eligibility criteria to ensure they are substantiated, equitable, and compliant with federal requirements. 2. Limit self-attestation to exceptional cases and implement verification procedures for all standard applications. 3. Strengthen internal controls to detect and prevent fraud, including random audits, third-party verification, and data cross-checks. 4. Document eligibility determinations and maintain records to support compliance with SLFRF rules and audit standards. Views of Responsible Officials The Foundation recognizes that self-attestation regarding impact of the Covid pandemic carries some fraud risk. The self-attestation process was developed as directed by the Washington Department of Commerce (the state recipient that contracted with the Foundation) to permit businesses not located in a geographic area that was presumptively disproportionately affected by the pandemic to participate in the program. Participants were required to explain the pandemic impact that they suffered in sufficient detail as to allow verification. The process attempted to balance fraud prevention against the desire to streamline qualification and reduce barriers to participation. The Foundation recognizes that documentation of the evidence of pandemic related impacts for self-attestation borrowers could be better.

Finding 2024-001 – N: Special Tests and Provisions Information on the Federal Program: Grantor: United States Department of Health and Human Services Program Name: Health Centers Cluster Assistance Listing Numbers: 93.224 – Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care); 93.527 – Grants for New and Expanded Services under the Health Center Program Criteria or Specific Requirement: Title 2 U.S. Code of Federal Regulations (CFR), Part 200.303 of the Uniform Guidance states the following regarding internal control, “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Per 42 CFR sections 51c.303(e), (f), and (g) and 42 CFR sections 56.303(e), (f), and (g), health centers must prepare and apply a sliding fee discount schedule (SFDS) so that the amounts owed for health center services by eligible patients are adjusted (discounted) based on the patient’s ability to pay as defined by these subsections. Condition: Montefiore Health System, Inc. (the Health System) has an established policy for the Bronx Health Collective that includes a SFDS that complies with federal regulations. Per the policy, eligibility for application of the SFDS should be evaluated once a year. In our review of a sample of financial records for patients treated during the audit period, it was noted that for 14 out of 40 patient files selected for review, the Health System was unable to demonstrate that internal controls were operating effectively to ensure proper application of the Health System’s policy relating to the SFDS. Specifically, documentation supporting the application of the SFDS was not obtained within a year of the visit in line with the Health System’s policy. Cause: The deficiency appears to be due to inconsistent documentation and monitoring practices in the patient intake process. Effect or Potential Effect: Without adequate documentation and effective internal controls, the auditee may improperly apply its SFDS policy. This could result in eligible patients being incorrectly charged for services, which may limit access to care and jeopardize compliance with program requirements. Questioned Costs: Not applicable. Context: As part of our control testing over the compliance requirement, we reviewed a random sample of 40 patient financial records to assess the application of the Health System’s SFDS policy. The sample was designed to provide sufficient coverage of the population and identify potential control deficiencies. In 14 of the 40 patient files selected for review, the Health System was unable to demonstrate that internal controls were operating effectively to ensure proper application of the Health System’s policy relating to the SFDS. Specifically, documentation supporting the application of the SFDS was not obtained or tracked within the patient’s electronic medical record within a year of the visit in line with the Health System’s policy. In each of the instances where documentation was not available, there were no out-of-pocket costs charged to the patient. Identification as a repeat finding: This finding is not a repeat finding from the prior year. Recommendation: The Health System should improve its process by implementing standardized procedures for documenting income and family size, conducting regular staff training on eligibility determination and documentation requirements, and performing periodic internal reviews to ensure compliance with the SFDS policy including retention of evidence supporting the performance of the control. View of responsible officials: Management concurred with the audit finding and implemented standardized procedures to enhance screening and enrollment of patients. Additional controls are in place to ensure timely documentation of income and family size. In order to ensure compliance with the SFDS policy including documentation and retention, a policy was adopted requiring reviews on the day before visit, during visit and day after visit, as well as periodic retrospective reviews. There will be regular staff training on eligibility, determination and documentation requirements.

2024-001: Significant Deficiency Over Compliance with Procurement and Suspension and Debarment Federal Program: Highway Planning and Construction and Coronavirus State and Local Fiscal Recovery Funds Federal Assistance Listing Number(s): 20.205 and 21.027 Federal Agency: U.S. Department of Transportation and U.S. Department of Treasury Pass-through Entity: Colorado Department of Transportation (20.205 only) Criteria: 2 CFR 200.319 states that all procurement transactions under the Federal award must be conducted in a manner that provides full and open competition and is consistent with Federal procurement standards. 2 CFR 200.214 states in part that recipients and subrecipients are subject to the nonprocurement debarment and suspension regulations. In addition, 2 CFR 200.303 in part states that a recipient of a Federal award must establish, document, and maintain effective internal control over the Federal award. Condition: We have selected and tested vendors for suspension and debarment with expenditures in excess of $25,000 for the Bridge CR-397 and EMS projects for compliance with suspension and debarment. We identified that two vendors were not properly verified for suspension and debarment prior to the contract execution date. Cause: Internal controls over suspension and debarment were properly designed but not operating effectively to verify that all vendors are in compliance with suspension and debarment. Effect: Our testing identified that the County’s internal controls over compliance with suspension and debarment are not operating effectively, which may cause the County to be out of compliance with Federal and grant requirements. Repeat Finding: No. Recommendation: We recommend that the County re-evaluate the design of internal controls over suspension and debarment to be in compliance with the Federal requirements and the County’s procurement policy/procedures.

2024-003: Material Weakness Over Internal Controls with the Schedule Expenditures of Federal Awards Federal Program: Local Assistance and Tribal Consistency Fund and Coronavirus State and Local Fiscal Recovery Funds Federal Assistance Listing Number(s): 21.032 and 21.027 Federal Agency: U.S. Department of Transportation and U.S. Department of Treasury Pass-through Entity: Colorado Department of Transportation (20.205 only) Criteria: 2 CFR 200.508 states that the auditee must prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the auditee’s financial statements. In addition, 2 CFR 200.303 in part states that a recipient of a Federal award must establish, document, and maintain effective internal control over the Federal awards. Condition: The expenditure amounts related to the 21.032 and 21.027 federal programs provided for the SEFA were materially misstated compared to the County’s accounting records. The County provides information to the auditors to assist with the preparation of the financial statements and the schedule of expenditure of federal awards. However, the information provided to the auditors for the SEFA did not match the information in the accounting records. Therefore, the County had material misstatements and prior year corrections (restatements) related to grants and federal awards. Cause: Lack of internal controls over financial reporting of the SEFA and federal expenditures.. Effect: This caused material audit adjustments to the financial statements and the significant corrections to the SEFA and potential for unidentified misstatements and lack of reporting of Federal awards on the SEFA. Repeat Finding: No. Recommendation: We recommend that the County establish internal controls over grants management and SEFA preparation processes during that year to make sure that the Federal expenditures are properly reflected on the information used to prepare the SEFA and match the accounting records.

Reference Number: 2024-003 Prior Year Finding: No Federal Agency: U.S Department of Housing and Urban Development Federal Program: Community Development Block Grants Assistance Listing Number: 14.218 Award Number: B-19-UC-42-0001, B-20-UC-42-0001, B-21-UC-42-0001, B-22-UC-42-0001, B-23-UC-42-0001, B-24-UW-42-0001 Compliance Requirement: Program Income Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Condition The County did not timely and accurately report program income received which caused the County’s reporting to HUD to be inaccurate. Criteria or specific requirement Compliance: CFR 570.504(a) states that the receipt and expenditure of program income as defined in §570.500(a) shall be recorded as part of the financial transactions of the grant program. Additionally, CFR 570.504(b)(2)(ii)) requires that program income be disbursed for eligible activities before additional funds are drawn from the U.S. Treasury account. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions the Federal award. These internal controls should comply with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Context Program income reported on Line 05 of the PR 26 report was $787,553, an additional $131,863 was collected in fiscal year 2024 but not reported. Cause Amounts received by the County were not identified timely. Effect The amount reported by the County to HUD related to program income was inaccurate. Questioned Costs Management indicated that $131,863 of collections in fiscal year 2024 was omitted from the PR 26 report. Recommendation We recommend that management identify its collections related to program income in a timely manner, modify its draw request appropriately, and report the accurate amounts to HUD. Views of responsible officials and planned corrective actions The county will continue to report the correct amount of program income to HUD. Receipts will be entered more timely.

Reference Number: 2024-004 Prior Year Finding: No Federal Agency: U.S Department of Housing and Urban Development Federal Program: Community Development Block Grants Assistance Listing Number: 14.218 Award Number: B-19-UC-42-0001, B-20-UC-42-0001, B-21-UC-42-0001, B-22-UC-42-0001, B-23-UC-42-0001, B-24-UW-42-0001 Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Condition The County could not report the prime awards within the required timeframes for its first-tier subawards of $30,000 or more. Criteria or specific requirement Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA) And Title 2 U.S. Code of Federal Regulations (CFR) Part 170 Appendix A, prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. As of March 8th 2025, FSRS.gov was retired, and all subaward reporting data and functionality are now on SAM.gov. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions the Federal award. These internal controls should comply with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Context The seven subawards selected for testing were not reported in FSRS or SAM.gov by the end of the month following the month in which the amounts were awarded. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause The County’s controls were not operating effectively to ensure the reporting was performed in accordance with federal requirements. Effect Subawards were not reported to FSRS or SAM.gov in accordance with FFATA requirements. Questioned Costs None noted. Recommendation We recommend that the County develop internal controls and procedures to ensure that FFATA reporting requirements are met and ensure that all required subawards are reported accurately and timely to FSRS or SAM.gov. Views of responsible officials and planned corrective actions All of the County’s 2024 grants have been entered into FFATA and our 2025 grants and going forward will be entered when awarded.

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S Department of Justice Federal Program: Congressionally Recommended Awards Assistance Listing Number: 16.753 Award Number: 15PBJA-23-GG-00920-BRND Compliance Requirement: Cash Management Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Condition The County received reimbursement for the total grant award amount prior to incurring expenditures. Criteria or specific requirement Compliance: Per 2 CFR section 200.305(b) For recipients and subrecipients other than States, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions the Federal award. These internal controls should comply with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Context The County received $2.5 million on July 1, 2024, for the grant, as of that date the general ledger reported no expenditures. The County incurred expenditures of $274,235 in October, $62,247 in November, and $2,160,518 in December. Cause The County’s controls were not operating effectively to ensure reimbursement request were performed in accordance with federal requirements. Effect The County had to return funding of $1,367,790 in November, which was subsequently drawn in December when expenditures were incurred. Questioned Costs None noted. Recommendation We recommend that the County develop internal controls and procedures to ensure drawdowns are performed in a manner to minimize the time between drawing and disbursing federal funds Views of responsible officials and planned corrective actions Fiscal Clerk has been trained on proper drawdown of grant funds and accurate recording of expenditures.

Criteria According to 2 CFR 200.303, non-federal entities receiving federal awards must establish and maintain internal controls over federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition During the testing there were two applications that did not include proof of review prior to the notice of eligibility being granted. Cause The primary cause of the errors identified was lack of administrative oversight and a lack of effective control activities such as effective review procedures and monitoring. Effect The Organization granted notices of eligibility to individuals without the required supporting documentation and/or proper approval. Questioned Costs Not applicable Context After an eligibility application is completed, it is given to a case manager for review. Prior to eligibility being granted, the case manager is supposed to sign that they have reviewed the eligibility application. Out of the sample of 40 files tested, two applications did not include proof of review prior to the notice of eligibility being granted. Recommendation We recommend the client implement controls to ensure all eligibility documentation is obtained and properly reviewed before granting eligibility. This includes providing regular staff training and conducting periodic internal audits to ensure compliance. Views of Responsible Officials See accompanying corrective action plan.

Finding No. 2024-001 – Cash Management | Identification of the Program: | Program Name: Research and Development Cluster: Basic Scientific Research, Department of Defense Awarding Office, 12.431; NSF Technology, Innovation and Partnerships, National Science Foundation, 47.084 | Criteria or Specific Requirements (Including Statutory, Regulatory, or Other Citations): 2 CFR 200.303 requires that a non-Federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” According to page 3-C-5 of the 2024 OMB Compliance Supplement, expenses must be incurred before submitting a reimbursement request (2 CFR § 200.305(b)(3)). | Condition: During our testing of 2024 reimbursement requests (totaling $536,272), we noted that there was no evidence of review and approval of the requests to indicate whether the reviewer determined that expenditures submitted for reimbursement had been incurred prior to the request for reimbursement. Management has indicated this review does, in fact, take place, however, there is no evidence (i.e., sign off) on the request to indicate that the review had occurred. | Section III— Federal Award Findings and Questioned Costs (continued) | Cause: Internal controls over the review and approval of the reimbursement requests were not effective. | Effect or Potential Effect: This could result in reimbursement for expenditures that have not been incurred and paid prior to reimbursement being requested. | Questioned Costs: None. | Context: As the sample size is small, we selected 10 cash disbursements for testing. There was no evidence of approval for all 10 reimbursement requests. | Identification as a Repeat Finding: N/A – This is a first year Uniform Guidance audit. | Recommendation: Management should strengthen its internal controls over cash management related to reimbursement requests by having the reviewer sign off on the reimbursement request to support that the review had occurred. | View of Responsible Officials: Management concurs with the findings and has developed a corrective action plan to address this finding.

Finding No. 2024-002 – Subrecipient Monitoring | Identification of the Program: | Program Name: Research and Development Cluster: Basic Scientific Research, Department of Defense Awarding Office, 12.431; NSF Technology, Innovation and Partnerships, National Science Foundation, 47.084 | Criteria or Specific Requirements (Including Statutory, Regulatory, or Other Citations): 2 CFR 200.303 requires that a non-Federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” According to page 3-M-1 of the 2024 OMB Compliance Supplement, management is responsible for monitoring activities designed to evaluate subrecipient risk as required by the terms and conditions of the award. Such activities include: reviewing financial reports; following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies detected through audits, on-site reviews, and other; issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. | Section III— Federal Award Findings and Questioned Costs (continued) | Condition: During our testing of 2024 subrecipient monitoring activities, we selected five subrecipients for testing noting that there was no evidence of management’s evaluation of each subrecipient or management’s review of the specific monitoring procedures performed. Through inquiry, management acknowledged that they complete an evaluation form for each subrecipient prior to contracting with the subrecipient although an evaluation of the risk of the subrecipient is not included on the form. Management also informed us that they review all expenditures and related supporting documentation provided by the subrecipient prior to paying their invoices, although evidence of performing such a review is not documented. | Cause: Internal controls over the review and approval of the subrecipient monitoring were not effective. | Effect or Potential Effect: This could result in granting subawards to and paying subrecipients who are of higher risk for compliance and/or subrecipients who have not been properly monitored to ensure they are complying with the grant terms. | Questioned Costs: None. | Context: As the sample size is small, we selected 5 subrecipients for testing out of a total of 5 subrecipients. | Identification as a Repeat Finding: N/A – This is a first year Uniform Guidance audit.

FINDING 2024-003 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Reporting Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY 2024 Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-004. Condition and Context The County had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties that would likely be effective in preventing, or detecting and correcting, noncompliance. Recipients are required to submit quarterly or annually Project and Expenditure (P&E) reports to the U.S. Department of the Treasury (Treasury). The reporting periods, as well as the respective due dates, are based on the type of recipient and the recipient's population, as well as the recipient's allocation amount. Information to be reported includes projects funded, expenditures, and contracts for the appropriate reporting period. The County was classified as a county with a population below 250,000 residents that received an allocation of less than $10 million in COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF). As such, the P&E report, covering the period from April 1, 2023 to March 31, 2024, was required to be submitted to the Treasury by April 30, 2024. INDIANA STATE BOARD OF ACCOUNTS 18 MIAMI COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) The County submitted one P&E report during the audit period, which was obtained from the Treasury's website. Although one employee prepared the P&E report and another reviewed the entries, the system of internal controls was not effective in preventing, or detecting and correcting, errors. The information submitted included amounts based on the incorrect period, amounts that should have been omitted, and amounts which were based on budgeted amounts instead of actual amounts, as such, the reports were not fairly presented. Errors identified included the following:  Total Cumulative Obligations were overstated by $2,077,147.  Total Current Obligations were overstated by $245,909. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Compliance and Reporting Guidance, State and Local Fiscal Recovery Funds, page 13, states in part: ". . . 10. Reporting. All recipients of federal funds must complete financial, performance, and compliance reporting as required and outlined in Part 2 of this guidance. Expenditures may be reported on a cash or accrual basis, as long as the methodology is disclosed and consistently applied. Reporting must be consistent with the definition of expenditures pursuant to 2 CFR 200.1. Your organization should appropriately maintain accounting records for compiling and reporting accurate, compliant financial data, in accordance with appropriate accounting standards and principles. . . ." 31 CFR 35.4(c) states in part: "Reporting and requests for other information. During the period of performance, recipients shall provide to the Secretary . . . periodic reports providing detailed accounting of the uses of funds . . ." Cause Although a system of internal controls over the P&E report was designed by management, which included segregation of duties, it was not documented, and it did not ensure that the County provided the Treasury with complete and accurate information related to the SLFRF awards. The officials were new and not familiar with the reporting requirements. INDIANA STATE BOARD OF ACCOUNTS 19 MIAMI COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As such, the County did not accurately report when filing the P&E report for the period April 1, 2023 to March 31, 2024. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the County. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County design and implement a proper system of internal controls that would ensure appropriate reviews, approvals and oversight are taking place. Additionally, management should develop policies and procedures to ensure that the County provides the Treasury with complete and accurate information for the P&E report. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Program: Continuum of Care Federal Financial Assistance Listing No.: 14.267 Federal Agency: U.S. Department of Housing and Urban Development Pass-through: Sacramento Steps Forward Award Year: 2024 Compliance Requirement: Procurement, Suspension and Debarment Grant Award Number: CA0955L9T032209, CA0955L9T032310, CA0143L9T032215, CA0143L9T032316, CA1303L9T032208, CA1303L9T032309 Type of Finding: Significant Deficiency in Internal Controls Over Compliance Criteria: 2 CFR 200.303(a) of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The nonfederal entity’s documented procurement procedures must conform to the procurement standards identified in 2 CFR 200.317 through 200.327. 2 CFR 200 Appendix II requires certain provisions be included in contracts if criteria are met. Condition: The Organization’s documented procurement policy does not incorporate several required elements outlined in 2 CFR §§200.317 through 200.327. Missing elements include, but are not limited to: • Defined procurement methods and thresholds (e.g., micro-purchase, sealed bids), • Procedures to ensure full and open competition, • Requirements for cost or price analysis for purchases above the simplified acquisition threshold, • Affirmative steps to use small and minority businesses and women’s business enterprises, • Procedures for contract administration and oversight, • Inclusion of required contract provisions as listed in Appendix II to 2 CFR Part 200, • Standards of conduct covering conflicts of interest for employees involved in the selection, award, and administration of contracts. Cause: The Organization’s procurement policy has not been updated to reflect the detailed procurement standards required under the Uniform Guidance. Effect: An incomplete procurement policy may lead to inconsistent practices and increase the risk of noncompliance with federal procurement requirements, potentially affecting the allowability and documentation of costs charged to federal awards. Questioned Costs: No questioned costs were identified as a result of our procedures. Context: This finding was identified during testing of the Organization’s procurement policy under the Continuum of Care Program. Repeat Finding from Prior Year: Partial repeat of Finding 2023-003. The prior finding included both procurement policy deficiencies and lack of suspension and debarment documentation. The current year finding relates only to the procurement policy. Recommendation: We recommend that management revise the Organization’s procurement policy to incorporate all required elements outlined in 2 CFR §§200.317 through 200.327, including definitions of procurement methods, competitive requirements, cost/price analysis, contract provisions, and oversight responsibilities. Views of Responsible Officials: Management agrees. See separately issued Corrective Action Plan.

Program: Temporary Assistance for Needy Families Assistance Listing No.: 93.558 Federal Grantor: U.S. Department of Health and Human Services Passed-through: County of Sacramento Award No. and Year: DHA-PRTS-NM-07-25-A1; FY 2024 Compliance Requirement: Other - Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) §200.510(b) - Schedule of Expenditures of Federal Awards Type of Finding: Material Weakness in Internal Control Over Compliance Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) §200.510(b) states that the auditee (the Organization) must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee’s financial statements, which must include the total federal awards expended (including amounts provided to subrecipients) as determined in accordance with §200.502. In addition, section 200.303 of the Uniform Guidance state that that recipients and subrecipients must establish effective internal control over the federal awards, including controls over the accuracy of program information and expenditure amounts. Condition: During our audit procedures performed over the SEFA and expenditures reported for the Temporary Assistance for Needy Families program we noted the Organization overstated expenditures totaling $138,217. The December 31, 2024 SEFA was corrected for this reporting error. Cause: The Organization did not have adequate internal controls to ensure the Schedule was prepared completely and accurately. Effect: Prior to the correction, expenditures for the Temporary Assistance for Needy Families program were overstated by $138,217. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: No sampling was used. Repeat Finding from Prior Years: No. Recommendation: We the recommend the Organization enhance internal controls to ensure federal expenditures are reported accurately and completely on the SEFA in accordance with the Uniform Guidance. Views of Responsible Officials: Management agrees. See separately issued Corrective Action Plan.

FINDING 2024-003 Subject: Water and Waste Disposal Systems for Rural Communities - Procurement Federal Agency: Department of Agriculture Federal Program: Water and Waste Disposal Systems for Rural Communities Assistance Listings Number: 10.760 Federal Award Numbers and Years (or Other Identifying Numbers): 92-02, 92-03, 92-04, 92-05 Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Other Matters Condition and Context As part of sound management of the federal award, the City was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The City had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. Federal regulations allow for informal procurement methods when the value of the procurement for property or services does not exceed the simplified acquisition threshold, which is set at $250,000 unless a lower, more restrictive threshold is set by a nonfederal entity. The State of Indiana has established a more restrictive threshold of $150,000 for informal procurement methods. This informal process allows for methods other than the formal bid process. The informal process is divided between two methods based on thresholds: micro-purchases, typically for those purchases $10,000 or under, and small purchase procedures for those purchases above the micro-purchase threshold, but below the simplified acquisition threshold. Small purchase procedures require that price or rate quotations must be obtained from an adequate number of qualified sources or documented reasoning to support a single source provider. Two vendors were identified that were paid $10,500 and $59,408, respectively, during the audit period using federal funds under the award, thereby requiring small purchase procedures for both procurements. Both vendors were selected for testing. The City was unable to provide any documentation for either vendor that the procurement method used was appropriate or that the procurement provided full and open competition or rationale to support the determination to limit competition. Additionally, the history of the procurement, including the rationale for the method of procurement, selection of the vendor, and the basis for the price, was not adequately documented for either vendor. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.318 states in part: "(a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non-Federal entity's documented procurement procedures must conform to the procurement standards identified in §§ 200.317 through 200.327. . . . (i) The non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. . . ." 2 CFR 200.320 states in part: "The non-Federal entity must have and use document procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award. (a) Informal procurement methods. When the value of the procurement for property or services under a Federal award does not exceed the simplified acquisition threshold (SAT), as defined in § 200.1, or a lower threshold established by a non-Federal entity, formal procurement methods are not required. The non-Federal entity may use informal procurement methods to expedite the completion of its transactions and minimize the associated administrative burden and cost. The informal methods used for procurement of property or services at or below the SAT include: . . . (2) Small purchases- (i) Small purchase procedures. The acquisition of property or services, the aggregate dollar amount of which is higher than the micro-purchase threshold but does not exceed the simplified acquisition threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources as determined appropriate by the non-Federal entity. . . . (c) Noncompetitive procurement. There are specific circumstances in which noncompetitive procurement can be used. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section); (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate." Cause The vendors in question had been utilized by the City for various services over the course of multiple years, including for several years under this award with the ongoing multi-year project. For continuity purposes, the City chose to limit competition when procuring the services. The City included the requirements for limiting competition in its purchasing policy but did not follow the established policy. Effect Without a proper system of internal controls in place that operated effectively, noncompliance remained undetected. As a result, proper procurement procedures were not adhered to for all vendors. Without following the required methods for procurement, the City could be overpaying for services by not receiving the most competitive pricing. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the City. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the City's management establish a proper system of internal controls to ensure expenditures made from federal awards use the appropriate procurement method and retain the documentation to support the procurement methods used in order to ensure compliance with the terms and conditions of the federal award. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Water and Waste Disposal Systems for Rural Communities - Reporting Federal Agency: Department of Agriculture Federal Program: Water and Waste Disposal Systems for Rural Communities Assistance Listings Number: 10.760 Federal Award Numbers and Years (or Other Identifying Numbers): 92-02, 92-03, 92-04, 92-05 Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion Condition and Context As part of sound management of the federal award, the City was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The City had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. The City was required to submit two annual data reports to the Department of Agriculture. The Statement of Budget, Income and Equity (Form RD 442-2) report data to be submitted included, but was not limited to, current income and expenditures and budgeted amounts. The Balance Sheet (Form RD 442-3) report data to be submitted included, but was not limited to, current year assets and liabilities. Per the USDA Rural Utilities Service Borrower's Guide, both reports also required inclusion of comparative information for the prior year. Both reports were selected for testing. We were unable to trace either report to the City's records, nor could we verify the accuracy and completeness of either report. The following errors were identified: • The Form RD 442-2, which covered calendar year 2023, reported total income and expenses of $3,792,018 and $1,615,582, respectively. However, the City's ledger for the same period had total income and expenses of $3,985,851 and $3,740,788, respectively. This resulted in net income being overstated by $2,319,039. Additionally, only one amount was reported as comparative data for prior year activity. We were unable to determine what this amount represented and were unable to verify it to the prior period report or to the City's records. • The Form RD 442-3, which covered calendar year 2023, reported total assets and liabilities of $18,229,653 and $10,503,419, respectively. However, the City's records for the same period had total assets and liabilities of $39,216,648 and $12,758498, respectively. Additionally, no comparative amounts from the prior year were reported. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 7 CFR 1780.47 states in part: "(a) Borrowers are required to provide RUS an annual audit or financial statements. . . . (e) Borrowers exempt from audits. All borrowers who are exempt from audits, will, within 60 days following the end of each fiscal year, furnish the RUS with annual financial statements, consisting of a verification of the organization's balance sheet and statement of income and expense by an appropriate official of the organization. Forms RD 442-2, 'Statement of Budget, Income and Equity,' and 442-3 may be used. (f) Management reports. These reports will furnish management with a means of evaluating prior decisions and serve as a basis for planning future operations and financial strategies. In those cases where revenues from multiple sources are pledged as security for an RUS loan, two reports will be required; one for the project being financed by RUS and one combining the entire operation of the borrower. In those cases where RUS loans are secured by general obligation bonds or assessments and the borrower combines revenues from all sources, one management report combining all such revenues is acceptable. The following management data will be submitted by the borrower to the processing office. These reports at a minimum will include a balance sheet and income and expense statement. . . . (2) Annual management reports. Prior to the beginning of each fiscal year the following will be submitted to the processing office. (If Form RD 442-2 is used as the annual management report, enter data in column three only of Schedule 1, and complete all of Schedule 2.) • The Form RD 442-3, which covered calendar year 2023, reported total assets and liabilities of $18,229,653 and $10,503,419, respectively. However, the City's records for the same period had total assets and liabilities of $39,216,648 and $12,758498, respectively. Additionally, no comparative amounts from the prior year were reported. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 7 CFR 1780.47 states in part: "(a) Borrowers are required to provide RUS an annual audit or financial statements. . . . (e) Borrowers exempt from audits. All borrowers who are exempt from audits, will, within 60 days following the end of each fiscal year, furnish the RUS with annual financial statements, consisting of a verification of the organization's balance sheet and statement of income and expense by an appropriate official of the organization. Forms RD 442-2, 'Statement of Budget, Income and Equity,' and 442-3 may be used. (f) Management reports. These reports will furnish management with a means of evaluating prior decisions and serve as a basis for planning future operations and financial strategies. In those cases where revenues from multiple sources are pledged as security for an RUS loan, two reports will be required; one for the project being financed by RUS and one combining the entire operation of the borrower. In those cases where RUS loans are secured by general obligation bonds or assessments and the borrower combines revenues from all sources, one management report combining all such revenues is acceptable. The following management data will be submitted by the borrower to the processing office. These reports at a minimum will include a balance sheet and income and expense statement. . . . (2) Annual management reports. Prior to the beginning of each fiscal year the following will be submitted to the processing office. (If Form RD 442-2 is used as the annual management report, enter data in column three only of Schedule 1, and complete all of Schedule 2.)• The Form RD 442-3, which covered calendar year 2023, reported total assets and liabilities of $18,229,653 and $10,503,419, respectively. However, the City's records for the same period had total assets and liabilities of $39,216,648 and $12,758498, respectively. Additionally, no comparative amounts from the prior year were reported. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 7 CFR 1780.47 states in part: "(a) Borrowers are required to provide RUS an annual audit or financial statements. . . . (e) Borrowers exempt from audits. All borrowers who are exempt from audits, will, within 60 days following the end of each fiscal year, furnish the RUS with annual financial statements, consisting of a verification of the organization's balance sheet and statement of income and expense by an appropriate official of the organization. Forms RD 442-2, 'Statement of Budget, Income and Equity,' and 442-3 may be used. (f) Management reports. These reports will furnish management with a means of evaluating prior decisions and serve as a basis for planning future operations and financial strategies. In those cases where revenues from multiple sources are pledged as security for an RUS loan, two reports will be required; one for the project being financed by RUS and one combining the entire operation of the borrower. In those cases where RUS loans are secured by general obligation bonds or assessments and the borrower combines revenues from all sources, one management report combining all such revenues is acceptable. The following management data will be submitted by the borrower to the processing office. These reports at a minimum will include a balance sheet and income and expense statement. . . . (2) Annual management reports. Prior to the beginning of each fiscal year the following will be submitted to the processing office. (If Form RD 442-2 is used as the annual management report, enter data in column three only of Schedule 1, and complete all of Schedule 2.) (i) Two copies of the management reports and proposed 'Annual Budget'. (ii) Financial information may be reported on Form RD 442-2 which includes Schedule 1, 'Statement of Budget, Income and Equity' and Schedule 2, 'Projected Cash Flow' or information in similar format. (iii) A copy of the rate schedule in effect at the time of submission. . . ." Cause The Clerk-Treasurer had served in the position for less than two years when the reports for 2024 were due and was inexperienced with the reporting requirements of the award. As a result, the Clerk-Treasurer did not properly prepare the reports. Additionally, the Clerk-Treasurer was solely responsible for preparing and submitting the reports with no oversight, review, or approval process that would have allowed for prevention, or detection and correction, of the noncompliance. Effect Without a proper system of internal controls in place that operated effectively, the City did not file an accurate and complete report for either annual report required under the federal award. As a result, material noncompliance occurred and remained undetected. By not reporting the comparative data, all information needed to determine the financial status of the City was not readily available. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the City. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the City's management establish a proper system of internal controls and develop and implement reporting policies and procedures to ensure that all required reports are filed timely, accurately, and contain all the required information. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-005 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Suspension and Debarment Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): 2024 Compliance Requirement: Procurement and Suspension and Debarment Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2023-002. Condition and Context As part of sound management of the federal award, the City was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The City had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. Prior to entering into subawards or covered transactions with COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF) award funds, recipients are required to verify that vendors or subrecipients are not suspended, debarred, or otherwise excluded from receiving federal funds. "Covered transactions" include, but are not limited to, contracts for goods and services awarded under a nonprocurement transaction (i.e., grant agreement) that are expected to equal or exceed $25,000. The verification can be done by checking the Excluded Parties List System (EPLS), collecting a certification from that person, or adding a clause or condition to the covered transaction with that person. Four covered transactions exceeding $25,000 for goods or services that were paid using SLFRF funds were identified during the audit period and two of them were selected for testing. The City did not verify the vendor's suspension and debarment status prior to entering into the covered transaction with either vendor. The amount paid to both vendors totaled $785,268. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 31 CFR 19.300 states: "When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you do business is not excluded or disqualified. You do this by: (a) Checking the EPLS; or (b) Collecting a certification from that person if allowed by this rule; or (c) Adding a clause or condition to the covered transaction with that person." Cause The City had conducted business with the two vendors in question in prior years, and due to the existing business relationship, opted to utilize both vendors for projects using federal funds under the award. The City included the various methods for verifying a vendor's suspension and debarment status in its purchasing policy but did not follow the established policy. Effect Without a proper system of internal controls in place that operated effectively, the City entered into covered transactions without verifying that the vendors were not suspended, debarred, or otherwise excluded from receiving federal funds. As a result, material noncompliance occurred and remained undetected. Noncompliance with the provisions of federal statues, regulations and the terms and conditions of the federal award could result in the loss of future federal funding to the City. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the City's management establish a proper system of internal control and follow the City's established purchasing policy to ensure procedures for entering into covered transactions are followed and to retain documentation of the verification of a vendor's suspension and debarment status. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-006 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Reporting Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): 2024 Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion Condition and Context As part of sound management of the federal award, the City was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The City had not properly designed or implemented such a system, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, noncompliance. The City was required to submit an annual Project and Expenditure (P&E) report to the U.S. Department of the Treasury. The P&E report data to be submitted included, but was not limited to, current period and total cumulative obligations and current period and total cumulative expenditures. We were unable to trace the annual P&E report to the City's records. The errors identified were as follows: • Total cumulative obligations were overstated by $23,337. • Total cumulative expenditures were understated by $171,136. • Current period expenditures were understated by $163,789. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 31 CFR 35.4(c) states in part: "Reporting and requests for other information. During the period of performance, recipients shall provide to the Secretary periodic reports providing detailed accounting of the uses of funds, . . ." Coronavirus State and Local Fiscal Recovery Funds Compliance and Reporting Guidance, page 10, states in part: ". . . 10. Reporting. All recipients of federal funds must complete financial, performance, and compliance reporting as required and outlined in Part 2 of this guidance. Expenditures may be reported on a cash or accrual basis, as long as the methodology is disclosed and consistently applied. Reporting must be consistent with the definition of expenditures pursuant to 2 CFR 200.1. Your organization should appropriately maintain accounting records for compiling and reporting accurate, compliant financial data, in accordance with appropriate accounting standards and principles. . . ." Cause The Clerk-Treasurer had served in the position for two years when the report for 2024 was due and was inexperienced with the reporting requirements of the award. As a result, the Clerk-Treasurer did not properly prepare the report. Additionally, the Clerk-Treasurer was solely responsible for preparing and submitting the report with no oversight, review, or approval process that would have allowed for prevention, or detection and correction, of the noncompliance. Effect Without a proper system of internal controls in place that operated effectively, the City did not file an accurate annual P&E report as required under the federal award. As a result, material noncompliance occurred and remained undetected. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the City. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the City's management establish a proper system of internal controls and develop and implement reporting policies and procedures to ensure that all required reports are complete and accurate when submitted. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

2024-006 Procurement and Suspension and Debarment Prior Year Finding Number: 2023-005 Year of Finding Origination: 2020 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Significant Deficiency and Other Matter Federal Agency: U.S. Department of the Treasury Program: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Award Number and Year: SLFRP3474, 2021 Pass-Through Agency: N/A – Federal Direct Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Federal requirements prohibit non-federal entities from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Title 2 U.S. Code of Federal Regulations § 180.300 describes a required verification process. Prior to entering into the transaction, one of the following must be performed: (1) checking SAM.gov exclusions, (2) collecting a certification, or (3) adding a clause or condition to the covered transaction with the contracting party. Condition: The County did not verify that vendors were not debarred, suspended, or otherwise excluded from participation in federal assistance programs or activities before entering into the covered transactions. Questioned Costs: None. Context: The County has revised its procurement policies to include components of federal procurement requirements related to suspension and debarment; these are pending review and approval by the Board of County Commissioners. The vendors paid with federal funds from this program were not listed as suspended or debarred on SAM.gov at the time of audit. Effect: Failure to verify vendors are not suspended, debarred, or otherwise excluded prior to entering into a covered transaction may result in the County entering into a transaction with a vendor that is not authorized to provide goods and services under the grant. Cause: The County’s written procurement policy does not include requirements specific to suspension and debarment. Recommendation: We recommend the County include the specific components of federal procurement requirements in its written procurement policies and procedures. View of Responsible Official: Concur

2024-007 Reporting Prior Year Finding Number: N/A Year of Finding Origination: 2024 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Material Weakness and Modified Opinion Federal Agency: U.S. Department of the Treasury Program: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Award Number and Year: SLFRP3474, 2021 Pass-Through Agency: N/A – Federal Direct Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 U.S. Code of Federal Regulations § 200.510(b) states that the auditee must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee’s financial statements which must include the total federal awards expended as determined in accordance with § 200.502, basis for determining federal awards expended. In addition, the U.S. Department of the Treasury requires recipients of funds to submit Project and Expenditure reports that include, by project, current period obligations, cumulative obligations, current period expenditures, and cumulative expenditures. The frequency of reporting is dependent on the size of the entity and amount of funding received. Condition: During 2024, McLeod County identified an additional $1,302,426 in COVID-19 – Coronavirus State and Local Fiscal Recovery Funds expenditures that were not included in the County’s original SEFA nor in the original population of expenditures provided for audit. In addition, expenditures documented in the County’s annual Project and Expenditure report through March 31, 2025, were understated by $1,515,400, and expenditures documented in the County’s annual Project and Expenditure report through March 31, 2024, were understated by $374,095. Questioned Costs: None. Context: The U.S. Department of the Treasury relies on accurate reporting of program costs to ensure grant funds are spent in accordance with program requirements. McLeod County is required to submit annual Project and Expenditure reports; the County submitted annual reports in both April 2024 and April 2025. Effect: Federal expenditures provided to the auditors were not fairly reported in the SEFA. In addition, the County did not accurately report expenditures on its Project and Expenditure reports as of March 31, 2025, and March 31, 2024. Cause: Due to human error, the County reported funds as obligated instead of expended because of additional projects that are ongoing. Recommendation: We recommend the County implement controls that ensure proper identification of federal expenditures in accordance with program requirements and that federal program reports are accurate. We also recommend the County submit revised Project and Expenditure reports as of March 31, 2025, and March 31, 2024. View of Responsible Official: Concur

U.S. Department of Housing and Urban Development Community Block Development Grants/Entitlement Cluster - 14.218 Multiple Awards and Award Years including COVID-19 funding Criteria or Specific Requirement – Reporting and Significant Deficiency The Quarterly Cash on Hand report must be submitted to the respective field office within 30 days after the end of the quarterly reporting period. Per 2 CFR 200.303, the non-Federal entities receiving federal awards (i.e., auditee management) establish and maintain internal control design to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During our test work over the Community Block Development Grants/Entitlement Cluster, we noted the Unified Government submitted two of the quarterly reports for the CDBG Entitlement program after the 30 day deadline. Cause: The Unified Government's controls to ensure required report submissions occur were not operating effectively. Effect: Required reports were not submitted timely. Questioned Costs – None noted. Context: Out of two quarters selected for testing, one quarters reports were submitted past the 30 day deadline. CDBG Cash on Hand Report Due Quarterly (January 1, 2024-March 31, 2024) and CDBG-CV Cash on Hand Report Due Quarterly (January 1, 2024-March 31, 2024) were submitted on July 24, 2024, 85 days past the 30 day due date. Identification of Prior Year Finding: N/A Recommendation: We recommend that the Unified Government implement a process to ensure reports are submitted by the required due date. Views of Responsible Official and Planned Corrective Actions: We agree with the finding. See management corrective action plan.

U.S. Department of Health and Human Services, passed through Kansas Department of Aging and Disability Services Aging Cluster - ALN 93.044 - Special Programs for the Aging_Title III, Part B_Grants for Supportive Services and Senior Centers - 2301KSOASS ALN 93.045 - Special Programs for the Aging _Title III, Part C_Nutrition Services - 2301KSOAHD ALN 93.053 - Nutrition Services Incentive Program - 2301KSOAHD Criteria or Specific Requirement: Suspension and Debarment and Significant Deficiency In accordance with 2 CFR 200.214, non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. “Covered transactions” include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220. All non-procurement transactions entered into by a pass-through entity (i.e., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR Section 180.215. Per 2 CFR 200.303, the non-Federal entities receiving federal awards (i.e., auditee management) establish and maintain internal control design to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Suspension and debarment checks were not completed for the subrecipient that received federal funds. Cause: For the Unified Government, this is typically included in the contracts, but was not included in the subrecipient contracts for this program and the Unified Government did not have another means of validating suspension and debarment. Effect: Federal funds could be paid to entities that are suspended or debarred. Questioned Costs: None noted. Context: Only one subrecipient received pass-through funding from the Unified Government. The single subrecipient under ALN 93.044, 93.045 and 93.053, receiving approximately $428,000, was not evaluated for suspension and debarment. It was noted after subsequent check, that the subrecipient was not suspended or debarred. Identification of Prior Year Finding: 2023-006, 2022-007, 2021-005, 2020-002 Recommendation: Policies and procedures should be modified to ensure that suspension and debarment checks are performed on vendors and subrecipients alike prior to making purchases with federal funds. When newly established programs include subrecipients, we also recommend the contracts include suspension and debarment language. View of Responsible Official and Planned Corrective Actions: We agree with the finding. See management corrective action plan.

Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Federal Agency: U.S. Department of the Treasury Federal Program: COVID-19 Coronavirus State and Local Fiscal Recovery Funds (CSLFRF), ALN No. 21.027, Award No. 23-0208-HITC ARPA Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Repeat Finding: No Condition: During our testing of two expenditures, we noted that management was unable to provide supporting documentation that review procedures were performed on invoices before the preparation of disbursement of funds. Questioned Costs: None Context: For both expenditures tested in the population of two, management was not able to provide the required support showing that the invoices were reviewed before preparation of disbursement. Criteria: 2 CFR part 200 section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award including proper authorization and approval for purchases. Cause: There was significant turnover within the finance department of the City and the grants administration process was missing supervision by key personnel. The finding indicates that there should be some process improvements in how grant expenditures are reviewed and approved before disbursement of funds to provide evidence the compliance requirement are being met. Effect: Unallowable costs or activities could be funded by the federal grant. Recommendation: We recommend the City implement procedures to ensure all disbursement of grant funds are reviewed and approved before disbursement as well as increase training efforts on disbursement policy requirements if there is future staffing turnover.