Findings Citing § 200.332

Finding 2026-002: Inadequate Subrecipient Monitoring – Failure to Evaluate Subrecipient Audit Findings Significant Deficiency in Internal Control over Compliance Federal Program Information • Federal agency: U.S. Department of Health and Human Services • Program: Temporary Assistance for Needy Families (TANF) • Assistance Listing Number - 93.558 • Compliance Requirement - Subrecipient Monitoring Criteria • 2 CFR 200.332(d)(4): The pass-through entity must review subrecipient audit findings to determine whether prompt and appropriate corrective action has been taken. • 2 CFR 200.332(f): The pass-through entity must ensure that subrecipients take timely and appropriate action on all deficiencies related to the federal award. • 2 CFR 200.303: The entity must establish and maintain effective internal control over federal awards. Condition The auditee obtained subrecipient Single Audit reports; however, there was no evidence that management: • Evaluated reported findings for relevance to the federal programs passed through. • Assessed the severity or potential impact of findings (e.g., material weaknesses, significant deficiencies, questioned costs). • Documented conclusions or follow-up on corrective actions. Cause The auditee did not have a formalized process or control requiring documented review and evaluation of subrecipient audit findings, including assignment of responsibility and supervisory oversight. Effect • The auditee may not identify or address subrecipient noncompliance affecting federal programs. • There is an increased risk that federal funds could be used in a manner inconsistent with compliance requirements. • Failure to ensure corrective action could result in questioned costs or federal sanctions. Questioned Costs None identified. Analysis / Auditor’s Perspective • While subrecipient audit reports were obtained, the absence of documented evaluation and follow-up indicates a breakdown in monitoring controls. Given that subrecipient monitoring is a key compliance requirement and the presence (or potential presence) of findings increases risk, this control deficiency is important enough to merit attention by those charged with governance but does not rise to the level of a material weakness, as no direct material noncompliance associated with the Organization’s pass-through funds or questioned costs were identified. Recommendation • Implement a standardized review process requiring documented evaluation of all subrecipient audit findings. • Develop a tracking mechanism for findings, corrective actions, and resolution status. • Assign responsibility for review and require evidence of supervisory approval. Views of Responsible Officials • Management agrees with the finding and its classification as a significant deficiency. • Management has begun developing a formal process through review of the Federal Audit Clearinghouse portal and inquiry and inspection of supporting pass-through grant detail to determine which organizations they pass-through funds to require single audits and to review any findings reported to determine if additional action as allowed under 2 CFR is necessitated. • Management has assigned responsibility to appropriate program personnel to carry out the detailed review and development of any action plans, if applicable, based on the results of subrecipient audits. • Management anticipates that the new procedures will be implemented and operating effectively by the end of the next fiscal year.

Finding Number: 2025-003 Federal Program: Coronavirus State and Local Fiscal Recovery Funds Federal Award Identification Number: 31-6400223 Assistance Listing Number (ALN): 21.027 Federal Awarding Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Pass-through Entity: Direct Award Repeat Finding: No Prior Audit Finding Number: N/A Significant Deficiency and Noncompliance – Subrecipient Monitoring Criteria Under 2 CFR § 200.332, pass-through entities are required to monitor the activities of subrecipients to ensure compliance with applicable federal statutes, regulations, and the terms and conditions of the subaward. This includes reviewing financial and performance reports, following up on deficiencies, and ensuring corrective action is taken. Condition During our testing of three subrecipient agreements, we noted that the City did not perform or document monitoring procedures for one subrecipient. Specifically, there was no evidence of review of financial reports, site visits, or other oversight activities for this subrecipient during the audit period. This condition only applies to subawards below a certain threshold, of which, the subrecipient activity is immaterial. For subawards above that threshold, the City utilizes a third-party consulting firm to perform subrecipient monitoring. The subawards tested that were monitored by the consulting firm did not indicate noncompliance. Cause The City does not have a consistent process in place to ensure all subrecipients are monitored in accordance with federal requirements. In this instance, monitoring procedures were either not performed or not documented. Effect Without proper monitoring, the City cannot ensure that subrecipients are using funds in compliance with program requirements. This increases the risk of noncompliance, improper use of funds, and undetected errors or irregularities. Recommendation We recommend the City implement and consistently follow formal subrecipient monitoring procedures. These should include documenting reviews of financial and performance reports, performing risk-based monitoring activities, and maintaining evidence of oversight for each subrecipient. Officials’ Response: See Corrective Action Plan.

Finding Number: 2025-004 Finding Type: Federal award finding Federal Assistance Listing No.: 15.685 Program Name: National Fish Passage Federal Agency: U.S. Department of the Interior Pass-Through Entity: n/a Grant Number: F24AC01768-00 Award Project Period: July 1, 2024 through July 1, 2029 Control Deficiency Type: Significant deficiency Instance of Noncompliance: Yes Compliance Requirement: Subrecipient monitoring Repeat Finding: No Criteria: Under 2 CFR 200.332 a pass-through entity must: • Evaluate each subrecipient’s risk of compliance to determine appropriate monitoring • Conduct monitoring activities based on risk, which may include reviewing financial and programmatic reports, following up on deficiencies, and verifying that subrecipients have required audits • Verify that subrecipients are not suspended or debarred prior to issuing a subaward • Ensure subrecipients submit required reports timely and comply with federal requirements • Include all applicable requirements imposed, including audit requirements under 2 CFR 200 Subpart F, the subaward • Issue management decisions for audit findings within 6 months of receiving the audit report Condition: The Council did not fully implement the required subrecipient monitoring procedures for its federal subaward. Specifically: • A formal written risk assessment was not performed prior to issuing the subaward. The Council relied on its prior working relationship with and knowledge of the subrecipient on non-federally funded projects rather than evaluating federal compliance risk. • Procurement and suspension/debarment verification were performed after the start of the subaward date. • Monitoring procedures performed were not thoroughly documented • The subaward did not include certain necessary language related the audit requirements under 2 CFR 200, Subpart F Cause: This is the Council’s first experience with awarding federal funds to a subrecipient. Staff relied on familiarity with the subrecipient rather than formalizing and documenting the required federal oversight steps. Effect: Without a documented risk assessment, timely debarment verification, documented monitoring activities, and required subaward language, the Council cannot fully demonstrate that it mitigated the risk of subrecipient noncompliance. This increases the likelihood that federal requirements may not be met or that noncompliance may go undetected. Questioned Costs: None. Audit Recommendation: The Council should strengthen its subrecipient monitoring processes by: • Developing and implementing a formal risk assessment process for all subrecipients of federal funds. • Performing and documenting suspension/debarment checks prior to issuing any subaward. • Reviewing its subaward requirements to ascertain that they include all the applicable requirements • Establishing monitoring procedures that include: • Tracking and reviewing required financial and programmatic reports for timeliness and completeness. • Obtaining and reviewing the subrecipient’s Single Audit or alternative audit documentation. • Issuing management decisions on findings within 6 months • Documenting follow up on any identified issue Management’s Response: Rogue River Watershed Council’s sub-recipient award in 2025 represents our first (and only) such award to date. While we don’t expect any sub-recipient awards in the near future, we will develop a set of procedures guiding such awards including the steps and the required timing for conducting a risk assessment, suspension/ debarment verification, required monitoring procedures, and the required language under 2 CFR 200, Subpart F. These procedures will be contained within a stand-alone policy for sub-recipient awards.

Federal Program Name: Research and Development Cluster: Uniformed Services University Medical Research Projects Federal Agency: U.S. Department of Defense Federal Assistance Listing Number: 12.750 Criteria or Specific Requirement: Subrecipient Monitoring Condition: During testing of subrecipient monitoring, it was noted that the Organization awarded three awards to subrecipients during the year and did not inform these subrecipients of the federal nature of the award at the time of the subaward. Specifically, the required federal award information was not included in the subaward documentation. Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance with federal requirements. Questioned Costs: None Context: In accordance with 2 CFR section 200.332(a), pass-through entities are required to clearly identify to the subrecipient the federal award information at the time of the subaward. This includes the federal award identification number, the federal awarding agency, the assistance listing number (ALN), and the amount of federal funds obligated. This information was not communicated to the subrecipients Cause: The Organization did not have adequate procedures in place to ensure that all required federal award information was communicated to subrecipients. Repeat Finding: Yes Recommendation: We recommend that the Organization implement procedures to ensure that all required federal award information is included in subaward agreements and communicated to subrecipients at the time of the award. Views of Responsible Officials and Planned Corrective Action: The Organization agrees with the comment and has revised policies to communicate all required federal award information to subrecipients.

Subrecipient Monitoring ALN 10:854: Rural Economic Development Loan and Grant Criteria: if the Cooperative serves as a passthrough entity, in accordance with 2 CFR 200.332 they must: • Clearly identify the award and applicable requirements to the subrecipient; • Monitor the activities of the subrecipient as necessary to ensure the subrecipient complies with federal requirements; • Verify that a subrecipient is audited. Condition: The Cooperative does not have written procedures that discuss subrecipients and how they will comply with the federal requirements as a passthrough entity, did not verify that the subrecipient was audited, and did not clearly identify to the subrecipient all the information required in the regulations. Context: There was a promissory note and loan agreement signed between the Cooperative and the subrecipient, and the agreement references to 2 CFR 200 via the incorporated Rural Economic Loan Agreement. Effect: The Cooperative is not fully following federal regulations regarding subrecipient monitoring. Questioned Costs: None. Cause: This is the first year the Cooperative received these loan funds, and written procedures were not in place prior to receiving the funds and not all of the requirements for pass through entities were followed. Auditor Recommendation: We recommend the Cooperative create procedures addressing the requirements in 2 CFR 200.332 and retain documentation showing that all required steps for passthrough entities were followed. Fergus Electric Cooperative Response: Fergus worked in conjunction and regularly communicated with the local Montana USDA REDL/G office to understand program requirements, provide requested information, and meet federal guidelines. Loan agreement RD 4280-5, (Dated 10/31/2024) refers to 7 CFR part 4280, Subpart A, as (“Regulations”). Fergus was unaware that 2 CFR 200 regulations are associated with 7 CFR part 4280, Subpart A. Fergus regretfully acknowledges that we were not informed or aware of obligations to meet the regulatory requirements within 2 CFR 200. Fergus has adopted and implemented a policy, Federal Funding Compliance, to establish formal procedures and ensure ongoing compliance with applicable federal regulations, including 7 CFR 4280, Subpart A and 2 CFR 200.

Federal Program Name: HOME Investment Partnerships Program Federal Agency: U.S. Department of Housing and Urban Development Assistance Listing Number: 14.239 Criteria Per 2 CFR 200.332, pass-through entities are required to evaluate each subrecipient’s risk of noncompliance to determine the appropriate level and type of monitoring, monitor the activities of the subrecipient to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and ensure subrecipients meet applicable program requirements, including financial and performance reporting and taking corrective action when issues are identified. Condition The City of Lafayette did not have formal, documented subrecipient monitoring policies in place during 2025, resulting in a lack of a consistent and structured monitoring framework. While the City performed several compensating controls (e.g., desk reviews, pre-disbursement reviews, and training), these activities were not formally defined or applied uniformly to ensure full compliance with Uniform Guidance. Cause The City has an agreement with Lafayette Housing Authority to administer and monitor the HOME program. Due to staff transitions during the year, the Authority relied on informal oversight procedures rather than implementing a structured monitoring plan, including risk-based assessments and documented monitoring activities. Effect The lack of formal subrecipient monitoring increases the risk that noncompliance with HOME program requirements may not be identified or corrected in a timely manner. Recommendation We recommend the Authority implement formal subrecipient monitoring procedures for the HOME program, including: • Performing and documenting annual risk assessments to determine the appropriate level of monitoring; • Conducting and documenting monitoring procedures (e.g., desk reviews and/or on-site reviews); and • Maintaining evidence of supervisory review and follow-up on any identified issues. Views of Responsible Officials and Planned Corrective Actions: For the views of responsible officials, refer to the Corrective Action Plan

Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Assistance Listing Number: 21.027 Compliance Requirement: Subrecipient Monitoring Criteria: 2 CFR 200.332 establishes standards to evaluate subrecipient risk, monitor subrecipient activities, follow up on identified deficiencies, and maintain documentation of monitoring to ensure compliance with federal requirements Condition: The City of Noblesville does not have a formal policy or standardized process in place to track and perform consistent subrecipient monitoring procedures for all subrecipients receiving Coronavirus State and Local Fiscal Recovery Funds. Cause: The City has not established formal written procedures or implemented a centralized tracking mechanism to ensure all required subrecipient monitoring activities are performed and documented in accordance with federal requirements. Effect: Without a formal policy and tracking process, there is an increased risk that subrecipient monitoring procedures may not be performed consistently or timely, which could result in noncompliance with Uniform Guidance requirements and improper use of federal funds by subrecipients going undetected. Questioned costs: There were no identified questioned costs Context: We tested a sample of one subrecipient that received payments under the program totaling $249,857 of disbursements out of 4 total recipients, with total payments of $475,638 during 2025. Based on our procedures, we noted that the City has not established formal subrecipient monitoring procedures and that monitoring activities were not performed consistently across subrecipients. Our sampling methodology is not considered statistically valid. Recommendation: We recommend the City develop and implement a formal subrecipient monitoring policy and establish a centralized tracking system to ensure all required monitoring activities are performed consistently and documented for all subrecipients. The policy should align with 2 CFR 200.332 and include procedures for risk assessment, monitoring activities, and follow-up on identified issues. Views of Responsible Officials and Planned Corrective Actions: For the views of responsible officials, refer to the Corrective Action Plan

Federal Programs – AL 93.568 – Low Income Home Energy Assistance Program Criteria – Uniform Guidance requires, for any funds passed through to a subrecipient, that the pass-through entity (CAPND) must perform certain activities to ensure that the subrecipient uses the funds within provisions of the grant award and Uniform Guidance, 2 CFR sections 200.332 (b). This includes issuing subawards granted to subrecipients. Condition – For the year ended December 31, 2025, we reviewed any subawards between CAPND and subrecipients under the Low Income Home Energy Assistance Program (LIHEAP). We noted one subrecipient was missing a subaward during the year. Cause – There was one missing subaward between CAPND and the subgrantee. Effect – Increased risk of potential noncompliance with subrecipient monitoring requirements under Uniform Guidance. Questioned costs – None. Repeat Finding – This is not a repeat finding. Recommendation – The entity should include all required information as determined in CFR Section 200.332(b) in all subawards. Views of Responsible Officials - Management recognizes the deficiency and plans to implement the auditor’s recommendation.

Federal Award Identification: 2023-70417-39322 Federal Program: American Rescue Plan Technical Assistance Investment Program Assistance Listing: 10.234 Federal Agency: U.S. Department of Agriculture Pass-through Entity: Not applicable - direct award Award Period Audited: Fiscal year ended December 31, 2025 Criteria: 2 CFR 200.332(c) requires pass through entities to evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring. In addition, 2 CFR 200.332(e) requires pass through entities to monitor subrecipients to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward, including review of financial and performance information and follow up on identified issues. Condition: During the audit, it was determined that for all (2) subrecipients tested, the Organization did not document subrecipient risk assessments and, for one subrecipient tested, did not demonstrate that elevated risks were used to determine or adjust the nature, timing, or extent of subrecipient monitoring. Management identified one subrecipient as having recurring federal award findings, including material weaknesses reported in prior Single Audits. Despite this known elevated risk, the Organization applied the same baseline subrecipient monitoring procedures to all (2) subrecipients under the major program. Context: The deficiency was identified during audit testing of subrecipient monitoring controls and inquiry of management. Cause: The deficiency resulted from the absence of formal policies and procedures requiring documentation of subrecipient risk assessments and requiring that identified risks be used to determine and document the appropriate level of subrecipient monitoring. Effect: This significant deficiency in internal control over compliance created a reasonable possibility that material noncompliance with subrecipient monitoring requirements would not be prevented or detected on a timely basis. However, no instances of noncompliance were identified. Although no questioned costs were identified, the deficiency increased the risk that noncompliance could occur and remain undetected. Known Questioned Costs: None. Repeat Finding Status: This is a new finding for the year ended December 31, 2025. Recommendation: The Organization should implement formal, documented policies and procedures for risk-based subrecipient monitoring to ensure that monitoring activities are tailored based on subrecipient risk levels. This should include documented consideration of subrecipient audit results and retention of documentation supporting the performance and results of enhanced monitoring procedures for higher risk subrecipients. Views of Responsible Officials: Management agrees with the finding. Management acknowledges that subrecipient risk assessments were not formally documented and that monitoring activities were not adjusted based on identified risk levels. Management has indicated that corrective actions will be taken to implement a documented, risk based approach to subrecipient monitoring.

Finding 2025-001: Subrecipient Monitoring Significant Deficiency and Other Noncompliance Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During fiscal year 2025, iDE passed federal funds to subrecipients under active federal awards that remained operational during a portion of the year prior to the termination of the underlying grant agreements. Although iDE reviewed subrecipient liquidation reports and reimbursement requests supporting expenditures incurred prior to award termination, iDE did not perform or document formal subrecipient risk assessments. Further, because risk assessments were not performed, iDE did not establish or implement monitoring procedures commensurate with assessed risk, such as documented reviews of performance information, follow-up on compliance matters, review of Single Audit reports, or other monitoring activities required by Uniform Guidance. Cause: Employee turnover and terminated programs. Effect: Inadequate procedures and controls for subrecipient monitoring could result in material noncompliance with applicable federal statutes, regulations, or award terms and conditions. Repeat finding: Yes—see Finding 2024-002. Questioned costs: None

Significant Deficiency – Lack of risk assessment over subrecipient Agency: Department of Health and Human Services ALN# 93.592 - Family Violence Prevention and Services/Discretionary Grants Grant Year: 2025 Grant Numbers: 90EV054301C6; 90EV052301C6; 90EV056003; 90EV0459-04 Criteria: Per 2 CFR §200.332(b), pass-through entities are required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward. This evaluation is necessary to determine the appropriate level of monitoring. Risk factors may include prior experience, results of previous audits, personnel or system changes, and results of federal monitoring. Condition: The Organization passed-through funding to two subrecipients without documenting a risk assessment over the entities’ possible noncompliance. Cause: Management has not established or implemented formal policies and procedures to ensure subrecipient risk assessments are performed in accordance with Uniform Guidance requirements. Additionally, there is a lack of oversight controls to verify completion and documentation of the risk assessment process. Possible Effect: Without performing and documenting subrecipient risk assessments, the Organization runs the risk that monitoring procedures are not appropriately tailored to the level of risk. This increases the likelihood that noncompliance with Federal requirements may occur and remain undetected. Questioned Costs: None. Perspective: Statistical sampling was not used, however, sampling methodology followed AICPA guidelines. Repeat Finding: This is not a repeat finding. Recommendation: We recommend the Organization develop and implement formal policies and procedures to ensure that risk assessments are performed for all subrecipients at the time of subaward and updated as necessary. The process should include documented consideration of required risk factors in accordance with 2 CFR §200.332(b) and should be used to determine the appropriate level and frequency of monitoring activities. Management’s Response (unaudited): See Corrective Action Plan.

Criteria 2 CFR § 200.332 requires a pass-through entity to evaluate each subrecipient’s risk of noncompliance and monitor the subrecipient’s activities as necessary to ensure that the subaward is used for authorized purposes, complies with applicable requirements, and achieves performance goals. Monitoring includes reviewing financial and performance reports and following up on identified deficiencies. Condition The Town awarded $3,575,000 of EPA grant funds to the Suffolk County Water Authority (the “Subrecipient”) as a subrecipient. Although the Town verified that the Subrecipient obtained required single audits for 2024 and 2025, the Town did not have adequate procedures to review the Subrecipient’s expenditures for allowability before including them in applications for payment. In addition, the Town did not have procedures in place to monitor the Subrecipient’s procurement process relating to this program for compliance with the grant agreement. The Town’s executed subrecipient agreement with the Subrecipient did not include all compliance requirements as identified by the grant agreement. Accordingly, the Town’s monitoring did not provide reasonable assurance that subaward funds were used for authorized purposes and in accordance with the federal award. Cause While the Town did assess the Subrecipient’s risk of non-compliance, the Town did not implement procedures to compare the subrecipient agreement to the grant agreement prior to issuance, and did not implement procedures to effectively monitor the Subrecipient for this program. Effect Without adequate communication of compliance requirements to the Subrecipient, and monitoring of the Subrecipient’s procurement and expenditures, there is an increased risk that the Town will not be in compliance with the terms of the grant agreement. Questioned Costs Unknown Recommendation We recommend that the Town ensure subrecipient agreements include all grant terms identified in the grant agreement and implement procedures to monitor the Subrecipient’s expenditures for allowability and compliance with procurement requirements prior to submission of requests for payment to the EPA. Views of Responsible Officials Management agrees with this finding. Community Development will review existing and future subrecipient agreements and update as necessary to ensure that all grant terms are included in the agreements. In addition, Community Development will establish and implement procedures to monitor the subrecipient’s expenditures for allowability and compliance with procurement requirements prior to submission of requests for payment to the EPA for all existing and future subrecipient agreements.

2025-001 Improve Controls and Documentation Over Subrecipient Monitoring Federal Program Information Federal Agency: Department of Health and Human Services Award Name(s): Child Care and Development Block Grant Assistance Listing Number(s): 93.575 Award Year: 2022 Compliance Requirement: Subrecipient Monitoring Federal Agency: Department of Health and Human Services Award Name(s): Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.391 Award Year: 2022 Compliance Requirement: Subrecipient Monitoring Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requires that a pass-through entity must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information as required in 2 CFR 200.332(b). Condition and Context During our fiscal year 2024 audit, we tested a sample of one subrecipient under the Child Care and Development Block Grant in order to determine if the subrecipient agreements contained all required elements per 2 CFR 200.332(b) and ensure sufficient subrecipient monitoring procedures were performed. As a result of our testing, it was identified that the agreement tested did not contain the subrecipient’s unique entity identifier, federal award identification number, federal award date, assistance listing title, assistance listing number, dollar amount available under each federal award and assistance listing number at the time of disbursement, and approved indirect cost rate. While assistance listing number 93.391 was not tested as a major federal program in 2025, and subrecipient monitoring is no longer applicable to 93.575 based on the 2025 Compliance Supplement, we have carried forward the finding from the prior year and applied it to this program as it has not yet been resolved. Cause The Organization did not have adequate controls in place to ensure all required elements were included in subrecipient agreements. Effect or Potential Effect The Organization did not comply with the requirements of the Uniform Guidance regarding communication to subrecipients all the specified elements in 2 CFR 200.332(b). No questioned costs are reported as this requirement is administrative in nature. Recommendation The Organization should address the weakness in internal control noted above and update its subrecipient agreements, policies, and procedures to ensure that all required elements are present to comply with the Uniform Guidance. Views of Responsible Official Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

2025-002 Subrecipient Monitoring – Required Award Information Program Information Federal Agency U.S. Department of Health and Human Services, Passed through the Washington State Department of Health Assistance Listing Numbers 93.323 Epidemiology and Laboratory Capacity of Infectious Diseases (ELC) Award Numbers NU50CK000515 Criteria Under 2 CFR 200.332(b), a pass-through entity is required to ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required federal award identification information. Required information includes, among other information, the Federal awarding agency, Federal Award Identification Number (FAIN), and Assistance Listing Number (ALN). [X] Compliance Finding [X ] Significant Deficiency [ ] Material Weakness Condition The Organization was not able to demonstrate that the Federal awarding agency, Federal award identification number (FAIN), and assistance listing number (ALN) were communicated to subrecipients. Cause Required communications were reportedly sent by the former Executive Director via email; however, supporting documentation was not retained or available for audit. Effect Failure to properly identify subawards and communicate required federal award information may result in subrecipients not being fully aware of the federal source of funding, applicable compliance requirements, reporting obligations, indirect cost rate requirements, audit requirements, access-to-records provisions, and closeout responsibilities. This condition increases the risk that subrecipients may not comply with federal statutes, regulations, and award terms and conditions, and that the Organization may not effectively fulfill its pass-through entity responsibilities for subrecipient monitoring. Questioned Costs None noted. Context We selected four subrecipient agreements out of a population of seven. All four agreements tested were missing the required information noted above. Recommendation The Organization should implement procedures to ensure all required subrecipient award information is communicated in accordance with federal requirements as part of the subrecipient agreements. Views of responsible officials and planned corrective action All required funding source information will be included in partner contracts moving forward. Corrective action plan is 2 fold: 1. OCH will email all 2026 subawardees the required funding source information and save this documentation within the appropriate contract folder. 2. OCH will update it’s contract templates to include funding source information and all future contracts will include this within the contract.

Reportable Finding Considered a Significant Deficiency and Noncompliance Finding – Subrecipient Monitoring Compliance Agency: U.S. Department of State, Bureau of Population, Refugees, and Migration (PRM) Program: U.S. Refugee Admissions Program ALN# 19.510 Grant Number: SPRMCO25CA0026 and SPRMCO25CA0028 Program Year: 2025 Criteria: 2 CFR §200.332 requires pass-through entities to establish and implement procedures to monitor subrecipients and ensure compliance with federal statutes, regulations, and the terms and conditions of federal awards. Effective internal controls should include documented policies and procedures governing the subrecipient monitoring process. Condition: Community Sponsorship Hub (CSH) did not have formally documented and approved subrecipient monitoring policies and procedures in place during FY2025. Although management performed various monitoring activities, including execution of subaward agreements, review of reimbursement requests, financial and programmatic reporting reviews, and communication with subrecipients, these procedures were not formally documented in a written policy until 2026. Cause: Management had established operational subrecipient monitoring practices but had not formally documented these practices in approved policies and procedures during the period under audit. As a result, monitoring activities were performed based on institutional knowledge rather than a formally established control framework. Effect: The absence of formal written policies and procedures increases the risk that subrecipient monitoring activities may be applied inconsistently, incompletely, or not performed in accordance with Uniform Guidance requirements. This could result in noncompliance by subrecipients not being identified and addressed in a timely manner. Questioned costs: None Perspective: Statistical sampling was not used; however, a nonstatistical sampling approach was applied in accordance with AICPA guidance. The deficiency impacts the design of internal controls over CSH’s subrecipient monitoring process and therefore represents a systemic issue rather than an isolated occurrence. Testing of selected subawards indicated that monitoring activities were generally performed and documented; however, the lack of a formal written policy existed throughout FY2025 and affected all federal programs with subrecipient activity. Repeat finding: This is not a repeat finding. Recommendation: We recommend that management establish, approve, and maintain comprehensive written subrecipient monitoring policies and procedures that comply with 2 CFR §200.332. The policy should clearly define responsibilities, risk assessment procedures, monitoring activities, documentation requirements, follow-up procedures, and compliance review requirements for all subrecipients. Management’s response (unaudited): See Corrective Action Plan

Reporting – Special Reports for FFATA and Subrecipient Monitoring Assistance Listing Number 14.251 – Economic Development Initiative, Community Project Funding, and Miscellaneous Grants U.S. Department of Housing and Urban Development (HUD) Federal Award Identification Number(s): B-22-CP-CO-0165 Award Year – 2022 Criteria or specific requirement(s): In accordance with the Federal Funding Accountability and Transparency Act (FFATA) and 2 CFR Part 170, recipients are required to report applicable first-tier subawards of $30,000 or more, including required data elements, in SAM.gov by the end of the month following the month in which the subaward obligation was made. Furthermore, pursuant to 2 CFR § 200.332(a), pass-through entities are required to clearly identify federal award information and communicate all applicable federal requirements, terms and conditions, and compliance requirements to subrecipients at the time of the subaward. Required information includes, among other items, the Assistance Listing number and name, federal award identification information, indirect cost rate and any additional requirements imposed by the pass-through entity so that subrecipients can properly administer the federal award and comply with applicable federal requirements. Condition: During testing of FFATA reporting requirements, we noted that the City had one applicable first-tier subrecipient; however, the City did not report the subaward information in SAM.gov. Additionally during testing of subrecipient monitoring, we noted the City did not communicate required federal award information or increase in funding to its sole subrecipient as required by 2 CFR § 200.332(a). Cause: The City experienced a delay in receiving the federal award and initially funded the subaward with nonfederal resources. After the federal award was received and the related expenditures were identified as federally funded, the City did not have a process to update the subaward, communicate the federal award information and funding increase to the subrecipient, or evaluate FFATA reporting requirements. As a result, the required subaward information was not reported in SAM.gov or communicated to the subrecipient. Effect or potential effect: Failure to report the applicable first-tier subaward in accordance with FFATA requirements resulted in noncompliance with federal reporting requirements and reduced transparency over the use of federal funds by preventing complete and accurate subaward information from being available through federal transparency reporting systems. In addition, failure to communicate required federal award information to the subrecipient increases the risk that the subrecipient would be unaware of applicable federal requirements and unable to properly administer the award in accordance with federal regulations and the terms and conditions of the subaward. Questioned costs: None Context: The City had one subrecipient during the audit period. The following testing was performed related to FFATA reporting: Transactions Tested -1 Subaward not reported -1 Report not timely -1 Subaward amount incorrect - Unable to test due to subaward no tbeing reported Subaward missing key elements -Unable to test due to subaward not being reported Dollar Amount of Tested Transactions - $1,045,014 Subaward not reported - $1,045,014 Report not timely - $ 1,045,014 Subaward amount incorrect -Unable to test due to subaward not being reported Subaward missing key elements - Unable to test due to subaward not being reported Additionally, we performed subrecipient monitoring testing over the sole subrecipient and identified the compliance exception described above. Identification as a repeat finding, if applicable: N/A Recommendation: We recommend the City submit any outstanding FFATA reporting information and formally notify the subrecipient of the increase in funding, applicable federal requirements, and terms and conditions of the award. We also recommend the City implement procedures to identify and assess compliance requirements when funding sources and award amounts change, including procedures to ensure required reporting, documentation, and subrecipient communications are updated timely and accurately. Views of responsible officials and planned corrective actions: Agree. See separate corrective action plan.

Subrecipient Monitoring and Special Tests: Housing Quality Standards Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: M17-DC170213 and 2017 M18-DC170213 and 2018 M21-DC170213 and 2021 M22-DC170213 and 2022 Home Investment Partnerships Program (HOME), Federal Assistance Listing #14.239 County Department – Department of Planning and Development (DPD) Finding 2025 – 001 CRITERIA Subrecipient Monitoring 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4) Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. DPD’s HOME Program Policies and Procedures Manual (updated January 2025), Monitoring Section (pages 114 to 129), under the Annual Monitoring Plan/Schedule Update, states the plan should identify the participating jurisdiction (PJ) monitoring goals and strategies, highlighting areas to which staff should pay special attention during the monitoring year. A specific schedule detailing annual, bi-annual, and tri-annual monitoring visits as required by HUD must be developed and maintained. To assure that adequate records are kept regarding each property and its compliance status, the monitor should establish a monitoring file for each property. The basic items in the file should include written agreement, written tenant selection criteria, property and unit inspections and results, etc. Also, HOME Program Compliance should conduct a risk assessment of its portfolio of the PJ’s HOME projects so that the highest risk projects can be identified and monitored first. In addition, HOME Program Compliance must conduct a desk review of all properties in the monitoring workload each year, as well as on-site reviews periodically, ranging from annually to every 3 years based on the number of units in property (i.e. 26 or more units require an annual review). Special Tests: Housing Quality Standards Per 24 CFR Section 92.209(i), Tenant-based rental assistance: Eligible costs and requirements, Housing Standards, states “The participating jurisdiction must require the housing occupied by a family receiving tenant-based rental assistance under this section to meet the participating jurisdiction's property standards under § 92.251. Initially and annually thereafter, the participating jurisdiction must determine the housing complies with its property standards and is decent, safe, sanitary, and in good repair in accordance with § 92.251(f). During the period of affordability (i.e., the period for which the nonfederal entity must maintain subsidized housing) for HOME assisted rental housing, the PJ must perform on-site inspections to determine compliance with property standards and verify the information submitted by the owners no less than (a) every three years for projects containing one to four units, (b) every two years for projects containing five to 25 units, and (c) every year for projects containing 26 or more units. CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not provide sufficient evidence to document annual monitoring performed, as well as performed the required inspections to ensure property standards were met, as required by Federal regulations and its internal policies. CAUSE Based on discussions with management, the cause of the findings occurred as a result of post pandemic allocations to the County which included several housing related fundings and initiatives, including Emergency Rental Assistance I & II (ERA I& II), Homeless Sheltering, Homeless and Transitional Sheltering Physical Site Acquisition and Development, HOME ARPA (HUD Allocation), and HOME, CDBG CV development delays that challenged the Housing teams provision of services and compliance requirement. While HUD had extended post pandemic compliance moratoriums into fiscal year 2024, Housing team hiring, training and implementation of compliance activities were unable to activate fully in the subject fiscal year to meet compliance. Additionally, for subrecipient monitoring of the HOME program, costs paid to developers were misclassified as subrecipient expenditures. The HOME program does not have contracts with subrecipients. EFFECT Failure to adequately monitor the activities and performance of subrecipients (and developers) could result in Federal awards being used for unauthorized purposes and DPD’s inability to adequately perform required risk assessments. Failure to perform the required inspections to ensure property standards were met is a violation of Federal regulations. QUESTIONED COSTS None. CONTEXT Subrecipient Monitoring During the current audit period, we noted a total of thirty-seven (37) projects were included on the Program Year 2024 (Fiscal Year 2025) HOME monitoring rental portfolio schedule provided, which required annual monitoring per DPD’s internal policies. Of the 37 projects, we noted three projects had some monitoring conducted during the period, which included some review of tenant files (for income verification/eligibility) and limited physical inspections of HOME units. No additional documentation was provided to verify compliance with federal regulations and the HOME Program Policies and Procedures Manual which required annual monitoring of each project (property). In addition, we noted approximately $7.3 million was reported on the SEFA as pass-through to two subrecipients under the program for the fiscal year ended November 30, 2025. Based on further discussions, DPD noted that these subrecipients are the two title companies used to pay the developers under the HOME program in accordance with its escrow agreement(s). We also reviewed a sample of these payments noting the supporting documentation referenced the developers as subrecipients. No documentation was provided to support compliance with subrecipient monitoring as required by 2 CFR Part 200.332. Special Tests: Housing Quality Standards We were provided with the same 37 projects reviewed under subrecipient monitoring to verify that DPD performed the required inspections to ensure that property standards were met. Based on our review, we noted the list included projects with HOME assisted units ranging from one (1) to 99 units, which would have required inspections every one to three years. However, the listing provided did not identify those units on which housing quality inspections were due. In addition, of the 37 projects, we were provided with documentary evidence to support only one (1) project whereby the required unit inspection reports were completed. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPD ensure procedures should be in place to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance, as required by Federal regulations and internal policies. Also, documentation should be maintained to support that required inspections are performed to ensure that property standards are met, including identification of those units on which housing quality inspections are due, in accordance with 24 CFR 92.251(f). VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 42-43.

Subrecipient Monitoring Federal Department – U.S. Department of Treasury Federal Award Identification Number and Year: SLFRP0143 and 2021 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds, Federal Assistance Listing #21.027 County Department(s) – Various Finding 2025 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (b) ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: (1) Federal award identification. (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN)…(c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. The Cook County, Illinois ARPA: Subrecipient Risk Assessment and Risk Reassessment Process Manual (dated May 16, 2024), states "If a subrecipient does not complete the risk reassessment by the assigned due date, their risk level will remain the same and they will be eligible for reimbursements only. Advancement requests will not be considered until the subrecipient completes the risk reassessment." Also, the level of monitoring to which the subrecipient must adhere to will vary by risk level assigned. The monitoring expectations associated with each risk level will be communicated to the subrecipient in the form of the risk reassessment and financial monitoring letter”. The monitoring parameters associated with each risk level are outlined below: • High Risk – minimum of monthly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Medium Risk – minimum of monthly to quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Low Risk - minimum of quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns The Cook County ARPA Grants Compliance Guide, under External Risk Management, states "Federal grant regulations in Uniform Guidance require that all SLFRF-funded programs be conducted in a risk-informed manner, particularly the selection and monitoring of subrecipients that implement programming on behalf of Cook County. In order to assess the risk potential of external subrecipient partners, each subrecipient organization is assessed for risk as the beginning of their partnership with the County and assigned a risk rating of High, Medium, or Low. This rating informs the monitoring and documentation requirements for that subrecipient. Subrecipients are reassessed for risk annually to reflect any changes or improvements in their risk potential”. The Cook County ARPA SLFRG Grant Subaward Financial Management Manual (revised March 3, 2025), under Subaward Financial Management Roles and Responsibilities states that “as outlined in the risk assessment form, the level of monitoring will be based on subrecipient’s risk designation. The subrecipient will receive a risk assessment and financial management letter apprising it of the expectations associated with its assigned risk level”. In addition, under Section A. Advancement of Funds Process, Item VI. Shifting to Reimbursement Model, states “nine months prior to the program’s conclusion, no further advancements can be provided to a subrecipient. Unspent advance balances will be applied against subsequent expenses incurred and reported to the County. Some subrecipients may need working capital to maintain operations, and it will be the responsibility of the Department to create a drawdown schedule to ensure to the best of its ability that all advanced funds are expended and/or recouped by program-end”. CONDITION During the current audit period, the County performed inadequate monitoring of its subrecipients as required by its internal policies. CAUSE Based on discussions with management, the County instituted new internal guidelines for program and financial management of its State and Local Fiscal Recovery Funds (SLFRF) award. These guidelines included more strict monitoring controls than federal regulations require. Additionally, the County deployed a new grants management system specifically to assist in collection and reporting on program metrics and subrecipient financials. The grants management system went live in spring of 2024. The County continues to invest in compliance oversight and technical assistance to ensure its new guidelines are effectively implemented, particularly in relation to utilization of its grants management system. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of 40 subrecipients (of a population of 250 subrecipients), we noted the following:  For 1 subrecipient file, we noted one (1) monitoring log was completed. However, based on risk rating(s) assigned, a total of four (4) monitoring logs were required.  For 11 subrecipients, we noted the risk reassessments were expired, ranging from 167 to 920 days over the assigned due date. Of the 11 subrecipients, 6 had risk reassessments currently outstanding and 3 had advancement requests approved without a risk reassessment, both of which were contrary to County’s internal policies. The total amount advanced to the 3 subrecipients was $772,214.  We noted one subrecipient submitted advancement requests totaling $852,757 during the County’s fiscal year. Based on review of the supporting documentation, it appears these funds are actual reimbursement of costs previously incurred by the subrecipient and should have been submitted via a payment request(s) as opposed to an advancement request(s). Consequently, the SEFA reported total expenditures incurred of $594,815, instead of the total $852,757, resulting in a net understatement of $257,942. However, the subrecipient was compensated for all work that was performed.  We noted the County executed a subrecipient agreement (signed December 20, 2024) prior to verifying the subrecipient had an active Unique Entity Identifier (UEI) number (active date January 20, 2025) which is required by Federal regulation. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend County implement procedures to ensure adequate documentation (monitoring log) is maintained and timely completion of risk reassessment is conducted to support the evaluation of each subrecipient’s risk of noncompliance as required by Federal regulations and its internal policies. Also, the County should adhere to its written internal policies which require that advancement requests not be considered until the subrecipient completes the risk reassessment. In addition, the agreement with a subrecipient should not be executed without an active UEI, unless exceptions to these policies are clearly documented. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 44-45.

Finding 2025-001 Subrecipient Monitoring (Significant Deficiency) Information on the Federal Programs: Fish and Wildlife Cluster Criteria or Specific Requirement: Under 2 CFR 200.332, pass-through entities are required to evaluate each subrecipient’s risk of noncompliance to determine the appropriate monitoring, monitor subrecipient activities as necessary to ensure compliance with Federal requirements, and verify whether subrecipients that meet the Federal expenditure threshold have obtained a Single Audit. These responsibilities include performing and documenting a subrecipient risk assessment, conducting monitoring activities based on the assessed risk, and obtaining, reviewing, and following up on subrecipient Single Audit reports when applicable. Condition: The Organization does not maintain written policies or procedures that address required subrecipient monitoring activities. The Organization does not perform or document a risk assessment of subrecipients to evaluate their risk of material noncompliance and does not have monitoring procedures that correspond to an assessed level of risk. Additionally, the Organization does not have a policy or consistent practice for determining whether subrecipients are subject to Uniform Guidance Subpart F Single Audit requirements, nor does it obtain or review Single Audit reports from subrecipients that meet the required threshold. Cause: This condition exists because the Organization has not established formal internal controls or written procedures to ensure compliance with all Federal requirements related to subrecipient monitoring. Effect or Potential Effect: As a result, the Organization is not fully compliant with the requirements of 2 CFR 200.332, and there is an increased risk that subrecipient noncompliance may occur and remain undetected. The absence of appropriate risk assessment and monitoring procedures increases the likelihood that programmatic or financial issues at the subrecipient level could go unidentified. Failure to obtain and review required Single Audit reports also increases the risk that audit findings, questioned costs, or other compliance concerns may not be addressed by the Organization in a timely manner. Although no questioned costs were identified during our audit, the control deficiencies described above increase the risk of future questioned costs. Questioned Costs: N/A. Context: This finding was noted during our review of the Organization’s subrecipient monitoring practices and reflects a systemic lack of documented policies and procedures governing the required elements of risk assessment, monitoring, and Single Audit verification. Identification as a Repeat Finding, if Applicable: No. Recommendation: We recommend that the Organization develop and implement comprehensive written subrecipient monitoring policies and procedures that align with 2 CFR 200.332. These procedures should include conducting and documenting a risk assessment for each subrecipient, establishing monitoring activities that are responsive to the level of assessed risk, and implementing a process to determine whether subrecipients are required to obtain a Single Audit and to obtain, review, and follow up on those audit reports as necessary. Establishing these controls will help ensure compliance with Federal requirements and reduce the risk of undetected noncompliance at the subrecipient level.

Finding number: 2025-003 Significant Deficiency – Lack of Internal Control Over Compliance with Subrecipient Monitoring Policy Assistance Listing Number 21.027 (Contract # 902060-23133) Criteria: Pursuant to CFR section 200.332(b), pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: The Unity Council did not perform a risk assessment of subrecipients. This is a repeat finding. Cause: The Organization does not have a formally documented policy for performing a risk assessment over subrecipients. Effect or potential effect: A risk assessment for purposes of determining the appropriate subrecipient monitoring was not performed. Recommendation: Management should develop a risk assessment policy to evaluate the risk profile of each subrecipient. Factors included during the evaluation can include the subrecipient's prior experience with the same or similar subawards, results of previous audits, whether the subrecipient has new personnel or new or substantially changed systems, and the extent and results of federal awarding agency monitoring. View of responsible officials: Management is in agreement with the finding, however the contract ended during 2025 and was not renewed. The Organization has no other subrecipients.

Subrecipient Monitoring – Risk Assessment (Noncompliance) and significant deficiency in Internal Control Finding 2025-002 Identification of the Federal Program: 93.600 – Head Start Cluster, 93.387 – National and State Tobacco Control Program, and 93.872 – Tribal Maternal, Infant, and Early Childhood Home Visit Criteria: According to 2 CFR § 200.332, a pass-through entity must evaluate each subrecipient's fraud risk and risk of noncompliance as a form of subrecipient monitoring. In doing so, a pass-through entity must review financial reports, including their financial audits, ensure that the subrecipient takes corrective action on all significant developments affecting the subaward, issue a management decision on any audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through and resolve audit findings specifically related to the subaward. If a finding rises to a certain level, the pass-through should consider taking action against noncompliant subrecipients. Condition: The organization does not have a formal risk assessment process in place. As of the date of fieldwork, audit reports of member tribes receiving subrecipient payments were not all received and therefore, were not reviewed to perform a proper risk assessment. We additionally noted that a quarterly report was not submitted as required per the agreement and funds were still distributed. Cause: Management's unfamiliarity with 2 CFR § 200.332 requirements and overall relationship with the Tribes. Effect: Risk assessment is significant to performing sufficient subrecipient monitoring. The structure of the organization being governed by the chairs of each Tribe and created to obtain grants to further support the Tribes creates a level of trust amongst the Tribes and the Organization; however, this does not eliminate the need to perform a risk assessment and ensure that the individual Tribes are in compliance at a Federal level. Questioned Costs: $0 Repeat Finding: No Recommendation: We recommend that management and program managers familiarize themselves with the requirements of 2 CFR § 200.332 and create a formal risk assessment process. We also recommend that Tribes are held accountable for not submitting a timely audit (i.e. withholding funds until provided). Management Response: Management agrees with the finding. The Council will work on implementing an efficient, yet effective risk assessment process for all subrecipients.

Finding 2025-002 – Incomplete Subrecipient Agreements and Inaccurate Subrecipient SEFA Reporting Federal Program: Violence Against Women Formula Grants Assistance Listing Number: 16.588 Compliance Requirement: Subrecipient Monitoring Internal Control Deficiency: Material Weakness - Insufficient controls over subaward agreement content and subrecipient reporting oversight Compliance Finding: Subaward agreements missing required elements; subrecipient failed to report pass-through funds on its SEFA Questioned Costs: None Criteria: Under 2 CFR § 200.332, pass-through entities must ensure that all subaward agreements contain specific federal award information, monitoring expectations, and required terms and conditions. Subrecipients must report federal expenditures on their SEFA in accordance with 2 CFR § 200.510(b). Condition: During our testing of subrecipient monitoring and federal reporting, we noted that subrecipient agreements did not include several elements required under 2 CFR § 200.332(b), (c), and (e)–(i). Specifically, the agreements reviewed were missing one or more of the following required components: • Federal award identification information, including unique entity identifier (UEI), Federal Award Identification Number (FAIN), ALN, award date, and other required identifiers. • Required access-to-records language granting the pass-through entity, auditors, and federal agencies the right to access pertinent records. • Subaward-level closeout requirements, including timelines and documentation expectations. In addition, during compliance testing we noted that the subrecipient did not include the pass-through funds received in its own SEFA, resulting in incomplete federal expenditure reporting. Cause: The deficiencies appear to result from the absence of a standardized subaward agreement template and insufficient review procedures to ensure all Uniform Guidance elements are included. The subrecipient’s SEFA omission appears to stem from a lack of communication and monitoring regarding reporting requirements. Effect: Incomplete subaward agreements increase the risk that subrecipients may not understand federal requirements, may apply incorrect cost principles, or may fail to comply with federal terms. Missing SEFA reporting by the subrecipient results in inaccurate federal expenditure reporting and may affect federal oversight, risk assessments, and audit coverage.Recommendation: Management should implement a standardized subaward agreement template that incorporates all elements required under 2 CFR § 200.332. If any of the required elements are missing, adding a short federal award information/Uniform Guidance appendix and an explicit records-access and closeout article would bring the contracts into compliance. Management should also strengthen monitoring procedures to ensure subrecipients understand and comply with SEFA reporting requirements, including verifying that pass-through funds are properly reported. Management’s Response and Corrective Action Plan is found on page 28-29.

FINDING 2025-030 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Subrecipient Monitoring - Subaward Information See Schedule of Findings and Questioned Costs for chart/table. Condition MSF did not report to its subrecipients all subaward information as required by the Uniform Guidance. We noted MSF did not report one or more of the following for 3 of 4 sampled CSLFRF subrecipients: identification of whether the award is for research and development (R&D), indirect cost rate for the federal award, and an approved federally recognized indirect cost rate for the subrecipient. Criteria Federal regulation 2 CFR 200.332(b) requires all pass-through entities ensure every subaward includes certain information. Cause MSF incorrectly interpreted federal regulation notification requirements for two subrecipients. For the remaining subrecipient, MSF informed us staff turnover and limitations contributed to a delay in complete communication of required subaward information to current subrecipients. Effect Subrecipients and their auditors may not be aware of the federal award information needed to ensure compliance with the federal requirements. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MSF report to its subrecipients all subaward information as required by the Uniform Guidance. Management Views MSF agrees with the finding.

FINDING 2025-031 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Subrecipient Monitoring - Subrecipient Audits See Schedule of Findings and Questioned Costs for chart/table. Condition The Department of Environment, Great Lakes, and Energy (EGLE) and DNR did not properly monitor their subrecipients to ensure they complied with the Uniform Guidance. We noted: a. EGLE did not appropriately identify or document if its subrecipients required a single audit for 7 (27%) of 26 sampled subrecipients. We reviewed the federal audit clearinghouse (FAC) and noted 5 of the 7 subrecipients had single audit reports submitted to the FAC in fiscal year 2025 and one required a management decision letter on its findings. b. DNR did not appropriately identify or document if the subrecipients required a single audit for 5 of 8 sampled subrecipients. Therefore, DNR did not monitor these subrecipients to ensure the status or submission of their single audit reports, if applicable. For these five subrecipients, we reviewed the FAC and noted the subrecipients did not submit a single audit report to the FAC during fiscal year 2025. Criteria Federal regulation 2 CFR 200.501 requires nonfederal entities who expend $750,000 or more in federal awards during their fiscal year to obtain a single audit for that fiscal year. Also, federal regulation 2 CFR 200.332(f) requires the pass-through entity to verify these subrecipients are audited as required by Subpart F of the Uniform Guidance, Audit Requirements, when it is expected the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the $750,000 threshold. In addition, federal regulation 2 CFR 200.521(d) requires the pass-through entity to issue a management decision letter on the appropriateness of all audit findings related to its federal awards and the subrecipient's corrective action plan within six months of acceptance by the FAC. Cause For part a., EGLE informed us its subrecipient expenditure query was limited to only EGLE expenditure data because of an oversight, which prevented the identification of all subrecipients exceeding the single audit threshold. For part b., DNR informed us its subrecipient expenditure query did not include sufficient CSLFRF coding because of an oversight, which prevented the identification of all CSLFRF subrecipients. Effect EGLE and DNR limited the State's assurance their subrecipients complied with grant requirements and implemented corrective actions for audit findings to prevent future sanctions or disallowed costs, which could necessitate adjustments to their records. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend EGLE and DNR properly monitor their subrecipients to ensure they comply with the Uniform Guidance. Management Views EGLE and DNR agree with the finding.

FINDING 2025-052 Low-Income Home Energy Assistance, ALN 93.568, Subrecipient Monitoring - Subrecipient Audits See Schedule of Findings and Questioned Costs for chart/table. Condition The Department of Licensing and Regulatory Affairs (LARA) did not properly monitor its Michigan Energy Assistance Program (MEAP) subrecipients to ensure they complied with the Uniform Guidance. LARA did not have an adequate process to identify or document if the subrecipient required a single audit and steps taken to determine whether a management decision letter was needed. We reviewed the FAC and noted 6 of 8 MEAP subrecipients submitted single audit reports to the FAC in fiscal year 2024 and/or fiscal year 2023. We verified there were no findings related to the subrecipients' LIHEAP federal awards. Criteria Federal regulation 2 CFR 200.501 requires nonfederal entities who expend $750,000 or more in federal awards during their fiscal year to obtain a single audit for that fiscal year. Also, federal regulation 2 CFR 200.332(f) requires the pass-through entity to verify these subrecipients are audited as required by Subpart F of the Uniform Guidance, Audit Requirements, when it is expected the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the $750,000 threshold. In addition, federal regulation 2 CFR 200.521(d) requires the pass-through entity to issue a management decision letter on the appropriateness of all audit findings related to its federal awards and the subrecipient's corrective action plan within six months of acceptance by the FAC. Cause LARA informed us it did not have a process in place to document its review of MEAP subrecipient single audits. Effect LARA limited the State's assurance its subrecipients complied with grant requirements and implemented corrective actions for audit findings to prevent future sanctions or disallowed costs, which could necessitate adjustments to their records. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend LARA monitor its MEAP subrecipients to ensure they comply with the Uniform Guidance. Management Views LARA agrees with the finding.

2025-002 – Subrecipient Monitoring - Lack of evidence of subrecipient Uniform Guidance report reviews Cluster: Research and Development Sponsoring Agency: Various agencies Award Names: Southeast Region Cybersecurity Collaboration Center (SERC3), Establish, manage, and maintain a public-private partnership (PPP) additive manufacturing (AM) consortium for the Rapid Manufacturing Propulsion Technology (RAMPT), Developing effective adaptation strategies to enhance the resilience of farmers under changing climate, Towards a sustainable bioeconomy: Biotransformation of paper mill sludge for value-added chirally pure (R)-1,3-butanediol production, A systems approach to perennial forage management using plant growth-promoting rhizobacteria Award Numbers: 212514, 208409, 200987, 205258, and 205264 Assistance Listing Title: Cybersecurity, Energy Security & Emergency Response (CESER), Science, Integrative Activities, and Agriculture and Food Research Initiative (AFRI) Assistance Listing Number: 81.008, 43.RD, 47.083, and 10.310 Award Year: 2024 - 2025 Pass-through entity: UT-Batelle LLC, RPM Innovations, Inc., New Mexico State University, Regents of the University of California, and University of Tennessee Criteria 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Condition Through our testing of 24 subrecipients, we noted the following: • For the Research and Development Cluster, 5 out of 24 samples tested did not have supporting documentation to verify Auburn’s review of subrecipient’s financial statements and/or Uniform Guidance report available. Cause The University indicated subrecipient reviews were not consistently performed in accordance with 2 CFR 200.501. Additionally, due to a lack of clearly defined roles, responsibilities, and documentation practices among the existing team members within the Office of Sponsored Programs, the Uniform Guidance requirements (and related University procedures) around subrecipient reviews were not consistently performed and/or documented. Effect The inconsistency of reviews performed over subrecipient financial statements and Uniform Guidance reports may result in ineligible subrecipients receiving federal awards, subrecipient findings not being fully remediated, and other applicable procedures not being performed timely and appropriately. Questioned Costs None noted. Repeat Finding Yes. Repeat of finding 2024-002. Recommendation We recommend that the University reassess the design of its controls around the review process of subrecipient financial statements and Uniform Guidance reports. The University should ensure its procedures properly address the review process of this information, including timeliness and appropriate personnel. The University should also ensure these annual reviews are being appropriately documented and the documentation is being maintained properly. Management’s Views and Corrective Action Plan Management’s Views and Corrective Action Plan are included at the end of this report after the summary schedule of prior audit findings and status

The Uniform Guidance, 2 CFR 200.332(e), requires non-Federal entities to monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. During our review of subrecipient monitoring, the Alabama Law Enforcement Agency (ALEA) did not provide documentation to support its monitoring activities for the 7 subrecipients reviewed. ALEA did not have adequate procedures in place to ensure subrecipients were monitored in accordance with the Uniform Guidance. As a result, ALEA did not ensure subrecipients were in compliance with federal requirements.

Finding Number 2025-003 Instance of Non-Compliance: Reporting Assistance Listing Numbe: 11.012 Questioned Cost: $ 0 Significant Deficiency Federal Agency: U.S. Department of Commerce Criteria: According to grant terms & conditions and 2 CFR Section 200.332, all awardees of applicable grants and cooperative agreements are required to report to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System on all subawards over $30,000. Required reporting includes timely and accurate information regarding subaward amounts, dates, and other key subaward data. Condition: NERACOOS submitted FFATA reports for the initial subaward agreements; however, the reports were not updated timely for subsequent subaward amendments. Specifically, amended subaward amounts and amendment dates were not reported timely and accurately in SAM.gov. Context: The condition was identified during our review of grant terms and conditions, 2 CFR § 200.332 requirements, and FFATA reporting for selected subawards subject to reporting requirements. Cause: NERACOOS did not have sufficient controls in place to ensure that amendments to subaward agreements were identified, tracked, and reported timely in SAM.gov. In addition, the review process did not ensure that amended subaward amounts and amendment dates were updated accurately after subaward modifications were executed. Effect: NERACOOS was not in compliance with FFATA reporting requirements for fiscal year 2025. Although all initial subawards tested were reported, subsequent amendments were not reported timely and the reported subaward amounts were not updated accurately. Following is a summary of the finding: (See pdf for table) Identification of a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that management strengthen controls over FFATA reporting by implementing procedures to identify and track all subaward amendments subject to FFATA reporting requirements. Management should ensure that amended subaward amounts, amendment dates, and other required information are updated in SAM.gov timely and accurately. We further recommend that management perform a periodic review of FFATA reports on SAM.gov to verify completeness and accuracy of reported subaward information. Views of Responsible Officials and Planned Corrective Action Plan: Management concurs with this finding. NERACOOS acknowledges that while initial subaward reporting was completed as required, the organization did not have adequate controls to ensure that subaward amendments were identified, tracked, and reported timely and accurately in SAM.gov pursuant to 2 CFR § 200.332 and FFATA requirements. NERACOOS will develop and implement written FFATA reporting procedures that specifically address the identification and reporting of subaward amendments, including trigger points for updating SAM.gov following execution of any subaward modification. Responsible Official: Emily Silva, Administrative Director Anticipated Completion Date: August 31, 2026 (retroactive corrections); ongoing quarterly reconciliation beginning July 2026

2025 – 002 Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: HIV Emergency Relief Project Grants HIV Care Formula Grants ALN: 93.914 93.917 Pass-Through Agency: Texas Department of State Health Services Pass-Through Number(s): N/A Award Number and Period: HIV Emergency Relief Project Grants H89HA00014-34, H89HA00014-35 March 1, 2024 – February 28, 2025, March 1, 2025 – February 28, 2026 HIV Care Formula Grants HHS001122200003 April 1, 2022 – March 31, 2026 Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Section III – Findings and Questioned Costs – Major Federal Programs (Continued) 2025 – 002 Subrecipient Monitoring – Missing Contract Elements (Continued) Criteria or specific requirement: Per 2 CFR 200.303(a), Dallas County must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), federal award identification number (FAIN), federal award date of award to the recipient by the granting agency, and the name of federal awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: HIV Emergency Relief Project Grants – The UEI was not included in any of the five subaward agreements selected for testing. The start and end dates for the agreements were March 1, 2024 – February 28, 2025. HIV Care Formula Grants – The UEI, FAIN, federal award date of award to the recipient by the granting agency, and the name of federal awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity were not included in any of the five subaward agreements selected for testing. The start and end dates for the agreements were March 1, 2024 – February 28, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR 200 §200.332 prior to execution is not at the correct precision level. Effect: As required subaward information was left out of contracts, Dallas County increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing contract elements may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) 2025 – 002 Subrecipient Monitoring – Missing Contract Elements (Continued) Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: See corrective action plan.

2025-001 – Communications with Subrecipients Finding Type: Significant Deficiency in internal control over compliance / noncompliance Program: ALN 93.788 – State Opioid Response Criteria: As required by 2 CFR 200.332, the pass-through entity must communicate specific information to subrecipients, as applicable. Condition: Contracts with subrecipients did not include portions of required disclosures. Cause/Effect: Inadequate internal controls over compliance. Select contracts were not in compliance with 2 CFR 200.332. Questioned Cost: None. Recommendation: We recommend that the PIHP update all contracts with subrecipients to include required language. View of Responsible Official: Management is in agreement with this recommendation.

Significant Deficiency in Internal Control Over Compliance and Noncompliance Related to Management Decisions for Subrecipient Audit Findings Identifying Award Information Federal Agency: U.S. Department of Commerce, National Oceanic and Atmospheric Administration (NOAA) Assistance Listing Number: 11.472 Federal Program: Unallied Science Program Criteria Under the requirements for pass-through entities in 2 CFR 200.332, 2 CFR 200.521, and related sections, the pass-through entity is required to monitor the activities of a subrecipient. This includes among other things, obtaining the Single Audit reports for the subrecipient and identify any findings report directly related to the pass-through entity’s subaward to the subrecipient. The pass-through entity is responsible for issuing a management decision for audit findings that affect subawards it issues to subrecipients under a Federal award. Condition and Context Among the five sub-awards we tested, one subrecipient had an audit finding directly related to NPRB’s subaward to that subrecipient. NPRB did not retain documentation evidencing that NPRB followed up with the subrecipient to issue a management decision related to the finding. Cause NPRB did not have procedures and controls in place to ensure the required management decisions were issued to subrecipients. Effect NPRB did not comply with the manage decision requirement for pass-through entities that are codified in Title 2 U.S. Code of Federal Regulations. Known Question Costs Not applicable. Repeat Finding This is not a repeat finding. Recommendations We recommend that management update procedures to ensure subrecipient Single Audit reports are reviewed and management decisions are communicated, and related documentation is retained. Views of Responsible Officials Management concurs with the finding and has provided the attached corrective action plan.

Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Special Education – Grants for Infants and Families Temporary Assistance for Needy Families (TANF) Block Grants for Prevention and Treatment of Substance Abuse ALN: 84.181 93.558 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Special Education – Grants for Infants and Families H181A200171, H181A210171, H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024, July 1, 2024 – September 30, 2025, July 1, 2025 – September 30, 2026 TANF 2001TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF and 2501TXTANF October 1, 2019 – September 30, 2020, October 1, 2020 – September 30, 2021, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI083054, 1B08TI083478, 1B08I084673, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2019 – September 30, 2021, October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), assistance listings numbers (ALN), and title of the program. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Special Education – Grants for Infants and Families (SEGIF) –The UEI was not included in the base subaward agreement for seven of the eight agreements selected for testing. The last amendment to the original agreement included the UEI number, however, it did not reference the ALN and title of the program. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Temporary Assistance for Needy Families – The ALN and title of the program was not included in four of the seven subaward agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Block Grants for Prevention and Treatment of Substance Abuse –The UEI was not included in one of the 18 agreements selected for testing. The start and end dates for the agreement was September 1, 2020 – August 31, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR §200.332 prior to execution is not at the correct precision level. Effect: Because required subaward information was omitted, HHSC increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing UEI, ALN, and program titles may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: HHSC concurs with the recommendation.

Findings and Questioned Costs Relating to Federal Awards: Finding 2025 001 Timeliness of Subrecipient Monitoring Federal Agency: National Science Foundation U.S. Department of Defense U.S. Department of Health and Human Services Program Name: Research and Development (R&D) Cluster ALN #: 12.910/47.041/47.049/93.213/93.286/93.399/93.837/93.838/93.865 Federal Award Numbers: FA8650 21 2 7119 P00014/EEC 2330040 001/CHE 2221346/ 5R01AT010413 04/5U54EB027049 08/5UG1CA242643 06/ 5UH3HL165065 04/5U01HL146240 07 Revised/ 5U01HL146408 06 Revised Federal Award Year: September 1, 2024 – August 31, 2025 Compliance Requirement: Subrecipient Monitoring Criteria According to 2 CFR 200.332(d), a pass through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subawards, and that the subaward performance goals are achieved. According to 2 CFR 200.332(d)(3) and 2 CFR 200.521, a pass through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure subrecipient single audit reports are reviewed and completed in a timely manner and management decisions are issued within required timeframes. Condition Found The University is required to review the single audit reports received from its subrecipients and issue management decision letters (MDL) within six months of the date of acceptance of the single audit report by the Federal Audit Clearinghouse (FAC). During our testwork over 40 subrecipients, we noted the following: For 3 subrecipients, the University did not issue an MDL in a timely manner. The delay in issuing this MDL was 42 to 167 days beyond the required timeframe. For 11 subrecipients, while the University did review the subrecipient’s single audit report, the review did not occur within the prescribed six month timeframe. The delay in reviewing the subrecipient's single audit reports was 2 to 140 days beyond the required timeframe. Cause The management review controls implemented by the University were not operating at a level of precision to ensure the University completed and documented the monitoring procedures timely primarily due to turnover. The delay occurred during the University’s corrective action period related to a similar finding from the previous year. Possible Asserted Effect Failure to complete and perform reviews of subrecipient single audit reports and issue MDLs in a timely manner may result in subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Questioned Costs None Repeat Finding A similar finding was reported in the prior year audit as finding 2024 001. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Recommendation We recommend the University establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Views of University Officials The University agrees with this finding. Delays occurred during the corrective action period associated with the prior year findings. The University has implemented additional monitoring and tracking procedures indented to strengthen the timeliness of subrecipient reviews and management decision issuance going forward

Finding: 2025-003: Documentation of Subrecipient Monitoring Condition: The Organization did not maintain documentation to demonstrate compliance with the requirements for subrecipient monitoring in accordance with 2 CFR 200, Subpart D for the year ended August 31, 2025. Criteria: The Organization is required to maintain documentation to demonstrate compliance with the requirements for subrecipient monitoring in accordance with 2 CFR 200, Subpart D (2 CFR section 200.332). Cause: Management was not aware of the requirement under 2 CFR 200, Subpart D requiring the Organization to maintain documentation to demonstrate compliance with the requirements for subrecipient monitoring. Effect: While the Organization did not maintain documentation to demonstrate compliance with the requirements for subrecipient monitoring in accordance with 2 CFR 200, Subpart D for the year ended August 31, 2025, the Organization provided a detailed description of the ongoing direct contact with the subrecipient to monitor its activities and compliance with regulations and terms of the prime and subawards. Recommendation: We recommend that management of the Organization adopt written policies procedures for maintaining documentation to demonstrate compliance with the requirements for subrecipient monitoring in accordance with 2 CFR 200, Subpart D. Response: Management accepts the recommendation and is working to develop an updated financial policies and procedures manual that provides for maintaining documentation to demonstrate compliance with the requirements for subrecipient monitoring to meet Federal compliance requirements.

Item: 2025-002 Assistance Listing Number: 17.280 Program: WIOA Dislocated Worker National Reserve Demonstration Grants Federal Agency: U.S. Department of Labor Pass-Through Agencies: n/a Contract/Pass-Through Grantor Identifying Number: 23A60YP000003 Award Year: September 30, 2023 to September 30, 2026 Compliance Requirement: Subrecipient Monitoring Criteria: A Pass-Through Entity (PTE) is required to monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: (a) reviewing financial and programmatic (performance and special reports) required by the PTE, (b) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means, and (c) issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR 200.521. Condition: The Foundation did not complete the required subrecipient monitoring related to review of subrecipient Single Audits and financial statements. Specifically, we noted no evidence that the Foundation verified whether certain subrecipients met the Single Audit threshold under 2 CFR 200.501 or obtained the subrecipients’ Single Audit reporting packages from the Federal Audit Clearinghouse. Additionally, the Foundation did not obtain or document a review of the subrecipients’ audited financial statements (or other financial information) to inform the subrecipient risk assessment under 2 CFR 200.332(b). Questioned Costs: n/a Context: Our testing included the Foundation’s two subrecipients with subawards totaling $225,335 during the audit period. For each subrecipient, we noted that the Foundation did not complete the required subrecipient monitoring related to review of subrecipient Single Audits and financial statements. Specifically, we noted no evidence that the Foundation verified whether certain subrecipients met the Single Audit threshold under 2 CFR 200.501 or obtained their Single Audit reporting packages from the Federal Audit Clearinghouse. Additionally, the Foundation did not obtain or document a review of the subrecipients’ audited financial statements (or other financial information) to inform the subrecipient risk assessment under 2 CFR 200.332(b). Effect: The Foundation is not in compliance with certain subrecipient monitoring requirements. This is deemed to be a material weakness in internal control over compliance. Cause: The Foundation did not have sufficient internal controls over subrecipient monitoring. Specific contributing factors included: (a) lack of formal, documented procedures assigning responsibility for obtaining and reviewing subrecipient single audit reports and/or reviewing financial statements, and (b) lack of formal training on Uniform Guidance subrecipient monitoring requirements. Identification as a Repeat Finding: Not a repeat finding. Recommendation: For the current audit period, we recommend the Foundation obtain missing Single Audit reports and financial statements, complete and document the required reviews, update subrecipient risk ratings, and perform any necessary follow-up or management decisions. Additionally, we recommend the Foundation establish formal written procedures to comply with 2 CFR 200.332(b), (d), and (f), 2 CFR 200.501, and 2 CFR 200.521, including clear steps and timelines for verifying Single Audit applicability, obtaining and reviewing Single Audit reports, and issuing management decisions when applicable. Additionally, for subrecipients not subject to the Single Audit, the Foundation should obtain annual audited financial statements (or other appropriate financial information) and performing a documented financial review to inform the risk assessment. Lastly, the Foundation should provide periodic training to finance and program staff on subrecipient monitoring requirements under the Uniform Guidance. Views of Responsible Officials: Management of the Foundation concurs with the finding. See Corrective Action Plan.

Assistance Listing, Federal Agency, and Program Name - 20.507, Department of Transportation, Federal Transit Cluster Federal Award Identification Number and Year - MI 2022-032, MI 2022-048, and MI 2023-027 Pass through Entity - N/A Finding Type - Significant deficiency and material noncompliance with laws and regulations Repeat Finding - No Criteria - Per the Uniform Guidance at 2 CFR 200.332, the pass through entity (SMART) must monitor the activities of a subrecipient as necessary to ensure that the subawards comply with federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition - The Authority did not provide sufficient evidence that there was adequate monitoring of subrecipients. Questioned Costs - None If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - Not applicable Identification of How Questioned Costs Were Computed - Not applicable Context - It was identified in the 2025 triennial review that the Authority's procedures and documentation of subrecipient oversight was not adequate. The Authority had two subrecipients during fiscal year 2025, and one of the subrecipients was not adequately monitored based on the funding received. Cause and Effect - The Authority did not provide sufficient evidence for adequate monitoring of subrecipients during the triennial review. Recommendation - We recommend the Authority strengthen subrecipient procedures and maintain evidence that these procedures were performed according to schedule. Views of Responsible Officials and Corrective Action Plan - The Authority is in agreement with this finding. The Authority has reviewed and corrected procedures related to monitoring subrecipients.

Finding 2025 - 001 Lack of Subrecipient Monitoring Procedures – Subrecipient Risk Assessments Federal Agencies: U.S. Department of State and U.S. Agency for International Development Federal Programs: Bureau of Population, Refugees and Migration Overseas Refugee Assistance Programs East Asia; Foreign Assistance for Programs Overseas Assistance Listing Numbers:19.523 and 98.001 Pass-through Entities: JSI Research & Training Institute, Inc. and RTI International Award Identification Number and Year: SPRMCO24CA0083, 2024; 7200AA22CA00011, 2022 and 72066923CA00003, 2023 Criteria or Specific Requirement: According to 2 CFR § 200.332(c), pass-through entities are required to: “Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring.” This risk assessment must consider factors such as the subrecipient’s prior experience with similar awards, results of previous audits, new personnel or systems, and the extent of Federal monitoring. Condition: BRAC USA did not adequately document the results of it's risk assessment procedures of its subrecipients prior to issuing subawards, as required by 2 CFR § 200.332(c). During our review of two subawards issued during the audit period, we noted that management did not formally document any evaluation of subrecipient risk related to program compliance, financial stability, or internal controls. Cause: The entity had not developed or implemented formal procedures to adequately document subrecipient risk prior to making subawards. Management was not aware of the documentation requirement or had not prioritized its implementation. Effect or Potential Effect: Without documenting subrecipient risk assessments, BRAC USA cannot ensure that the level of subrecipient monitoring is appropriate to mitigate risks of noncompliance or misuse of Federal funds. This increases the likelihood of unallowable costs, noncompliance with Federal regulations, and potential questioned costs. Questioned Costs: Costs associated with qualitative monitoring measures are not identifiable. Context: During our audit, we examined subawards for two subgrantees for which total expenditures aggregated $1,683,098 (approximately 67% of the total Federal expenditures passed through to subrecipients). Identification as a Repeat Finding, if applicable: Not a repeat findingRecommendation: The entity should establish and implement written procedures to perform and document subrecipient risk assessments prior to awarding Federal funds. The procedures should include standardized criteria—such as prior audit results, experience with similar programs, financial stability, and management capacity—to determine risk levels and guide monitoring activities.

2025-003 Lack of Formal Subrecipient Monitoring Program Name/Assistance Listing Number: 93.788 Opioid STR Federal Agency: Department of Health and Human Services Type of Finding: Significant Deficiency Compliance Requirement: Subrecipient Monitoring Criteria: According to 2 CFR §200.332 (Requirements for Pass-Through Entities), a pass-through entity must monitor the activities of subrecipients as necessary to ensure that federal funds are used for authorized purposes and in compliance with applicable statutes, regulations, and terms and conditions of the Federal award. Required monitoring includes, but is not limited to, the following: a. Reviewing financial and programmatic reports; b. Performing risk assessments of subrecipients; c. Following up on deficiencies identified through audits or reviews; and d. Ensuring subrecipients have required audits under 2 CFR §200.501. Lack of documented subrecipient monitoring constitutes noncompliance with Uniform Guidance. Condition: During our walkthrough and review of the Organization’s grant management processes, we noted that the Organization does not have formal subrecipient monitoring policies or procedures in place. While a monitoring memo exists, it documents only an informal process and does not provide structured oversight. Specifically: - No risk assessments, monitoring checklists, or follow-up documentation were maintained. - There is no formalized, structured process or standard for overseeing subrecipient activities. - Required monitoring under 2 CFR §200.332 could not be performed. Cause of Condition: Management has not developed formal policies and procedures for subrecipient monitoring or consistent documentation standards. Potential Effect of Condition: Noncompliance: Failure to monitor subrecipients increases the risk of noncompliance with Uniform Guidance requirements. Questioned Costs: Federal program expenditures passed through to subrecipients may become subject to questioned costs if insufficient oversight results in unallowable or unsupported charges. Financial & Operational Risk: The Organization may be exposed to reputational or financial consequences, including funding restrictions, if the lack of monitoring persists. Questioned Cost: Not quantifiable. Recommendation: We recommend the Organization develop and implement formal policies and procedures for subrecipient monitoring, including: a. Conducting and documenting subrecipient risk assessments; b. Establishing structured monitoring procedures, such as periodic reviews, report evaluations, and follow-ups; c. Maintaining written documentation of all monitoring activities; and d. Implementing policies to ensure consistent oversight of subrecipient performance and compliance. Description of the Nature and Extent of Issues Reported: The Organization did not perform or document any formal subrecipient monitoring activities during the fiscal year. This constitutes noncompliance with 2 CFR §200.332. Management Response: Management concurred with the finding. In the future, the organization will require midyear and year-end impact reports from each grant subrecipient.

Subrecipient Monitoring Departments of Education Passed through Minnesota Department of Education Federal Financial Assistance Listing 84.027/84.173 Special Education Cluster Condition: During our audit, we found that RAED did not have proper subrecipient monitoring documentation related to approvals and communication of subaward terms and conditions. Criteria: 2 CFR section 200.332, Requirements for pass-through entities, requires RAED to communicate subaward terms and conditions with subrecipient and to monitor the subawards for authorized purposes in compliance with Federal statutes, regulation and the terms and conditions. Cause: Communication to subrecipients about terms and conditions of the subaward was not sent out during the fiscal year. It was also noted that there was a missed approval of a reimbursement request during staff turnover. Effect: RAED is not incompliance with Federal Award Programs. Recommendation: We recommend RAED review their procedures in place to determine if any improvements can be made to ensure compliance with subrecipient monitoring. Management Response: There is no disagreement with the audit finding.

Finding 2025-002: Subrecipient Monitoring Criteria: The Uniform Guidance (2 CFR §200.332) requires a non-Federal entity to monitor the activities of its subrecipients as necessary to ensure that Federal awards are used for authorized purposes in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specifically, the Sponsoring Organization is required to perform specific monitoring activities, including site visits, for its CACFP subrecipients (centers/homes). To ensure that these required monitoring activities are occurring timely and correctly, the Sponsoring Organization's internal controls include a requirement for monthly meetings between the Program Manager and the Monitoring Specialist to review the status of subrecipient monitoring. Condition: During the review of internal controls related to subrecipient monitoring, it was noted that the required monthly meetings between the Program Manager and the Monitoring Specialist were not consistently performed throughout the fiscal year. Specifically, for the 12-month period tested, the required monthly reviews were not documented for 3 out of 12 months. Cause: The lapse in the required monthly reviews was attributed to staff turnover in the program office and competing priorities that diverted staff time away from this control activity. Effect: The lack of consistent management oversight through the required monthly meetings increases the risk that mandatory subrecipient monitoring activities (e.g., required site visits, review of subrecipient documentation) could be delayed, missed, or performed inadequately. This could result in non-compliance by the subrecipients going undetected, potentially leading to inaccurate claims and funds being used for unauthorized purposes. Questioned Costs: None noted. Context: This is the first year this finding has been reported. The internal control deficiency appears to be a breakdown in the execution of the established procedure rather than an absence of a control. Repeat Finding: No. This is the first time this specific finding has been identified. Recommendation: We recommend that management reinforce the importance of this control and implement a documented process to ensure that the monthly meetings between the Program Manager and the Monitoring Specialist occur consistently. This should include establishing a recurring meeting schedule and requiring documentation (e.g., signed meeting minutes, checklist) that demonstrates the review of monitoring status took place each month, even during periods of staff turnover or high-priority competing demands.

Finding 2025-003: Subrecipient Monitoring Criteria: The Uniform Guidance (2 CFR §200.332) requires a non-Federal entity to monitor the activities of its subrecipients as necessary to ensure that Federal awards are used for authorized purposes in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Furthermore, the Organization's policy and/or CACFP regulations governing the Sponsoring Organization require an initial on-site review of each new center or Family Child Care (FCC) provider within the first 28 calendar days of program operation. This is a critical component of initial subrecipient monitoring to ensure program integrity and compliance with Federal requirements. Condition: The Sponsoring Organization did not consistently perform the required initial on-site review for new subrecipients (centers and FCC providers) within the mandatory 28-day timeframe. A sample of 40 new centers/FCC providers was selected for testing. Four (4) of the 40 subrecipients (10%) did not have their initial on-site review completed within the first 28 days of operation. The delays in conducting the initial reviews ranged from 6 to 23 days past the required 28-day deadline. Cause: The cause appears to be an inadequate internal control or process to ensure initial review scheduling and completion are prioritized and managed to meet the 28-day deadline, potentially due to competing demands or staffing limitations. Effect: Failure to conduct initial on-site reviews within the required timeframe weakens the Sponsoring Organization's internal controls over subrecipient monitoring and oversight. Timely initial reviews are essential for early identification and correction of compliance issues, proper training, and ensuring new centers/FDCH providers operate in accordance with Federal CACFP requirements from the outset. Questioned Costs: None noted. Context: This is the first time this issue has been noted as a finding. The Sponsoring Organization performed the required reviews; however, they were completed after the regulatory deadline. Repeat Finding: No. This is the first time this specific finding has been identified. Recommendation: The Sponsoring Organization should strengthen its internal controls and monitoring procedures to ensure that all new centers and FCC providers receive the required initial on-site review within the 28-day mandatory timeframe. This should include: 1. Establishing a formal process with documented timeframes for assigning and completing initial reviews immediately upon a new site's approval. 2. Implementing a system to track and alert monitoring staff of the 28-day deadline for each new subrecipient. 3. Providing targeted training to monitoring staff to emphasize the importance of timely initial reviews and the associated regulatory deadlines.

Finding: 2025-002 Subrecipient Monitoring (Significant Deficiency) Federal Agency(ies): United States Department of Agriculture Federal Program(s): Partnerships for Climate-Smart Commodities Assistance Listing Number(s): 10.937 Pass-through Entity (if applicable): N/A Award Identification Number and Year: NR233A750004G045 (2023) Criteria or Specific Requirement: Per 2 CFR 200.332 Requirements for pass-through entities:  Pass-through entities must clearly identify to subrecipients the award information, including the Assistance Listing number, subrecipient’s UEI, Federal award identification number, and Federal award project title (§200.332(a)(1)).  Pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate subrecipient monitoring (§200.332(b)).  Pass-through entities must monitor the activities of subrecipients as necessary to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward (§200.332(d)). Condition: During our testing of subrecipient monitoring, we noted several deficiencies: 1. Subaward agreements were structured more like subcontracts rather than subrecipient agreements and did not include all elements required under 2 CFR 200.332(a), such as the subrecipient’s UEI and Assistance Listing number. 2. Subrecipients were required to submit periodic invoices for reimbursement instead of financial reports detailing costs incurred by budget line item, cumulative expenditures, cash receipts, and cash balances. 3. Pre-award risk assessments were completed; however, the assessments were undated, preventing the audit team from verifying that they occurred prior to subaward execution. Additionally, the monitoring procedures described in policy were not clearly linked to assessed risk levels, and in certain instances, subrecipients with no prior Federal grant management experience were assigned a “low risk” classification. Cause: These conditions occurred due to a lack of formalized procedures to align subrecipient agreements, reporting requirements, and monitoring activities with the specific requirements of 2 CFR 200.332. Management relied on existing subcontract templates and internal policies that were not fully updated to reflect Uniform Guidance requirements. Effect or Potential Effect: Failure to properly structure subaward agreements, and obtain adequate financial reporting, increases the risk that subrecipients may not comply with Federal statutes and regulations. Questioned Costs: N/A Context: We tested a statistically valid sample of subawards charged to Federal awards. The deficiencies noted were consistent across the sample population, indicating a systemic issue rather than isolated exceptions. Identification as a Repeat Finding, if Applicable: Yes, repeat of Finding 2024-002Recommendation: We recommend that management:  Update subaward agreement templates to include all elements required under 2 CFR 200.332(a).  Require subrecipients to submit periodic financial reports by budget line item, cumulative expenditures, cash receipts, and cash balances, rather than invoices alone.  Revise pre-award risk assessment procedures to include dating and ensure that results are documented prior to subaward execution.  Strengthen policies to ensure monitoring procedures are explicitly linked to risk assessment results, with higher levels of oversight required for subrecipients new to Federal grant management.

Findings and Questioned Costs Relating to Federal Awards: 2025-001 Compliance Finding: Subrecipient Monitoring-Audit Verification. Federal Agengy: Department of the Treasury. Pass-through Entity: SC Rural Infrastructure Authority. Federal Program: Coronavirus State and Local Fiscal Recovery Funds(CSLFRF)-Water Capacity Improvments. Assistance Listing Number: 21.027. Criteria. In accordance with 2 CFR 200.332(g) a pass-through entity must verify that a subrecipient is audited as required by subpart F. Subpart F: 200.501 Audit Requirements. (a) Audit required. A non-Federal entity that expends $1,000,000 ($750,000 prior to the 2024 uniform Guidance (UG) revisions) or more during the non-Federal enity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. Condition. Cherokee County did not adequately verify that the subrecipient obtained the required single audit or program specific audit in accordance with 2 CFR 200.332. Although Cherokee County was aware that the subrecipient would be subject to audit requirements based on federal expenditures, Cherokee County did not obtain or otherwise confirm receipt of the required audit report by the applicable submission deadline of September 30, 2025. Upon further inquiry it was determined that the subrecipient did not have a single audit or program-specific audit by September 30, 2025. Cause. The County did not perform sufficient follow-up procedures to confirm subrecipient compliance with single audit requirements after being notified that the subrecipient would be subject to audit for the year ended December 31, 2024. Effect. Failure to verify receipt of the required audit prevented Cherokee County from complying with their policies and procedures and with federal regulation in a timely manner. Recommendation. We recommend that Cherokee County enhance its subrecipient monitoring procedures to include documented follow-up and verification that subrecipients subject to single audit requirements submit the required audit reports within the applicable timeframes, in accordance with 2 CFR 200.332.

Federal Program: Temporary Assistance for Needy Families (TANF) (93.558). Criteria: 2 CFR 200.332(d) requires pass-through entities to monitor the activities of subrecipients to ensure compliance with federal statutes, regulations, and the terms and conditions of the subaward. Required monitoring activities include reviewing financial and performance reports, following up on deficiencies, and ensuring timely corrective action. Condition: The Council did not perform required monitoring procedures for subrecipients as required by Uniform Guidance: Cause: The Council lacked formal procedures and controls for tracking and reviewing subrecipient audit reports and for documenting follow-up on identified deficiencies. Effect: There is an increased risk that subrecipients may not comply with federal requirements, which could result in unallowable costs, questioned costs, or other noncompliance with federal statutes and regulations. Questioned Costs: None. Context: This finding was noted in 3 out of 4 subrecipients for the fiscal year ended June 30, 2025 with a total of $124,302 paid to subrecipients. Repeat Finding: No. Recommendation: We recommend the client implement and document formal procedures to ensure all required subrecipient monitoring activities are performed in accordance with Uniform Guidance, including obtaining and reviewing subrecipient audit reports and following up on any identified deficiencies. Views of Responsible Officials: Management concurs with the finding and will implement corrective action.

Finding Reference Number: 2025-001 Federal Program: CFDA 93.959– Block Grants for Prevention and Treatment of Substance Abuse Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: Lutheran Service Florida, Inc. Award Year: FY 2025 Criteria: Per 2 CFR §200.332(d), pass-through entities must monitor the activities of subrecipients to ensure that federal awards are used for authorized purposes and in compliance with laws, regulations, and the provisions of the subaward. Monitoring includes reviewing performance and financial reports required by the subaward agreement. Condition: The pass-through entity conducted appropriate monitoring activities for the subrecipient Bradford Community Coalition, Inc., including communication and oversight consistent with federal requirements. However, the subrecipient did not submit the required monitoring report by the established deadline. As of the audit report date, the report remained outstanding. Cause: While the pass-through entity fulfilled its monitoring responsibilities, the subrecipient failed to comply with reporting requirements in a timely manner. Effect: The absence of the monitoring report limits the pass-through entity’s ability to fully verify that the $39,406 in federal funds was used in accordance with applicable regulations. This may result in questioned costs due to insufficient documentation. Questioned Costs: $39,406 Recommendation: We recommend the pass-through entity continue its monitoring efforts and implement additional follow up procedures to ensure timely receipt of required reports. The entity should also consider revising subaward agreements to include stronger enforcement mechanisms for noncompliance. Views of Responsible Officials: The organization monitored the subrecipient in accordance with federal guidelines and has documented its oversight activities. We are working with the subrecipient to obtain the overdue report and have updated our procedures to escalate follow-up actions when reports are delayed.

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-014 Condition: For 2 out of 2 selections, the unique identifier number and federal award identification number were not included in the grant agreement. For 2 out 2 selections, evidence that the prior year Single Audit Report was reviewed was not provided. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (b) Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; and (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (f) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance for subrecipient monitoring. Effect: The subrecipient could not be in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls to ensure grant agreements include the unique identifier number and federal award identification number. We also recommend a process to ensure that the single audit of subrecipients are reviewed timely. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Labor (DOL) AL No. 17.258, 17.259, 17.278 Workforce Innovation and Opportunity Act (WIOA) Cluster Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Condition: For 2 out of 2 selections, the unique identifier number on the notice of award did not agree with the subrecipient's active registration UEI on SAM.gov. For 2 out of 2 selections, management was unable to provide evidence that subrecipient monitoring was performed to ensure compliance with accounting requirements. For 2 out of 2 selections, evidence that the prior year Single Audit Report was reviewed was not provided. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (b) Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. According to AM 413-60, Grant Documentation, Grant Manager/Program Manager/Director Conducts ongoing monitoring and control of all reimbursement receipts and deposits until grant ends; as well as all program and sub-recipient (when applicable) documentation, to include: (1) program documentation; (2) timesheets; (3) deliverables; (4) activities; (5) vendor payments; (6) program data/charts/numbers; and (7) financial and compliance report. According to AM 413-61, Grant Management Financial Reporting, Grant Manager/Program Manager/Director maintains all documentation, either electronic or hard copy, for all federally funded grants for the term of the grant for a minimum of seven years for review and audit by the granting agency or its designee. Cause: The Mayor’s Office of Employment Development (MOED) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: MOED may not be in compliance with the subrecipient monitoring requirements of its grants. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-022 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 1 out of 1 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR 200.303: Internal Control, the non-Federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: The Baltimore County Department of Health (BCHD) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-025 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 5 out of 6 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR 200.303: Internal Control, the non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: The Baltimore County Department of Health (BCHD) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-028 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 2 out of 5 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR §200.303: the non-federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: BCHD did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.