Findings Citing § 200.332

Finding 2025-001 Subrecipient Monitoring (Significant Deficiency) Information on the Federal Programs: Fish and Wildlife Cluster Criteria or Specific Requirement: Under 2 CFR 200.332, pass-through entities are required to evaluate each subrecipient’s risk of noncompliance to determine the appropriate monitoring, monitor subrecipient activities as necessary to ensure compliance with Federal requirements, and verify whether subrecipients that meet the Federal expenditure threshold have obtained a Single Audit. These responsibilities include performing and documenting a subrecipient risk assessment, conducting monitoring activities based on the assessed risk, and obtaining, reviewing, and following up on subrecipient Single Audit reports when applicable. Condition: The Organization does not maintain written policies or procedures that address required subrecipient monitoring activities. The Organization does not perform or document a risk assessment of subrecipients to evaluate their risk of material noncompliance and does not have monitoring procedures that correspond to an assessed level of risk. Additionally, the Organization does not have a policy or consistent practice for determining whether subrecipients are subject to Uniform Guidance Subpart F Single Audit requirements, nor does it obtain or review Single Audit reports from subrecipients that meet the required threshold. Cause: This condition exists because the Organization has not established formal internal controls or written procedures to ensure compliance with all Federal requirements related to subrecipient monitoring. Effect or Potential Effect: As a result, the Organization is not fully compliant with the requirements of 2 CFR 200.332, and there is an increased risk that subrecipient noncompliance may occur and remain undetected. The absence of appropriate risk assessment and monitoring procedures increases the likelihood that programmatic or financial issues at the subrecipient level could go unidentified. Failure to obtain and review required Single Audit reports also increases the risk that audit findings, questioned costs, or other compliance concerns may not be addressed by the Organization in a timely manner. Although no questioned costs were identified during our audit, the control deficiencies described above increase the risk of future questioned costs. Questioned Costs: N/A. Context: This finding was noted during our review of the Organization’s subrecipient monitoring practices and reflects a systemic lack of documented policies and procedures governing the required elements of risk assessment, monitoring, and Single Audit verification. Identification as a Repeat Finding, if Applicable: No. Recommendation: We recommend that the Organization develop and implement comprehensive written subrecipient monitoring policies and procedures that align with 2 CFR 200.332. These procedures should include conducting and documenting a risk assessment for each subrecipient, establishing monitoring activities that are responsive to the level of assessed risk, and implementing a process to determine whether subrecipients are required to obtain a Single Audit and to obtain, review, and follow up on those audit reports as necessary. Establishing these controls will help ensure compliance with Federal requirements and reduce the risk of undetected noncompliance at the subrecipient level.

Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Special Education – Grants for Infants and Families Temporary Assistance for Needy Families (TANF) Block Grants for Prevention and Treatment of Substance Abuse ALN: 84.181 93.558 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Special Education – Grants for Infants and Families H181A200171, H181A210171, H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024, July 1, 2024 – September 30, 2025, July 1, 2025 – September 30, 2026 TANF 2001TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF and 2501TXTANF October 1, 2019 – September 30, 2020, October 1, 2020 – September 30, 2021, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI083054, 1B08TI083478, 1B08I084673, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2019 – September 30, 2021, October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), assistance listings numbers (ALN), and title of the program. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Special Education – Grants for Infants and Families (SEGIF) –The UEI was not included in the base subaward agreement for seven of the eight agreements selected for testing. The last amendment to the original agreement included the UEI number, however, it did not reference the ALN and title of the program. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Temporary Assistance for Needy Families – The ALN and title of the program was not included in four of the seven subaward agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Block Grants for Prevention and Treatment of Substance Abuse –The UEI was not included in one of the 18 agreements selected for testing. The start and end dates for the agreement was September 1, 2020 – August 31, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR §200.332 prior to execution is not at the correct precision level. Effect: Because required subaward information was omitted, HHSC increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing UEI, ALN, and program titles may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: HHSC concurs with the recommendation.

Assistance Listing, Federal Agency, and Program Name - 20.507, Department of Transportation, Federal Transit Cluster Federal Award Identification Number and Year - MI 2022-032, MI 2022-048, and MI 2023-027 Pass through Entity - N/A Finding Type - Significant deficiency and material noncompliance with laws and regulations Repeat Finding - No Criteria - Per the Uniform Guidance at 2 CFR 200.332, the pass through entity (SMART) must monitor the activities of a subrecipient as necessary to ensure that the subawards comply with federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition - The Authority did not provide sufficient evidence that there was adequate monitoring of subrecipients. Questioned Costs - None If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - Not applicable Identification of How Questioned Costs Were Computed - Not applicable Context - It was identified in the 2025 triennial review that the Authority's procedures and documentation of subrecipient oversight was not adequate. The Authority had two subrecipients during fiscal year 2025, and one of the subrecipients was not adequately monitored based on the funding received. Cause and Effect - The Authority did not provide sufficient evidence for adequate monitoring of subrecipients during the triennial review. Recommendation - We recommend the Authority strengthen subrecipient procedures and maintain evidence that these procedures were performed according to schedule. Views of Responsible Officials and Corrective Action Plan - The Authority is in agreement with this finding. The Authority has reviewed and corrected procedures related to monitoring subrecipients.

Finding 2025 - 001 Lack of Subrecipient Monitoring Procedures – Subrecipient Risk Assessments Federal Agencies: U.S. Department of State and U.S. Agency for International Development Federal Programs: Bureau of Population, Refugees and Migration Overseas Refugee Assistance Programs East Asia; Foreign Assistance for Programs Overseas Assistance Listing Numbers:19.523 and 98.001 Pass-through Entities: JSI Research & Training Institute, Inc. and RTI International Award Identification Number and Year: SPRMCO24CA0083, 2024; 7200AA22CA00011, 2022 and 72066923CA00003, 2023 Criteria or Specific Requirement: According to 2 CFR § 200.332(c), pass-through entities are required to: “Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring.” This risk assessment must consider factors such as the subrecipient’s prior experience with similar awards, results of previous audits, new personnel or systems, and the extent of Federal monitoring. Condition: BRAC USA did not adequately document the results of it's risk assessment procedures of its subrecipients prior to issuing subawards, as required by 2 CFR § 200.332(c). During our review of two subawards issued during the audit period, we noted that management did not formally document any evaluation of subrecipient risk related to program compliance, financial stability, or internal controls. Cause: The entity had not developed or implemented formal procedures to adequately document subrecipient risk prior to making subawards. Management was not aware of the documentation requirement or had not prioritized its implementation. Effect or Potential Effect: Without documenting subrecipient risk assessments, BRAC USA cannot ensure that the level of subrecipient monitoring is appropriate to mitigate risks of noncompliance or misuse of Federal funds. This increases the likelihood of unallowable costs, noncompliance with Federal regulations, and potential questioned costs. Questioned Costs: Costs associated with qualitative monitoring measures are not identifiable. Context: During our audit, we examined subawards for two subgrantees for which total expenditures aggregated $1,683,098 (approximately 67% of the total Federal expenditures passed through to subrecipients). Identification as a Repeat Finding, if applicable: Not a repeat findingRecommendation: The entity should establish and implement written procedures to perform and document subrecipient risk assessments prior to awarding Federal funds. The procedures should include standardized criteria—such as prior audit results, experience with similar programs, financial stability, and management capacity—to determine risk levels and guide monitoring activities.

2025-003 Lack of Formal Subrecipient Monitoring Program Name/Assistance Listing Number: 93.788 Opioid STR Federal Agency: Department of Health and Human Services Type of Finding: Significant Deficiency Compliance Requirement: Subrecipient Monitoring Criteria: According to 2 CFR §200.332 (Requirements for Pass-Through Entities), a pass-through entity must monitor the activities of subrecipients as necessary to ensure that federal funds are used for authorized purposes and in compliance with applicable statutes, regulations, and terms and conditions of the Federal award. Required monitoring includes, but is not limited to, the following: a. Reviewing financial and programmatic reports; b. Performing risk assessments of subrecipients; c. Following up on deficiencies identified through audits or reviews; and d. Ensuring subrecipients have required audits under 2 CFR §200.501. Lack of documented subrecipient monitoring constitutes noncompliance with Uniform Guidance. Condition: During our walkthrough and review of the Organization’s grant management processes, we noted that the Organization does not have formal subrecipient monitoring policies or procedures in place. While a monitoring memo exists, it documents only an informal process and does not provide structured oversight. Specifically: - No risk assessments, monitoring checklists, or follow-up documentation were maintained. - There is no formalized, structured process or standard for overseeing subrecipient activities. - Required monitoring under 2 CFR §200.332 could not be performed. Cause of Condition: Management has not developed formal policies and procedures for subrecipient monitoring or consistent documentation standards. Potential Effect of Condition: Noncompliance: Failure to monitor subrecipients increases the risk of noncompliance with Uniform Guidance requirements. Questioned Costs: Federal program expenditures passed through to subrecipients may become subject to questioned costs if insufficient oversight results in unallowable or unsupported charges. Financial & Operational Risk: The Organization may be exposed to reputational or financial consequences, including funding restrictions, if the lack of monitoring persists. Questioned Cost: Not quantifiable. Recommendation: We recommend the Organization develop and implement formal policies and procedures for subrecipient monitoring, including: a. Conducting and documenting subrecipient risk assessments; b. Establishing structured monitoring procedures, such as periodic reviews, report evaluations, and follow-ups; c. Maintaining written documentation of all monitoring activities; and d. Implementing policies to ensure consistent oversight of subrecipient performance and compliance. Description of the Nature and Extent of Issues Reported: The Organization did not perform or document any formal subrecipient monitoring activities during the fiscal year. This constitutes noncompliance with 2 CFR §200.332. Management Response: Management concurred with the finding. In the future, the organization will require midyear and year-end impact reports from each grant subrecipient.

Subrecipient Monitoring Departments of Education Passed through Minnesota Department of Education Federal Financial Assistance Listing 84.027/84.173 Special Education Cluster Condition: During our audit, we found that RAED did not have proper subrecipient monitoring documentation related to approvals and communication of subaward terms and conditions. Criteria: 2 CFR section 200.332, Requirements for pass-through entities, requires RAED to communicate subaward terms and conditions with subrecipient and to monitor the subawards for authorized purposes in compliance with Federal statutes, regulation and the terms and conditions. Cause: Communication to subrecipients about terms and conditions of the subaward was not sent out during the fiscal year. It was also noted that there was a missed approval of a reimbursement request during staff turnover. Effect: RAED is not incompliance with Federal Award Programs. Recommendation: We recommend RAED review their procedures in place to determine if any improvements can be made to ensure compliance with subrecipient monitoring. Management Response: There is no disagreement with the audit finding.

Finding 2025-002: Subrecipient Monitoring Criteria: The Uniform Guidance (2 CFR §200.332) requires a non-Federal entity to monitor the activities of its subrecipients as necessary to ensure that Federal awards are used for authorized purposes in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specifically, the Sponsoring Organization is required to perform specific monitoring activities, including site visits, for its CACFP subrecipients (centers/homes). To ensure that these required monitoring activities are occurring timely and correctly, the Sponsoring Organization's internal controls include a requirement for monthly meetings between the Program Manager and the Monitoring Specialist to review the status of subrecipient monitoring. Condition: During the review of internal controls related to subrecipient monitoring, it was noted that the required monthly meetings between the Program Manager and the Monitoring Specialist were not consistently performed throughout the fiscal year. Specifically, for the 12-month period tested, the required monthly reviews were not documented for 3 out of 12 months. Cause: The lapse in the required monthly reviews was attributed to staff turnover in the program office and competing priorities that diverted staff time away from this control activity. Effect: The lack of consistent management oversight through the required monthly meetings increases the risk that mandatory subrecipient monitoring activities (e.g., required site visits, review of subrecipient documentation) could be delayed, missed, or performed inadequately. This could result in non-compliance by the subrecipients going undetected, potentially leading to inaccurate claims and funds being used for unauthorized purposes. Questioned Costs: None noted. Context: This is the first year this finding has been reported. The internal control deficiency appears to be a breakdown in the execution of the established procedure rather than an absence of a control. Repeat Finding: No. This is the first time this specific finding has been identified. Recommendation: We recommend that management reinforce the importance of this control and implement a documented process to ensure that the monthly meetings between the Program Manager and the Monitoring Specialist occur consistently. This should include establishing a recurring meeting schedule and requiring documentation (e.g., signed meeting minutes, checklist) that demonstrates the review of monitoring status took place each month, even during periods of staff turnover or high-priority competing demands.

Finding 2025-003: Subrecipient Monitoring Criteria: The Uniform Guidance (2 CFR §200.332) requires a non-Federal entity to monitor the activities of its subrecipients as necessary to ensure that Federal awards are used for authorized purposes in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Furthermore, the Organization's policy and/or CACFP regulations governing the Sponsoring Organization require an initial on-site review of each new center or Family Child Care (FCC) provider within the first 28 calendar days of program operation. This is a critical component of initial subrecipient monitoring to ensure program integrity and compliance with Federal requirements. Condition: The Sponsoring Organization did not consistently perform the required initial on-site review for new subrecipients (centers and FCC providers) within the mandatory 28-day timeframe. A sample of 40 new centers/FCC providers was selected for testing. Four (4) of the 40 subrecipients (10%) did not have their initial on-site review completed within the first 28 days of operation. The delays in conducting the initial reviews ranged from 6 to 23 days past the required 28-day deadline. Cause: The cause appears to be an inadequate internal control or process to ensure initial review scheduling and completion are prioritized and managed to meet the 28-day deadline, potentially due to competing demands or staffing limitations. Effect: Failure to conduct initial on-site reviews within the required timeframe weakens the Sponsoring Organization's internal controls over subrecipient monitoring and oversight. Timely initial reviews are essential for early identification and correction of compliance issues, proper training, and ensuring new centers/FDCH providers operate in accordance with Federal CACFP requirements from the outset. Questioned Costs: None noted. Context: This is the first time this issue has been noted as a finding. The Sponsoring Organization performed the required reviews; however, they were completed after the regulatory deadline. Repeat Finding: No. This is the first time this specific finding has been identified. Recommendation: The Sponsoring Organization should strengthen its internal controls and monitoring procedures to ensure that all new centers and FCC providers receive the required initial on-site review within the 28-day mandatory timeframe. This should include: 1. Establishing a formal process with documented timeframes for assigning and completing initial reviews immediately upon a new site's approval. 2. Implementing a system to track and alert monitoring staff of the 28-day deadline for each new subrecipient. 3. Providing targeted training to monitoring staff to emphasize the importance of timely initial reviews and the associated regulatory deadlines.

Finding: 2025-002 Subrecipient Monitoring (Significant Deficiency) Federal Agency(ies): United States Department of Agriculture Federal Program(s): Partnerships for Climate-Smart Commodities Assistance Listing Number(s): 10.937 Pass-through Entity (if applicable): N/A Award Identification Number and Year: NR233A750004G045 (2023) Criteria or Specific Requirement: Per 2 CFR 200.332 Requirements for pass-through entities:  Pass-through entities must clearly identify to subrecipients the award information, including the Assistance Listing number, subrecipient’s UEI, Federal award identification number, and Federal award project title (§200.332(a)(1)).  Pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate subrecipient monitoring (§200.332(b)).  Pass-through entities must monitor the activities of subrecipients as necessary to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward (§200.332(d)). Condition: During our testing of subrecipient monitoring, we noted several deficiencies: 1. Subaward agreements were structured more like subcontracts rather than subrecipient agreements and did not include all elements required under 2 CFR 200.332(a), such as the subrecipient’s UEI and Assistance Listing number. 2. Subrecipients were required to submit periodic invoices for reimbursement instead of financial reports detailing costs incurred by budget line item, cumulative expenditures, cash receipts, and cash balances. 3. Pre-award risk assessments were completed; however, the assessments were undated, preventing the audit team from verifying that they occurred prior to subaward execution. Additionally, the monitoring procedures described in policy were not clearly linked to assessed risk levels, and in certain instances, subrecipients with no prior Federal grant management experience were assigned a “low risk” classification. Cause: These conditions occurred due to a lack of formalized procedures to align subrecipient agreements, reporting requirements, and monitoring activities with the specific requirements of 2 CFR 200.332. Management relied on existing subcontract templates and internal policies that were not fully updated to reflect Uniform Guidance requirements. Effect or Potential Effect: Failure to properly structure subaward agreements, and obtain adequate financial reporting, increases the risk that subrecipients may not comply with Federal statutes and regulations. Questioned Costs: N/A Context: We tested a statistically valid sample of subawards charged to Federal awards. The deficiencies noted were consistent across the sample population, indicating a systemic issue rather than isolated exceptions. Identification as a Repeat Finding, if Applicable: Yes, repeat of Finding 2024-002Recommendation: We recommend that management:  Update subaward agreement templates to include all elements required under 2 CFR 200.332(a).  Require subrecipients to submit periodic financial reports by budget line item, cumulative expenditures, cash receipts, and cash balances, rather than invoices alone.  Revise pre-award risk assessment procedures to include dating and ensure that results are documented prior to subaward execution.  Strengthen policies to ensure monitoring procedures are explicitly linked to risk assessment results, with higher levels of oversight required for subrecipients new to Federal grant management.

Findings and Questioned Costs Relating to Federal Awards: 2025-001 Compliance Finding: Subrecipient Monitoring-Audit Verification. Federal Agengy: Department of the Treasury. Pass-through Entity: SC Rural Infrastructure Authority. Federal Program: Coronavirus State and Local Fiscal Recovery Funds(CSLFRF)-Water Capacity Improvments. Assistance Listing Number: 21.027. Criteria. In accordance with 2 CFR 200.332(g) a pass-through entity must verify that a subrecipient is audited as required by subpart F. Subpart F: 200.501 Audit Requirements. (a) Audit required. A non-Federal entity that expends $1,000,000 ($750,000 prior to the 2024 uniform Guidance (UG) revisions) or more during the non-Federal enity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. Condition. Cherokee County did not adequately verify that the subrecipient obtained the required single audit or program specific audit in accordance with 2 CFR 200.332. Although Cherokee County was aware that the subrecipient would be subject to audit requirements based on federal expenditures, Cherokee County did not obtain or otherwise confirm receipt of the required audit report by the applicable submission deadline of September 30, 2025. Upon further inquiry it was determined that the subrecipient did not have a single audit or program-specific audit by September 30, 2025. Cause. The County did not perform sufficient follow-up procedures to confirm subrecipient compliance with single audit requirements after being notified that the subrecipient would be subject to audit for the year ended December 31, 2024. Effect. Failure to verify receipt of the required audit prevented Cherokee County from complying with their policies and procedures and with federal regulation in a timely manner. Recommendation. We recommend that Cherokee County enhance its subrecipient monitoring procedures to include documented follow-up and verification that subrecipients subject to single audit requirements submit the required audit reports within the applicable timeframes, in accordance with 2 CFR 200.332.

Federal Program: Temporary Assistance for Needy Families (TANF) (93.558). Criteria: 2 CFR 200.332(d) requires pass-through entities to monitor the activities of subrecipients to ensure compliance with federal statutes, regulations, and the terms and conditions of the subaward. Required monitoring activities include reviewing financial and performance reports, following up on deficiencies, and ensuring timely corrective action. Condition: The Council did not perform required monitoring procedures for subrecipients as required by Uniform Guidance: Cause: The Council lacked formal procedures and controls for tracking and reviewing subrecipient audit reports and for documenting follow-up on identified deficiencies. Effect: There is an increased risk that subrecipients may not comply with federal requirements, which could result in unallowable costs, questioned costs, or other noncompliance with federal statutes and regulations. Questioned Costs: None. Context: This finding was noted in 3 out of 4 subrecipients for the fiscal year ended June 30, 2025 with a total of $124,302 paid to subrecipients. Repeat Finding: No. Recommendation: We recommend the client implement and document formal procedures to ensure all required subrecipient monitoring activities are performed in accordance with Uniform Guidance, including obtaining and reviewing subrecipient audit reports and following up on any identified deficiencies. Views of Responsible Officials: Management concurs with the finding and will implement corrective action.

Finding Reference Number: 2025-001 Federal Program: CFDA 93.959– Block Grants for Prevention and Treatment of Substance Abuse Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: Lutheran Service Florida, Inc. Award Year: FY 2025 Criteria: Per 2 CFR §200.332(d), pass-through entities must monitor the activities of subrecipients to ensure that federal awards are used for authorized purposes and in compliance with laws, regulations, and the provisions of the subaward. Monitoring includes reviewing performance and financial reports required by the subaward agreement. Condition: The pass-through entity conducted appropriate monitoring activities for the subrecipient Bradford Community Coalition, Inc., including communication and oversight consistent with federal requirements. However, the subrecipient did not submit the required monitoring report by the established deadline. As of the audit report date, the report remained outstanding. Cause: While the pass-through entity fulfilled its monitoring responsibilities, the subrecipient failed to comply with reporting requirements in a timely manner. Effect: The absence of the monitoring report limits the pass-through entity’s ability to fully verify that the $39,406 in federal funds was used in accordance with applicable regulations. This may result in questioned costs due to insufficient documentation. Questioned Costs: $39,406 Recommendation: We recommend the pass-through entity continue its monitoring efforts and implement additional follow up procedures to ensure timely receipt of required reports. The entity should also consider revising subaward agreements to include stronger enforcement mechanisms for noncompliance. Views of Responsible Officials: The organization monitored the subrecipient in accordance with federal guidelines and has documented its oversight activities. We are working with the subrecipient to obtain the overdue report and have updated our procedures to escalate follow-up actions when reports are delayed.

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-014 Condition: For 2 out of 2 selections, the unique identifier number and federal award identification number were not included in the grant agreement. For 2 out 2 selections, evidence that the prior year Single Audit Report was reviewed was not provided. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (b) Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; and (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (f) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance for subrecipient monitoring. Effect: The subrecipient could not be in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls to ensure grant agreements include the unique identifier number and federal award identification number. We also recommend a process to ensure that the single audit of subrecipients are reviewed timely. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Labor (DOL) AL No. 17.258, 17.259, 17.278 Workforce Innovation and Opportunity Act (WIOA) Cluster Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Condition: For 2 out of 2 selections, the unique identifier number on the notice of award did not agree with the subrecipient's active registration UEI on SAM.gov. For 2 out of 2 selections, management was unable to provide evidence that subrecipient monitoring was performed to ensure compliance with accounting requirements. For 2 out of 2 selections, evidence that the prior year Single Audit Report was reviewed was not provided. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (b) Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. According to AM 413-60, Grant Documentation, Grant Manager/Program Manager/Director Conducts ongoing monitoring and control of all reimbursement receipts and deposits until grant ends; as well as all program and sub-recipient (when applicable) documentation, to include: (1) program documentation; (2) timesheets; (3) deliverables; (4) activities; (5) vendor payments; (6) program data/charts/numbers; and (7) financial and compliance report. According to AM 413-61, Grant Management Financial Reporting, Grant Manager/Program Manager/Director maintains all documentation, either electronic or hard copy, for all federally funded grants for the term of the grant for a minimum of seven years for review and audit by the granting agency or its designee. Cause: The Mayor’s Office of Employment Development (MOED) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: MOED may not be in compliance with the subrecipient monitoring requirements of its grants. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-022 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 1 out of 1 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR 200.303: Internal Control, the non-Federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: The Baltimore County Department of Health (BCHD) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-025 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 5 out of 6 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR 200.303: Internal Control, the non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: The Baltimore County Department of Health (BCHD) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-028 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 2 out of 5 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR §200.303: the non-federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: BCHD did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Treasury AL No. 21.027 American Rescue Plan Act Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-015 Condition: There was no evidence that the City verified whether the subrecipient was suspended and/or debarred from receiving federal funds for 3 out of 40 subrecipients selected for testing. The City did not have current subrecipient grant agreements for 3 out of 40 subrecipients selected for testing. The unique entity identifier (UEI) was not included in the grant agreements for 3 out of 40 subrecipient grant agreements selected for testing. The Federal Award Identification Number (FAIN) was not included in the grant agreements for 8 out of 40 subrecipient grant agreements selected for testing. The UEI was incorrect in the grant agreement for 1 out of 40 subrecipient grant agreements selected for testing. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. According to AM 413-61, Grant Management Financial Reporting, Grant Manager/Program Manager/Director maintains all documentation, either electronic or hard copy, for all federally funded grants for the term of the grant for a minimum of seven years for review and audit by the granting agency or its designee. Cause: The City did not maintain adequate documentation of the requirements included in Uniform Guidance for subrecipient monitoring. Effect: The subrecipient could not be in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

Finding 2025.003 - Subrecipient Monitoring - Material Weakness Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name and Assistance Listing Number: Head Start Cluster, 93.600 Federal Award Identification Number and Year: 01CH011268-05-01 (2024), 01CH012890-01-01 (2024), 01CH011268-05-03 (2024) Name of Pass-through Entity (if applicable): N/A Criteria Per 2 CFR 200.332 (Requirements for pass-through entities) a pass through entity must, among other things, evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition CLC did not properly monitor its subrecipient in accordance with Uniform Guidance requirements. The agreement with the subrecipient referred to outdated polices that were replaced by the Uniform Guidance (Circulars A-87, A-110, A-133) and did not include all required elements which included, but is not limited, to the Assistance Listing Number, Unique Identifying Number. A review was not performed of the use of program funds or the subrecipient's audited financial statements and Uniform Guidance report. Cause The Financial Policies and Procedures Manual was not followed. The manual also needs to be updated to include the updated requirements of the Uniform Guidance and require documentation of review of compliance with requirements. Effect or Potential Effect Failure to perform required risk assessments and to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Questioned Costs None Context During our testing, we noted CLC did not perform subrecipient monitoring procedures over subrecipients with respect to the Head Start Cluster Program during the year ended June 30, 2025. Amounts passed through to subrecipients totaled $284,791 for the year ended June 30, 2025. Identification as a Repeat Finding This is not a repeat finding. Recommendation Management should review the Uniform Guidance requirements for subrecipient monitoring and update their policy manual as appropriate. We recommend CLC develop and implement a standardized checklist that outlines all subrecipient monitoring compliance requirements. The checklist should clearly identify the individual responsible for implementing each requirement and the individual responsible for reviewing compliance, along with documentation of that review. Views of Responsible Officials Children’s Learning Centers of Fairfield County, Inc. concurs with this finding. Management will update its Financial Policies and Procedures Manual and subaward templates to align with current Uniform Guidance requirements, including all required subaward elements (such as Assistance Listing Number, UEI, award identification, and applicable compliance requirements). CLC will implement a standardized subrecipient monitoring checklist covering risk assessment, review of invoices and programmatic reports, verification of allowable costs, confirmation and review of subrecipient audit requirements and Uniform Guidance reports (as applicable), and documentation of management review. Monitoring will be documented and reviewed by senior management on at least an annual basis and more frequently based on risk.

FINDING 2025-003 Subject: Teacher and School Leader Incentive Grants – Subrecipient Monitoring Federal Agency: Department of Education Federal Program: Teacher and School Leader Incentive Grants Assistance Listings Number: 84.374 Federal Award Numbers and Years (or Other Identifying Numbers): Year 2-3, Year 3-4 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Modified Opinion Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, material noncompliance related to the Teacher and School Leader Incentive Grants (TSL) funds passed through to subrecipients. The School Corporation received and passed through to subrecipients $6,143,393 of TSL funds. The School Corporation is to clearly identify the award and applicable requirements to the subrecipients, evaluate the risk of noncompliance related to the subrecipients to determine appropriate monitoring of the subaward, and monitor the activities of the subrecipients to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. The School Corporation did not enter into an agreement with the subrecipients. As such, there is no agreement between the School Corporation and the subrecipients that clearly identifies the award as a subaward or includes all the required data elements. In addition, the School Corporation did not have any policies or procedures in place to evaluate the subrecipients' risk of noncompliance or to monitor the activity of the subrecipients. Per inquiry of the School Corporation, it was determined an evaluation of the risk of noncompliance for the subrecipients was not completed, nor did the subrecipients' files support any such evaluation. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 19 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states: "All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the passthrough entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; INDIANA STATE BOARD OF ACCOUNTS 20 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; (4) (i) An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the pass-through entity must determine the appropriate rate in collaboration with the subrecipient, which is either: (A) The negotiated indirect cost rate between the pass-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass-through entity is not required to collect information justifying this rate, but may elect to do so; (B) The de minimis indirect cost rate. (ii) The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). (5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and (6) Appropriate terms and conditions concerning closeout of the subaward. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; INDIANA STATE BOARD OF ACCOUNTS 21 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. INDIANA STATE BOARD OF ACCOUNTS 22 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 of this part and in program regulations." Cause The School Corporation's management was not aware of the requirements for subrecipient and subaward monitoring compliance. Thus, the School Corporation had not implemented its system of internal controls, which would include appropriate segregation of duties that would likely be effective in preventing, or detecting and correcting, noncompliance related to the Subrecipient Monitoring compliance requirement. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the School Corporation establish a proper system of internal controls, including segregation of duties, to evaluate the subrecipients' risk of noncompliance and adequately monitor the subrecipients. Additionally, policies and procedures should be implemented to ensure appropriate reviews, approvals, and oversight are taking place, as needed, to evaluate and monitor its subrecipients. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Condition: The City entered into a written agreement with a subrecipient; however, the agreement did not include language requiring the subrecipient to compliance with the Uniform Guidance. As a result, the subrecipient was not formally notified of its responsibility to adhere to federal administrative, cost, and audit requirements. Criteria: 2 CFR §200.332(a) requires pass-through entities to ensure that subaward agreements include all required federal award information and clearly identify applicable federal statutes, regulations, and terms and conditions, including compliance with Uniform Guidance (2 CFR Part 200). Cause: The City had a preexisting agreement with an entity who later became a subrecipient of federal grant pass-through funds. The City did not amend their agreement to include the required components after receiving the grant nor report the funds as federal revenues or expenditures in the City’s financial statements. Effect or Potential Effect: Without a formal subaward agreement, the pass-through entity lacks assurance that the subrecipient understands and complies with applicable federal requirements, increasing the risk of noncompliance, improper use of federal funds, and questioned costs. The subrecipient may also not be aware of their responsibility to report the related federal expenditures on the subrecipient’s schedule of expenditures of federal awards. Questioned Costs: None. Recommendation: We recommend that the City identify all federal expenditures and passthrough awards and notify all subrecipients of their receipt of federal awards by identifying the award granted, specific compliance requirements passed-through and other requirements of 2 CFR 200.332. Management’s Comments Regarding Corrective Actions Planned: Management agrees with the finding. The City had a preexisting agreement with the subrecipient for a project that was already in progress when the federal grant was awarded. The subrecipient had in-depth involvement during the federal grant application process and is aware of specific compliance requirements under the Uniform Guidance (2 CFR Part 200). We will make sure that all future subrecipients of pass-through federal grants are notified in writing of the responsibility to adhere to federal administrative, cost, and audit requirements.

Federal Program - Research and Development Cluster Assistance Listing Numbers - Various Federal Agency - All Research and Development Sponsor Award Number - Various Award Period - Various Criteria or Specific Requirement – Subrecipient Monitoring - Management is responsible for verifying that subrecipients expected to be audited as required by CFR part 200, subpart F, met this requirement. (2 CFR 200.332(g)) Condition - Management reported that subrecipient monitoring procedures as it relates to confirming subrecipients met audit requirements had not been completed during the year. Cause - Turnover of University personnel responsible for subrecipient monitoring. Questioned Costs - There were no questioned costs as a result of this finding. Effect - While management did follow established controls to determine whether subrecipients used the Federal awards for authorized purposes and complied with Federal statutes, regulations and the terms and conditions of the sub award, by not confirming whether subrecipients had received required audits, management may not become aware of subrecipients with audit findings. Context - Management reported that subrecipient monitoring procedures as it relates to confirming subrecipients met audit requirements had not been completed for all ten subrecipients during the year. Identification as a Repeat Finding - No. Recommendation - We recommend management bring subrecipient audit documentation current and complete training with responsible individuals to ensure future compliance.

2025-001 Internal Controls Systems and Compliance Over Subrecipient Monitoring – U.S. Department of Treasury, COVID-19 Coronavirus State and Local Fiscal Recovery Funds, Passed Through the State of Nevada Department of Education Criteria: In accordance with 2 CFR 200.332(a)(1), the auditee must maintain a system of internal control to ensure information related to federal awards is clearly identified to the subrecipient at the time of the subaward and if any data elements change, include the changes in a subsequent subaward modification. Condition: The Organization receives funding for the Nevada Ready! program through the State of Nevada Department of Education. The amount of funding provided by Federal and state sources changes annually as does the Federal program from which the funds are derived. The Organization did not receive clear documentation from their grantor on the source of grant funding and did not clarify with the grantor on these requirements. The Organization then did not identify the correct Federal agency and assistance listing number for the grant awards provided to subrecipients. Context: Sixteen preschool centers received notification of subawards with an incorrect Federal agency and assistance listing number for the Federal funds received. Cause: The design and implementation of internal controls over subrecipient monitoring was not operating effectively. Effect: Not communicating the correct Federal agency and assistance listing number in a subaward to subrecipients could result in the subrecipients not complying with Federal regulations. Repeat Finding: Yes. Prior finding 2024-001. Recommendation: We recommend management design and implement a system of internal controls whereby every subaward that includes Federal funding be clearly identified to the subrecipient as a Federal subaward and include all data elements required to be provided to the subrecipient at the time of the subaward. For any information where the Organization’s grantor has provided unclear or incomplete information, appropriate follow-up with the grantor should be performed. Additionally, if any of the data elements change, those changes should be included in a subsequent subaward modification. Views of Responsible Officials and Planned Corrective Action: We appreciate the identification of this compliance issue and are committed to addressing the finding with a robust corrective action plan. The following steps outline the measures we will take to ensure compliance with federal requirements for subrecipients. 1. Each subaward will be clearly identified as a federal subaward and include all required data elements at the time of issuance. Any subsequent changes will be communicated through a formal subaward modification process. 2. Each required data element will be reviewed and compared to the source data by the preparer and the final signer. If elements are unclear or incomplete, follow-up with the grantor will be performed before the execution of the agreement. If clarity cannot be obtained, the agreements will be executed, noting the area of unclear or incomplete data and that the information will be obtained and updated promptly through a formal subaward modification agreement. 3. In the event subsequent changes occur, these changes will be communicated through a formal subaward modification agreement.

Coronavirus State and Local Fiscal Recovery Funds: Noncompliance over Subrecipient Monitoring Condition: During our testing of subrecipient monitoring requirements, we noted that for all of the subrecipients tested, the Organization did not verify whether or not the subrecipient required and, if so, completed an audit. Criteria: 2 CFR 200.332(g) of the Uniform Guidance requires pass-through entities to verify that subrecipients are audited as required by subpart F of 2 CFR 200. Cause: The exception was due to a breakdown in the Organization’s procedures to ensure that all subrecipient monitoring procedures are in accordance with Uniform Guidance. Effect: There is an increased risk that noncompliance at the subrecipient level could occur and remain undetected by the Organization. Improper subrecipient monitoring procedures can also result in actions taken by oversight agencies which could impact future funding. Context: The population subject to subrecipient monitoring requirements included 69 subrecipients. The sample size of seven subrecipients was determined. Recommendation: We recommend that the Organization implement procedures that include monitoring that subrecipients needing an audit meet the requirement. Views of Responsible Officials: Management agrees with the finding.

Finding No. 2025-001 – Subrecipient Monitoring Deficiencies Repeat Finding: No ALN and Program: 84.002 – Adult Education State Grant Program Award Amount: $1,384,339 Award Number: 09-401-146-125 Award Year: 7/1/2024-6/30/2025 Criteria: 2 CFR 200.332 specifies requirements for monitoring subaward agreements. Section (b) of the guidance lists required elements to be included in subaward agreements, including subrecipient identifying information, information about the original federal award dates and amounts, contact information, and compliance requirements of the award. Section (c) specifies that grantees evaluate each subrecipient's fraud risk and risk of noncompliance with the subaward. Section (e) requires grantees to assess risk and monitor the activities of a subrecipient as necessary to ensure the subrecipient complies with Federal statutes, regulations, and terms and conditions of the subaward. MATC's system of control is required to be designed and implemented in order to ensure compliance of subawards with the applicable compliance requirements. Condition/Context: In testing compliance with the requirements of 2 CFR 200.332, we noted that MATC's internal controls over subrecipient monitoring requirements were not effectively operating during the year ended June 30, 2025. MATC's subaward agreement with Literacy Services of Wisconsin did not contain all the required information included in Section (b). In particular, the agreement was missing the subrecipient's Unique Entity Identification Number (UEI), the Federal and / or State Award Identification Number (FAIN), Federal and / or State Award Date, and the indirect cost rate for the Federal and / or State Award. Additionally, MATC was not able to produce evidence of the required risk assessment process, and resulting monitoring activities deemed necessary to ensure the subgrantee's compliance with Federal Requirements. MATC's review and approval process for this subaward did not prevent, detect, or identify the missing contract information or the lack of documented risk assessments. Monitoring activities were performed; however, without the documented risk assessment, it is unclear whether the activities were sufficient. Cause: MATC has made subawards under the AEFL program for many years, and the same subaward document has been used without amendment. While the agreement was subjected to the required review and approval process internally, the review did not identify the updated requirements for elements of the agreements. Additionally, MATC has historically performed site monitoring and review of financial reports for all of its sub-awardees; however, in 2025 the individual responsible for performing this process retired and a replacement was not found for several months, resulting in a vacancy in the position and lack of available staffing to complete the monitoring documentation and process. Questioned Costs: None Effect: The subaward agreement is not in compliance with Federal sub-award requirements, and an appropriate risk assessment was not documented, which could result in incorrect reporting of the award by the sub-grantee, or potential non-compliance of the sub-awardee. Recommendation: We recommend MATC evaluate its award approval process and implement clear and robust procedures designed to ensure agreements are compared to the most current set of requirements for compliance.

Type of Finding: Subrecipient Monitoring – Noncompliance and Internal Control (Significant Deficiency) Supplemental Nutrition Assistance Program Cluster: State Administration Matching Grants for the Supplemental Nutrition Assistance Program (Assistance Listing #10.561) Federal Agency: U.S. Department of Agriculture Pass-Through Entity: New York State Office of Temporary and Disability Assistance Contract Number: TDA01-C00986GG-3410000 Funding Years: 10/1/2023 - 9/30/2025 Criteria: Per 2 CFR 200.332(g), a pass-through entity must verify that subrecipients expected to be audited by 2 CFR Part 200, Subpart F, met this requirement. Condition/Context: For a non-statistical sample of three subrecipients, during the fiscal year ended June 30, 2025, UWNYC did not verify that subrecipients expected to be audited as required by 2 CFR Part 200, Subpart F, met this requirement. Cause: UWNYC’s internal controls over subrecipient monitoring lacked the requirement to ensure that UWNYC complied with 2 CFR 200.332(g). However, UWNYC requested and obtained the most recent audit report required by 2 CFR Part 200, Subpart F for each of the sampled subrecipients as part of CBIZ CPAs’ Single Audit requests. Effect: UWNYC was noncompliant with the subrecipient monitoring requirement described in 2 CFR 200.332(g). Questioned Costs: None. Identified as a Repeat Finding: No. Recommendation: UWNYC should implement a procedure within its subrecipient monitoring process and internal control to ensure that, each year, program staff verify whether subrecipients are expected to be audited by 2 CFR Part 200, Subpart F. For those subrecipients that expect to be audited by 2 CFR Part 200, Subpart F, program staff should also obtain and review the final audit report. If the final audit report includes any audit findings, including those specifically related to the subaward, UWNYC should consider such audit findings as part of UWNYC’s assessment of the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Views of Responsible Officials: We acknowledge and accept this finding. To address this gap and prevent recurrence, we will implement a formal annual verification and documentation process requiring program staff to determine audit applicability, obtain and review final Single Audit reports, and incorporate any audit findings into subrecipient risk assessments to inform ongoing monitoring. These procedures will be documented and integrated into UWNYC’s internal controls to ensure future compliance.

Finding 2025-003: Subrecipient Monitoring (Significant Deficiency) Federal Agency: United States Department of Health and Human Services. Federal Program: Unaccompanied Children Program. Assistance Listing Number: 93.676 Pass-through Entity, if applicable: Not applicable. Award Identification Number and Year: All awards and all of 2025 fiscal year. Criteria or Specific Requirement (including Statutory, Regulatory, or Other Citation): Criteria or specific requirement (including statutory, regulatory, or other citation): Per 2 CFR 200.332 Requirements for pass-through entities:  Verify that the subrecipient is not excluded or disqualified in accordance with § 180.300.  Pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate subrecipient monitoring (§200.332(b)).  Verify that a subrecipient is audited as required. Condition: During our testing of subrecipient monitoring, we noted several exceptions as follows:  No process was in place to verify that subrecipients are suspended or debarred from receiving Federal funds.  Pre-award risk assessments were not completed. The monitoring procedures were not linked to assessed risk levels.  The audited financial statements of the subrecipients were not received in order to assist in the risk assessment process. Cause: These conditions occurred due to a lack of formalized procedures to align subrecipient agreements, reporting requirements, and monitoring activities with the specific requirements of 2 CFR 200.332. Management relied on existing subcontract templates and internal policies that were not fully updated to reflect Uniform Guidance requirements. Effect or Potential Effect: Failure to properly structure subaward agreements, and obtain adequate financial reporting, increases the risk that subrecipients may not comply with Federal statutes and regulations. Questioned Costs: Costs associated with qualitative monitoring procedures are not identifiable. Context: We tested a statistically valid sample of subawards charged to Federal awards. The deficiencies noted were consistent across the sample population, indicating a systemic issue rather than isolated exceptions. Identification as a Repeat Finding, if applicable: Not a repeat finding. Recommendation: We recommend that management implement processes and procedures as follows:  Establish formalized policies and procedures on subrecipient monitoring;  Include a screening of subrecipients against the Federal suspended and debarred list as part of the contracting process;  Implement pre-award risk assessments that clearly links monitoring procedures to the level of assessed risk;  Document the monitoring procedures that occurred throughout the year in accordance with the established policies and procedures and identified risk assessment for each subrecipient.

Finding 2025-004: Federal Funding Accountability and Transparency Act of 2006 (FFATA) Reporting (Significant Deficiency) Federal Agency: United States Department of Health and Human Services. Federal Program: Unaccompanied Children Program. Assistance Listing Number: 93.676 Pass-through Entity, if applicable: Not applicable. Award Identification Number and Year: All awards and all of 2025 fiscal year. Criteria or Specific Requirement (including Statutory, Regulatory, or Other Citation): In accordance with 2 CFR 200.332 and as required by the Federal Funding Accountability and Transparency Act of 2006 (Pub. L. 109–282), as amended by section 6202 of Public Law 110–252, recipients must report information for each subaward of $30,000 or more in Federal funds and executive total compensation, as outlined in Appendix A to 2 CFR Part 170. The information is to be submitted to the FFATA Subaward Reporting System (FSRS) by the end of the month following the month in which the subaward was awarded. Condition: During our review of subrecipient activities, we noted that Everstand was not submitting the required reporting under FFATA regulations. Cause: Internal controls over financial reporting were not operating effectively to ensure reporting under FFATA in a timely manner. Effect or Potential Effect: Failure to submit the required reports by the submission deadline results in noncompliance with the Federal Funding Accountability and Transparency Act of 2006 as outlined in Appendix A to 2 CFR Part 170. Questioned Costs: Costs associated with qualitative reporting requirements are not identifiable. Context: We tested a statistically valid sample of subawards charged to Federal awards. The deficiencies noted were consistent across the sample population, indicating a systemic issue rather than isolated exceptions. Identification as a Repeat Finding, if applicable: Not a repeat finding. Recommendation: We recommend that management strengthen controls over reporting requirements for each Federal award to ensure timely submission of required reports.

Reference Number: 2025-021 Prior Year Finding: 2024-054 Federal Agency: Department of Health and Human Services State Agency: Department of Agriculture Federal Program: Research and Development Cluster Assistance Listing Number: 93.103 Award Number and Year: 5U2FFD007445-04 (7/01/2024 – 06/30/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Agriculture did not include all required information in subaward agreements. Context: One of eight subawards selected for testing were missing required federal award information. The eight subawards tested consisted of six subawards from West Virginia University (WVU), one subaward from the Department of Agriculture (Department) and one subaward from the Higher Education Policy Commission (HEPC). The following exceptions were noted: Department of Agriculture: The subaward tested did not contain all required federal award information. The Assistance Listing Number and identification of whether the Federal award was for research and development was omitted from the subaward agreement. Questioned costs: None noted. Cause: The Department does not have sufficient procedures and internal controls to ensure that subawards are issued in compliance with Federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Federal Agency: US Department of Agriculture Federal Program Name: Infrastructure Investment and Jobs Act Community Wildfire Defense Grants Cooperative Forestry Assistance Assistance Listing Number: 10.720, 10.664 Federal Award Identification Number, Year and Award Period: ALN 10.720: 23DG11030000019: 7/1/2023 – 12/31/2028 23DG11030000057: 7/1/2023 – 12/31/2026 24DG11030000035: 8/1/2024 – 6/30/2029 ALN 10.664: 20DG11030000007: 7/1/2020 – 12/31/2025 21DG11030000013: 7/1/2021 – 12/31/2025 22DG11030000007: 7/1/2022 – 12/31/2025 23DG11030000008: 7/1/2023 – 12/31/2026 24DG11030000023: 7/1/2024 – 12/31/2027 Type of Finding:  Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Per 2 CFR §200.332 Requirements for pass-through entities, a non-federal entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass_x0002_through entity monitoring of the subrecipient must include reviewing financial and performance reports required by the pass-through entity. Additionally, §200.332 includes required elements that are to be included in the subawards for pass-through entities. Condition: During single audit testwork over subrecipient monitoring, the following issues were noted which are detailed by ALN: ALN 10.720:  5 out of 5 subrecipient samples tested did not have adequate subaward agreements that include the points listed in 2 CFR §200.332 Requirements for pass-through entities.  5 out of 5 subrecipient samples tested listed the incorrect assistance listing number on either the subaward, notice to proceed, or both. ALN 10.664:  9 of 9 subrecipient samples tested did not have adequate subaward agreements that include the points listed in 2 CFR §200.332 Requirements for pass-through entities.  3 of 9 subrecipient samples tested listed the incorrect assistance listing number on either the subaward, notice to proceed, or both.  1 of 9 subrecipient samples were not initially identified as subrecipients for the program due to mapping issues. As result, the Department did not perform any monitoring related to the subrecipient. Questioned costs: None Context: This was identified during Subrecipient Monitoring Testing. The samples described above were statistically valid samples. Cause: The Department has not maintained internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effect: Noncompliance with portions of the applicable regulations. Programmatic monitoring was being performed for the ALNs. Recommendation: We recommend the Department create an agreement template that contains the required elements of a subaward to distribute to its subrecipients. We recommend that the Department conduct training with program staff on required elements of subawards and proper mapping of subrecipients within SHARE.

Finding 2025-046 Compliance with Subrecipient Monitoring for Disaster Grants The Federal Emergency Management Agency (FEMA) Disaster Grants program [ALN 97.036] provides supplemental assistance to recipients to assist communities with responding to and recovering from major disasters or emergencies. The program also provides funding for hazard mitigation measures to help communities implement hazard mitigation projects that can protect them from future disasters. The Disaster Grants program is based on a partnership between FEMA, the recipient (in this case, the Department), and, as applicable, the subrecipient (local governments). FEMA is responsible for managing the Disaster Grants program, approving grants, and providing technical assistance to the state, local, tribal, and territorial governments. The Department, as a recipient of Disaster Grants program funds, is responsible for providing technical advice and assistance to eligible subrecipients, providing support for damage survey activities, ensuring that all potential applicants are aware of funding assistance available, and submitting documents necessary for grant awards. A subrecipient is defined in federal regulations [2 CFR 200.1] as an entity, usually but not limited to non-federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through entity (such as the Department) to an entity (subrecipient) to carry out part of a federal grant award received by the pass-through entity. Specifically for this program, the subrecipient is expected to request assistance, as needed; identify the damaged facilities; provide information to support its funding requests; maintain accurate documentation; and perform other work, as necessary. As part of its subrecipient monitoring process, the Department should complete an annual risk assessment to determine the extent of its subrecipient monitoring activities. The risk assessment should include considerations of financial risk factors, such as financial implications of operational and compliance failures; operational risk factors, such as risks resulting from inadequate internal controls; and compliance risks, such as violations with laws, regulations, and internal policies. In addition, the Department should be using monitoring tools to track the status of whether the subrecipient underwent a Single Audit, if applicable, and whether that audit has been reviewed by Department staff and any resulting management decisions issued by those staff to the subrecipient, if applicable, that address the Department’s assessment and planned actions to address any findings or issues identified in the audit During Fiscal Year 2025, the Department passed approximately $76.0 million to 66 subrecipients for responses to various disasters covered by the Department’s Disaster Grants program. In addition, the Department reported that it approved no new subawards during Fiscal Year 2025. All funds passed through to subrecipients by the Department were related to reimbursements for prior period expenses. In total, the Department reported that it had passed through Disaster Grant funding to another 68 subrecipients in prior years who did not receive funding passed through from the Department during Fiscal Year 2025; many of these subrecipients had multiple open projects that had been completed in prior years but were awaiting final approval and close-out from FEMA. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to determine whether the Department had adequate internal controls in place over, and complied with, subrecipient monitoring requirements over the Disaster Grants program during Fiscal Year 2025. Another purpose of the audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendation to review all subrecipients’ federally-required Single Audit reports, as required. The Department agreed with the recommendation and planned to implement it by June 2025. As part of our audit work, we performed testwork to determine whether the Department obtained its subrecipients’ Single Audit reports and issued a management decision, if applicable. We also determined whether the Department performed risk assessments on the subrecipients as required by federal regulations. Finally, we performed this testing over a random sample of 9 of 68 subrecipients that received pass-through funding in the current year. How were the results of the audit work measured? We measured the results of our audit work against the following requirements: • Federal regulations [2 CFR 200.332] require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate level of subrecipient monitoring based on the Department’s assessment of risk posed by the subrecipients. Additionally, it requires the Department to verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, Audit Requirements, which sets forth the federal regulations around Single Audit threshold requirements for subrecipients. It also covers the federal regulations to consider whether the results of the subrecipient’s audits indicates conditions that necessitate adjustment to the passthrough entity’s—in this case, the Department’s—own records. Further, federal regulations [2 CFR 200.521] require the Department to issue a management decision, which is defined as the Department’s written determination of the adequacy of the subrecipient’s proposed corrective action to address any findings in the subrecipient’s Single Audit reports within 6 months of the federal audit clearinghouse’s acceptance of the audit report. • The Department’s Division of Homeland Security and Emergency Management’s (DHSEM) Subrecipient Monitoring policy states that it “…will perform an annual evaluation of Subrecipient’s risks prior to the start of each State fiscal year, analyzing active awards and assessing Subrecipients for the upcoming year to determine the financial status of each Subrecipient and which subrecipients will receive on-site monitoring which may include desk reviews.” The policy further goes on to indicate that each subrecipient will receive an overall risk score that is used to determine which subrecipients will undergo monitoring review during the fiscal year based on the quantitative and qualitative data used for the assessment inputs. • The DHSEM Subrecipient Monitoring policy also states that “DHSEM will perform reviews of single audit results for Subrecipients who have expended Federal grant funds in excess of $750,000 of which some portion is passed through DHSEM.” • Federal regulations [2 CFR 200.329] stipulate that the non-federal award recipient—in this case the Department—is responsible for oversight of the operations of its federal award-supported activities. The regulations further state that the “non-federal entity” must monitor its activities under federal awards to assure that compliance with applicable federal requirements and performance expectations is being achieved. What problems did the audit work identify? Based on our audit work, we determined that the Department did not fully implement our prior audit recommendation by its planned implementation date of June 30, 2025, and did not complete required subrecipient monitoring activities for its Disaster Grants program. Specifically, we found that the Department did update the risk assessment policies for the 2025 risk assessment and fully assessed risks for subrecipients for Fiscal Year 2025. However, there was one subrecipient that had not yet issued a finalized audit report and, therefore, the Department’s subrecipient monitoring process was pending completion. Why did these problems occur? Although the Department designated staff to obtain and review Single Audit reports for all of its subrecipients, Department staff stated that they were not able to complete their reviews of previously unreviewed Single Audit reports during Fiscal Year 2025, as letters were still being processed for execution and distribution under the updated policies. The Department also subsequently stated that some of these reviews were incomplete due to the subrecipients not yet finalizing their Single Audits with their auditors. Why do these problems matter? By failing to complete all of its reviews of subrecipients’ Single Audit reports, the Department is out of compliance with both federal requirements and with its policy to complete monitoring reviews for each subrecipient. This could result in the Department not timely identifying enforcement actions that may be needed against noncompliant subrecipients and then making revisions, as applicable, to its monitoring risk assessment for the subrecipient. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-046 The Department of Public Safety (Department) should continue to implement its subrecipient monitoring policy and ensure the Department is in compliance with federal regulations to review all subrecipients’ Single Audit reports in a timely manner. This should also include the Department completing its reviews of the subrecipients’ prior year’s Single Audit reports and issuing the management decision letters for those reports. Response Department of Public Safety Agree Implementation Date: June 2026 The Department will continue to follow the current Policy and Procedure related to the Single Audit reviews and has allocated an individual to review the Single Audits. This includes issuing a management decision letter if required, in accordance with the timeline established in federal guidance.

Finding 2025-047 Compliance with Reporting for the Highway Safety Cluster The Department is required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for its Highway Safety Cluster programs, specifically the State and Community Highway Safety [ALN 20.600] and National Priority Safety Programs [ALN 20.616] (Programs). The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public, including information about amounts passed through to subrecipients. The Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations (also referred to as subrecipients). Federal regulation [2 CFR 200.1] defines a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulation [2 CFR 200.1] as an entity, usually but not limited to non-federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. The Department is required to file FFATA reports through the System for Award Management website, SAM.gov. Once the Department submits a report to SAM.gov, the public can view certain information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. In Fiscal Year 2025, the Department reported approximately $12.9 million in total for the Programs’ expenditures. Of this amount, the Department issued about $6.8 million in subawards under the Programs. The Department had 70 subrecipients with subawards it was required to submit FFATA information for through SAM.gov during the fiscal year. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine whether the Department had adequate internal controls over and complied with FFATA reporting requirements for the Highway Safety Cluster Programs during Fiscal Year 2025. Another purpose of our audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendations to strengthen its internal controls over and to ensure it complies with FFATA reporting requirements for the Highway Safety Cluster Programs. The Department agreed with these recommendations and planned to implement them by June 2025. As part of our audit work, we selected 24 Fiscal Year 2025 subrecipient expenditure transactions out of a total of 70 subrecipient transactions for which FFATA reporting was required for these Programs. We obtained copies of the FFATA reports that the Department uploaded to SAM.gov and obtained subaward agreements and purchase orders for each sample. We compared the Department’s subaward information to the information the Department submitted to SAM.gov to determine whether the Department reported accurate information. In addition, we performed testwork to determine whether the Department submitted the FFATA reports within the month following the month it made the subaward, as required by federal regulations. We also tested the Department’s progress in implementing our prior audit recommendations by reviewing their updated policies and procedures. How were the results of the audit work measured? We measured the results of our audit work against the following: • Federal regulations [2 CFR 170] require direct recipients of federal grants to report subawards of $30,000 or more to SAM.gov by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to SAM.gov in May 2025 if an award or supplemental award equal to or greater than $30,000 was made in April 2025. Federal regulations [2 CFR 200.303] require the non-federal entity—in this instance the Department—to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. • Federal regulation [2 CFR 200.332 (a)(1)] states that the Department’s subawards must clearly identify certain information, including but not limited to, the unique entity identifier, the Assistance Listing Number, the federal award date, and the federal award identification number. What problem did the audit work identify? Based on our audit work, we determined that the Department did not fully comply with FFATA reporting requirements for the Programs during Fiscal Year 2025 and did not fully implement our prior audit recommendations. Of the 24 subaward reports selected for testing, we identified issues on 5 subaward reports (21 percent). Specifically, we identified the following issues: • The Department was unable to provide documentation demonstrating that two subaward FFATA reports related to Fiscal Year 2024 awards had been submitted in SAM.gov. These submissions could not be located in SAM.gov. The amount of the subawards not submitted was $375,553. We further noted that these two reports had still not been submitted during Fiscal Year 2025. • For three subawards totaling $771,258, the Department did not maintain adequate documentation to support the amounts reported in SAM.gov. Specifically, the Department reported amounts of $537,573 for the three subawards, which did not agree to the Department’s subaward records, and represented a difference of $233,684. In addition, the Department did not meet the required FFATA reporting timelines for these subawards. Specifically, one subaward was reported 271 days late and two were reported 301 days late. Why did this problem occur? The Department did not have adequate internal controls in place related to FFATA reporting for the Highway Safety Cluster during Fiscal Year 2025 that ensured that reporting occurred as required for subawards of $30,000 or more in SAM.gov by the end of the month following the month the subawards are made. The Department implemented policies and procedures related to FFATA reporting during the fiscal year; however, Department staff indicated that staff were still being trained on these new procedures. In addition, the Department did not have procedures in place to ensure that, when an unsubmitted FFATA report is identified, the report is subsequently filed in SAM.gov, even if the submission is late. Why does this problem matter? By failing to properly report FFATA subawards through SAM.gov, the Department is out of compliance with federal reporting requirements, risks federal sanctions, and does not meet the federal intent of transparency for federal program spending. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-047 The Department of Transportation (Department) should strengthen its internal controls over and ensure it complies with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the Highway Safety Cluster by: A. Ensuring that FFATA reporting occurs as required for subawards of $30,000 or more by the end of the month following the month the subawards are made and, if an unsubmitted FFATA report is identified, subsequently filing the report as soon as possible through SAM.gov, even if the submission is late. B. Providing training to Department staff to follow FFATA reporting policies and procedures. C. Ensuring Department staff follow the Department’s FFATA policies and procedures to ensure that FFATA reports are accurate and complete. Response Department of Transportation A. Agree Implementation Date: June 2026 The Department agrees with the recommendation. The Department will review, assess, and, where necessary, update existing procedures for FFATA reporting relating to the requirement that state subawards for $30,000+ be submitted within 30 days of committed budget. This will include ensuring that the confirmation date is documented. This process will be a coordinated effort between the Office Transportation Safety (OTS) and the Center for Accounting. This will include updating our reconciliation process to include additional data, reviewing and updating reconciliation and review procedures as needed, and reconciling Grants awarded in prior fiscal years that are still active and ensuring they have been appropriately reported. The findings related to this recommendation are in part the result of a federal reporting system limitation, and a federal system conversion. The legacy reporting system, FSRS, had a system limitation, which prevented the full amount of the award being reported in the case of three awards. Additionally, this conversion resulted in some data conversion issues impacting one additional award B. Agree Implementation Date: June 2026 The Department agrees with this finding and will provide any training needed to staff members to ensure that all components of the FFATA are completed accurately, timely and with proper reviews. This training will include leadership reviewing NHTSA/Federal guidelines and SAM.Gov training on FFATA reporting and requirements, documenting controls and ensuring the approvers have access to all supporting schedules, forms and systems and that they understand the subawards, and process for late submissions if needed. C. Agree Implementation Date: June 2026 The Department agrees with the finding and will ensure that staff follow all internal policies and procedures to maintain accurate and complete FFATA reporting. To achieve this, staff will review existing procedures and make any necessary updates regarding report compilation. Additionally, we will review control points to ensure they are consistently followed and approved by the team supervisor or team manager.

The following finding and recommendation relating to an internal control deficiency classified as a Significant Deficiency was communicated to the Department of Transportation (Department) in the previous year and has not been remediated as of June 30, 2025 because the original implementation date provided by the Department was in a subsequent fiscal year. This complete finding and recommendation can be found within the original report and the complete recommendation can be found within Section IV: Disposition of Prior Audit Recommendations of this report. Finding 2024-058 Compliance with Subrecipient Monitoring for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and SLFRF The Department receives federal grant funds directly from the federal government for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program and then subgrants, or passes through, a portion of the funds to cities and counties and other organizations that are considered to be either a subrecipient or a contractor. For Fiscal Year 2024, the Department had the following transactions that were subject to subrecipient monitoring testing: • Formula Grants for Rural Areas and Tribal Transit Program – 783 subrecipient transactions totaling $23,075,270. • Highway Safety Cluster – 829 subrecipient transactions totaling $5,669,865. • SLFRF – 232 subrecipient transactions totaling $38,321,493. For the SLFRF program, Intergovernmental Agreements are executed between the Department and subrecipients to communicate all relevant federal award information. For both the Formula Grants for Rural Areas and Tribal Transit Program and Highway Safety Cluster, Subaward Agreements (subawards) are executed between the Department and subrecipients to communicate all relevant federal award information. Intergovernmental Agreements and subawards are signed by authorized State personnel, generally the State Controller and the Department’s Chief Engineer. The Department includes a “Subrecipient Risk Assessment” tool with its Intergovernmental Agreements or subawards, which must be completed by Department staff prior to making the award. The Department’s subrecipient monitoring procedures are dependent on the assessed risk level noted in the Subrecipient Risk Assessment tool. Federal regulations [2 CFR Part 200 Section F] state that a non-federal entity that expends $1,000,000 or more in federal awards during the non-federal entity’s fiscal year must have a Single Audit conducted in accordance with 2 CFR 200.514. The Department’s Internal Audit Division staff tracks and receives Single Audit reports from its subrecipients. As part of the Department’s monitoring procedures, the Internal Audit Division personnel complete a “Single Audit Report Review Summary” form to show they reviewed the subrecipient’s Single Audit report, summarized any findings, and concluded on any risks presented to the Department and any related future actions to be taken. The form is signed by a Department preparer and a Department reviewer. For those subrecipients not required to file a Single Audit, an “Audit Division Single Audit Certification Form” must still be submitted by the subrecipients to the Department. These forms note that the entity was exempt from a Single Audit. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine if the Department complied with federal requirements for subrecipient monitoring during Fiscal Year 2024 for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and the SLFRF program and to determine whether the Department had adequate internal controls over subrecipient monitoring. As part of our audit work, we reviewed the Department’s internal controls over compliance for subrecipient monitoring and tested the Department’s compliance with federal subrecipient monitoring requirements. Specifically, we performed the following testwork related to each of the following federal programs: • Formula Grants for Rural Areas and Tribal Transit Program—We selected and reviewed a random sample of 40 subrecipient payment transactions. We reviewed subawards, amendments, and other supporting documentation provided by the Department. • Highway Safety Cluster—We selected and reviewed a random sample of 40 subrecipient payment transactions. We reviewed subawards, amendments, and other supporting documentation provided by the Department. • SLFRF—We selected and reviewed a random sample of 29 subrecipient payment transactions. We reviewed Intergovernmental Agreements, amendments, and other supporting documentation provided by the Department. How were the results of the audit work measured? Our audit work was designed to measure the Department’s compliance with the following criteria: • Federal regulation [2 CFR 200.303] states that the Department, as a federal grant recipient, must “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” • Federal regulation [2 CFR 200.332 (a)(1)] states that the Department’s subawards must clearly identify certain information, including but not limited to, the ALN, the Federal Award Date, and the FAIN. • Federal regulation [2 CFR 200.331] states that a pass-through entity, in this case the Department, must make case-by-case determinations as to whether each agreement it makes for the disbursement of federal program funds represents a payment of funds to a subrecipient or a contractor, depending on the role the entity plays. What problems did the audit work identify? We determined that the Department did not fully comply with subrecipient monitoring requirements during Fiscal Year 2024. Specifically, we noted the following: • Formula Grants for Rural Areas and Tribal Transit Program o For 10 of 40 (25 percent) subrecipient payment transactions selected for testing, we determined the subaward documents did not contain the federal award date in the subaward agreement, as required. The 10 transactions totaled $7,432,248 in subrecipient awards. • Highway Safety Cluster o For 1 of 40 (3 percent) subrecipient payment transactions selected for testing, we determined that the subrecipient should have been classified as a contractor, not a subrecipient. The transaction totaled $75,325. The Department had not made an adjusting entry in CORE to reclassify the transaction and correct this error by the end of our audit testwork. o For 5 of 40 (13 percent) subrecipient payment transactions selected for testing, we determined the subaward documents did not contain the federal award date in the subaward agreement. The 5 transactions totaled $25,100 in subrecipient awards. • SLFRF o For 2 of 29 (7 percent) subrecipient payment transactions selected for testing, we determined that the Intergovernmental Agreement did not include the FAIN and Federal Award Dates. The 2 transactions totaled $3,277,779 in subrecipient awards. o For 1 of 29 (3 percent) subrecipient payment transactions selected for testing, we determined the transaction did not include the ALN. This transaction totaled $1,851,279 in subrecipient awards. Why did these problems occur? The Department’s procedures and internal controls were not sufficient to ensure that Intergovernmental Agreements and subawards included all the required information to be included in the subaward, and internal controls did not prevent or detect errors. Department staff were not aware that this information was needed for the subaward to be in compliance with federal regulations. In some situations, the FAIN was only provided to the Department from the U.S. Department of Transportation subsequent to when the subaward was made. In these instances, the Department was not aware that they were required to provide the FAIN to their subrecipients once it was determined by the U.S. Department of Transportation. The Department’s procedures and internal controls were not sufficient to ensure that payments were properly classified as general disbursements or subrecipient payments, and internal controls did not prevent or detect errors. Department staff lacked the appropriate knowledge of the difference in contractors and subrecipients to ensure the proper classification of expenditures. The Department’s reviewers did not complete a sufficient review of the expense classifications to be able to identify the misclassification and propose a subsequent correction. Why do these problems matter? Based on the issues we identified, the Department is out of compliance with federal subrecipient requirements and could face sanctions or other penalties. In addition, by failing to properly report the required federal grant award information at the time of subaward issuance, subrecipients may be uninformed about what funding the subaward related to. This could result in misclassification of subaward information on the subrecipients’ Schedules of Expenditures of Federal Awards (SEFA) and the subrecipient may not know what federal requirements they need to follow as part of receiving the federal award funds. The Department’s improper classification of expenses as general disbursements versus subrecipient payments could lead to misstatements in the amounts reported on the SEFA, both for the State as a whole and at the subrecipient level. See "Schedule of Findings and Questioned Costs" for chart/table. Recommendation 2024-058 The Department of Transportation (Department) should strengthen its internal controls over and ensure that it complies with federal subrecipient monitoring requirements for the Formula Grants for Rural Areas and Tribal Transit Program, the Highway Safety Cluster, and the Coronavirus State and Local Fiscal Recovery Funds. Specifically, the Department should ensure that all required information is included in subawards or intergovernmental agreements or provide amendments to the subawards or intergovernmental once the Department receives the necessary information from the federal government, and that Department staff are sufficiently aware of the difference in subrecipients and contractors and properly classify general disbursements versus subrecipient payments. Response Department of Transportation Agree Implementation Date: June 2026 Department will strengthen controls to ensure that the required award information is provided, once available. Certain information such as Federal Award Identification Number and Federal Transit Administration and National Highway Traffic Safety Administration award date are not available at the time of contracting CDOT is working on a process to provide this information, once it is available in a publicly available format on CDOT’s website or on a subrecipient facing grant management site. We will add a note to the contract explaining where the information will be posted on our site when it becomes available. The Department will also identify staff requiring additional training on classification and coding for contractors vs. subrecipients.

2025-017: Evaluate Subrecipients’ Risk of Noncompliance in Accordance with Federal Regulations Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-085; 2023-100; 2022-016; 2021-071 Finding Type: Internal Control and Compliance Finding Severity: Significant Deficiency Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: Supplemental Nutrition Assistance Program – 10.551; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program – 10.561; Temporary Assistance for Needy Families (TANF) - 93.558; Child Care and Development Block Grant - 93.575; Federal Award ID (Year): 251VA407S2514 (2025); 2501VATANF (2025); 2502VACCDD (2025); 2502VACCDM (2025) Federal Agency: Various Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.332(b) Known Questioned Costs: $0 As in prior years, Benefit Programs is still not confirming that program consultants evaluate each subrecipient’s risk of noncompliance in accordance with its subrecipient monitoring plan. Benefit Programs oversees the Medicaid, SNAP, TANF, and CCDF Cluster federal grant programs. Benefit Programs disbursed over $425 million in grant funding during fiscal year 2025 from these federal grant programs to over 260 subrecipients. In response to prior audit recommendations, Benefit Programs hired a subrecipient monitoring coordinator in fiscal year 2025 and began creating new materials for managing risk assessments and monitoring reviews, including developing a memorandum detailing the schedule and operation for monitoring activities. Additionally, Benefit Programs developed tracking tools to monitor completion of risk assessments and follow-up activities. However, due to the extent of its corrective actions, Benefit Programs did not complete all corrective actions by the end of fiscal year 2025. As a result, we noted the following deviations while auditing Benefit Programs’ fiscal year 2025 subrecipient monitoring activities: Program consultants did not complete programmatic risk assessments for 17 of 42 (40%) non-locality subrecipients with fiscal year payments. Program consultants did not provide an adequate justification for not conducting monitoring reviews for 11 of 76 (14%) locality risk assessments rated high or medium. Program consultants did not complete 15 of 316 (5%) locality programmatic risk assessments. Title 2 CFR § 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Additionally, Benefit Programs’ subrecipient monitoring plan requires that all staff follow its procedures which guides the process and frequency for ongoing subrecipient monitoring of public assistance programs at local departments. Without appropriate oversight of program consultants, Benefit Programs cannot demonstrate proper monitoring of subrecipient activity, including whether the subrecipient used the subawards for authorized purposes and in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Benefit Programs should continue to implement its planned corrective actions to evaluate subrecipient’s risk of noncompliance in accordance with federal regulations. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.

2025-016: Review Non-Locality Subrecipient Single Audit Reports Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-084; 2023-098; 2022-013; 2021-072; 2020-075; 2019-091; 2018-092 Finding Type: Internal Control and Compliance Finding Severity: Significant Deficiency Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: State Administrative Matching Grants for the Supplemental Nutrition Assistance Program – 10.561; MaryLee Allen Promoting Safe and Stable Families Program - 93.556; Temporary Assistance for Needy Families (TANF) - 93.558; Social Services Block Grant - 93.6 Federal Award ID (Year): 251VA407Q3903 (2025); 2501VATANF (2025); 2502VAFPSS (2025); 2501VASOSR (2025) Federal Agency: Various Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.332(d)(3); 2 CFR § 200.332(f) Known Questioned Costs: $0 Compliance continues to not review non-locality subrecipient Single Audit reports as set forth within Compliance’s Agency Monitoring Plan. Non-locality subrecipients are subrecipients who are not local governments (primarily non-profit organizations). During fiscal year 2025, Social Services disbursed approximately $125 million in federal funds to 252 non-locality subrecipients. Of the 11 non-locality subrecipients that received more than $750,000 in federal funds from Social Services, we identified two (18%) that did not have a Single Audit reporting package available in the Federal Audit Clearinghouse (Clearinghouse) for the most recent audit period; one of which appeared to have never filed a Single Audit reporting package. Since the prior audit, Compliance adopted a policy regarding how to obtain and review information from the Clearinghouse, compiled a list of non-locality subrecipients receiving federal funds, and worked with Social Services’ Contract and Procurement Team to update contract language that requires the non-locality to communicate anticipated federal spending to Social Services so Compliance can monitor adherence with the Single Audit requirements. However, because of the extent of its corrective actions, Compliance was unable to fully implement its corrective action and review all non-locality subrecipient Single Audit reports by fiscal year end. Title 2 CFR § 200.332(f) requires pass-through entities to verify that subrecipients expending $750,000 or more in federal awards during the fiscal year obtain a Single Audit. Additionally, Compliance’s Agency Monitoring Plan requires the subrecipient monitoring coordinator to reference a comprehensive list of non-locality subrecipients and corresponding federal expenditures, identify subrecipients required to obtain a Single Audit, verify submission of those audits to the Clearinghouse, and follow up with subrecipients that have not complied. Without verifying whether non-locality subrecipients receive a Single Audit, Compliance is unable to provide assurance that Social Services is fulfilling its responsibilities as a pass-through entity. By not reviewing non-locality subrecipient Single Audit reports, Social Services may be unaware of a potential liability to the Commonwealth. Not complying with federal regulations could result in federal awarding agencies temporarily withholding payments until Social Services takes corrective action; disallowing costs for all or part of the activity associated with the noncompliance; suspending or terminating the federal award in part or in its entirety; initiating initial suspension or debarment proceedings; and/or withholding further federal funds for the project or program. Compliance should continue its corrective action efforts and begin reviewing non-locality subrecipient Single Audit reports. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.

2025-014: Perform Responsibilities Outlined in the Agency Monitoring Plan Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-082; 2023-097; 2022-011; 2021-070; 2020-074; 2019-090; 2018-093 Finding Type: Internal Control and Compliance Finding Severity: Material Weakness Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: Grants to States for Medicaid – 93.778 Federal Award ID (Year): 2505VA5MAP (2025) Federal Agency: U.S. Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.303(a); 2 CFR § 200.332 Known Questioned Costs: $0 The Department of Social Services (Social Services) Compliance Division (Compliance) continues not to adhere to its established approach for overseeing agency-wide subrecipient monitoring, as outlined in its Agency Monitoring Plan. In response to the prior audit recommendations, Compliance made significant revisions to its Agency Monitoring Plan to include tools for tracking and monitoring division-level subrecipient monitoring reviews, began meeting monthly with division-level subrecipient monitoring coordinators, and developed a quarterly variance report that it will use to report the status of the agency’s subrecipient monitoring activities to Social Services’ Executive Team. Compliance adopted its revised Agency Monitoring Plan in July 2025 and anticipates completing the remainder of its corrective actions by the end of fiscal year 2026. Additionally, Social Services hired a director to lead Compliance in fiscal year 2025. Social Services engaged a consultant in April 2025 to help develop remediation plans for its previous audit findings. However, because of the extent of its corrective actions, Compliance could not design and implement its corrective actions by the end of fiscal year 2025. As a result, we identified the following deviations from the Agency Monitoring Plan: Compliance did not review programmatic division annual subrecipient monitoring plans to ensure they implement a risk-based approach. The Agency Monitoring Plan states that Compliance will use a monitoring plan checklist to evaluate and determine if all the required elements for subrecipient monitoring are present in each division’s plan. As a result, Compliance was not aware that the Division of Benefit Programs' (Benefit Programs) non-locality risk assessment template did not include all required risk factors outlined in the Agency Monitoring Plan. Compliance did not confirm that division-level subrecipient monitoring coordinators are maintaining monitoring documentation in Compliance’s centralized repository. As a result, Compliance could not confirm the completeness of the centralized repository. The Agency Monitoring Plan requires that Compliance monitor whether divisions post monitoring review reports to the centralized repository. Compliance did not review each division’s monitoring activities nor provide the required quarterly reports of variances and noncompliance from the Agency Monitoring Plan to Social Services’ Executive Team. As a result, Compliance and the Executive Team were not aware that Benefit Programs did not comply with certain aspects of its subrecipient monitoring plan, such as maintaining complete sampling documentation, monitoring records and reports, and documenting subsequent corrective action. Title 2 U.S. Code of Federal Regulations (CFR) § 200.303(a) requires pass-through entities to establish, document, and maintain effective internal control over federal awards to ensure compliance with applicable laws, regulations, and award terms. Further, 2 CFR § 200.332 requires pass-through entities to monitor subrecipients to ensure they meet federal requirements. Finally, the Agency Monitoring Plan establishes Compliance’s responsibility to centrally coordinate, review, and report on subrecipient monitoring activities across all divisions. Compliance is responsible for agency-wide compliance and risk mitigation that helps ensure adherence to state and federal legal and regulatory standards. During fiscal year 2025, Social Services disbursed approximately $700 million in federal funds to roughly 350 subrecipients from 37 federal grant programs. Without performing the responsibilities in the Agency Monitoring Plan, Compliance cannot provide the Executive Team with assurance that Social Services’ subrecipient monitoring efforts are adequate to comply with the regulations at 2 CFR § 200.332. Additionally, Compliance places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards by not monitoring the agency’s subrecipient monitoring activities. Because of the scope of this matter and the magnitude of Social Services’ subrecipient monitoring responsibilities, we consider these weaknesses collectively to create a material weakness in internal controls since Compliance did not implement its corrective actions by the end of fiscal year 2025. Compliance should continue to implement its planned corrective actions to perform the responsibilities outlined in its Agency Monitoring Plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.

2025-018: Confirm Monitoring Activities are Conducted in Accordance with the Monitoring Plan Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-086; 2023-102; 2022-014 Finding Type: Internal Control and Compliance Finding Severity: Significant Deficiency Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: Supplemental Nutrition Assistance Program – 10.551; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program – 10.561; Temporary Assistance for Needy Families (TANF) - 93.558; Child Care and Development Block Grant - 93.575; Federal Award ID (Year): 2501VATANF (2025); 2505VA5MAP (2025); 251VA407Q3903 (2025); 2502VACCDD (2025); 2502VACCDM (2025) Federal Agency: Various Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.332(e) Known Questioned Costs: $0 Benefit Programs continues to not confirm that program consultants complete required subrecipient monitoring procedures and/or document their work in accordance with its subrecipient monitoring plan. Benefit Programs oversees the Medicaid, SNAP, TANF, and CCDF Cluster federal grant programs. Benefit Programs disbursed over $425 million in grant funding during fiscal year 2025 from these federal grant programs to over 260 subrecipients. In response to prior audit recommendations, Benefit Programs hired a subrecipient monitoring coordinator in fiscal year 2025 and began creating new materials for managing risk assessments and monitoring reviews, including developing a memorandum detailing the schedule and operations for monitoring activities. However, due to the extent of its corrective actions, Benefit Programs did not complete its corrective actions by the end of fiscal year 2025. As a result, Benefit Programs did not identify incomplete sampling documentation, missing monitoring records, untimely locality notifications, incomplete monitoring reports, or insufficient documentation of corrective actions across multiple locality reviews. While reviewing fiscal year 2025 monitoring activities, we noted the following deviations from Benefit Programs’ subrecipient monitoring plan: Benefit Programs did not confirm that program consultants uploaded all required monitoring records to the data repository. As a result, Benefit Programs could not provide complete documentation for six out of 20 locality reviews (30%). Benefit Programs did not confirm that program consultants maintained complete sampling documents and final locality review reports for five out of 20 locality reviews (25%). Benefit Programs did not confirm that program consultants fully documented corrective actions for five out of 20 locality reviews (25%). Benefit Programs did not confirm that program consultants selected and documented sampling units appropriately. As a result, three out of 20 locality reviews (15%) lacked sufficient documentation of sampling units, and one out of 20 reviews (5%) did not include the required number of sampled cases. Benefit Programs did not confirm that program consultants included all required elements in their final monitoring review reports in two out of the 20 locality reviews (10%). Benefit Programs did not confirm that program consultants provided timely notification to localities for the monitoring review for one out of 20 locality reviews (5%). Title 2 CFR § 200.332(e) requires pass-through entities to monitor subrecipients use of subawards for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the award. Benefit Programs’ subrecipient monitoring plan outlines the required monitoring steps, documentation standards, and timelines necessary to comply with this regulation. Without confirming that program consultants complete monitoring activities in accordance with its monitoring plan, Benefit Programs cannot provide reasonable assurance that it complied with federal monitoring requirements. These deficiencies can increase the risk of undetected noncompliance, disallowed expenditures, and potential suspension or termination of federal awards. Benefit Programs should continue to implement its planned corrective actions to confirm that program consultants conduct subrecipient monitoring activities in accordance with its monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.

2025-001 - Material Weakness in Internal Control and Material Compliance over Subrecipient Monitoring: Incomplete Subaward Agreements Identification of federal programs: Federal Agency: Department of Commerce (DOI) ALN: 11.438 – Pacific Coast Salmon Recovery Pacific Salmon Treaty Program Award Numbers: NA22NMF4380226, NA20NMF4380258, and NA21NMF4380467 Criteria: Per 2 CFR 200.332(a), pass-through entities must provide specific information to subrecipients at the time of the subaward, including but not limited to:  Subrecipient name, UEI, and contact information  Federal Award Identification Number (FAIN)  Federal award date  Period of performance  CFDA/ALN number and program name  Total amount of federal funds obligated  All requirements imposed by the pass-through entity  Indirect cost rate information  Provisions for closeout Failure to include the required information limits the subrecipient’s ability to comply with federal requirements. Condition: During our testing of subrecipient monitoring, we noted that the subawards were missing elements under 2 CFR 200.332(a), including the assistance listing number and amount of federal funds obligated. Further, these relevant compliance requirements were not communicated to the subrecipients at any other time in writing. The entity made subaward payments totaling $784,907 during the audit period without maintaining complete documentation demonstrating compliance with federal subaward requirements. Cause: Pass through funding through subawards was new for the Organization and they were not familiar with subrecipient disclosure requirements. Effect or potential effect: Failure to issue complete subaward agreements increases the likelihood that subrecipients may not comply with federal requirements. These deficiencies represent a material weakness because they indicate a reasonable possibility that material noncompliance with federal requirements could occur and not be prevented or detected. Questioned Costs: None. Context: There were seven subrecipients under the program. In 2025, subrecipient expenditures totaled $784,907. Identification of Repeat Finding: Not applicable. Recommendations: Management should implement a standardized subaward agreement template that incorporates all elements required by 2 CFR 200.332(a). Views of Responsible Officials: See Corrective Action Plan.

2025-002 Material Weakness in Internal Control and Material Compliance over Subrecipient Monitoring: Failure to Verify Single Audit Requirement and Follow Up on Findings Identification of federal programs: Federal Agency: Department of Commerce (DOI) ALN: 11.438 Pacific Coast Salmon Recovery Pacific Salmon Treaty Program Awards: NA22NMF4380226, NA20NMF4380258, and NA21NMF4380467 Criteria: The entity did not verify whether subrecipients who expended $750,000 or more in federal funds obtained the required single audit. Additionally, the entity did not document any follow-up or management decisions on potential subrecipient audit findings. Under 2 CFR 200.332(f)–(g), pass-through entities must:  Verify that subrecipients expending $750,000 or more in federal awards during the fiscal year have obtained a single audit in accordance with Subpart F.  Review subrecipient audits to determine whether findings related to the program exist.  Issue management decisions on audit findings, when applicable, and ensure timely corrective action. Condition: During our testing of subrecipient monitoring, we identified significant deficiencies in the entity’s processes for determining whether subrecipients were required to obtain a Single Audit and for following up on known audit findings:  The entity did not document whether the subrecipient spent $750,000 or more in federal awards and therefore did not determine whether a Single Audit was required under 2 CFR 200.501(a).  One subrecipients had publicly available Single Audit reports that included material weaknesses, yet the entity did not obtain the audit reports, review them, or follow up on corrective action plans.  No documentation was maintained to demonstrate that the entity performed annual verification of audit status, reviewed the Federal Audit Clearinghouse, or communicated with subrecipients regarding audit results. Recommendations: We recommend the entity develop and implement written procedures to: Annually assess subrecipient federal expenditures to determine single audit requirements, obtain and review subrecipient audit reports, including follow-up on any findings, document management decisions and track corrective action until resolution. Views of Responsible Officials: See Corrective Action Plan. Cause: The entity lacks formal policies and procedures for monitoring subrecipients in conformance with Uniform Guidance, including annual confirmation of federal expenditures and review of audit reports. Effect or potential effect: Failure to verify audit requirements and follow up on findings limits the entity’s ability to ensure subrecipients comply with federal regulations. This increases the risk of unaddressed noncompliance, misuse of federal funds, and potential liability for the pass-through entity. Questioned Costs: None. Context: There were seven subrecipients under the program of which 4 subrecipients were reviewed related to the monitoring of audit requirements. In 2025, subrecipient expenditures totaled $784,907. Identification of Repeat Finding: Not applicable.

Finding Reference 2025-004 Federal Agency: U.S. Department of Housing and Urban Development Pass-Through Agency: P.R. Department of Housing Program: Community Development Block Grant/State’s Program and Non-Entitlement Grants in Hawaii (Assistance Listing No. 14.228) Compliance Requirement: Reporting (L) Type of Finding: Significant Deficiency (SD), Instance of Noncompliance (NC) This finding is similar to prior-year finding 2023-004 and 2024-004. Statement of Condition In our reporting test, we evaluate four (4) quarterly reports and two (2) of them were not submitted and one (1) was submitted late. Additionally, two (2) quarterly reports that were submitted do not agree with the accounting records. Criteria Based on the CDBG agreements, the Municipality must submit to the Department of Housing reports on records, collections, and disbursements of Program Income on an annual and quarterly basis. Including the progress of the projects developed with the CDBG program. In addition, the Municipality will submit all the reports required by the Agency. Failure to comply with this provision will be just cause for the Department to stop the fund requisition process. § 200.332 Requirements for pass-through entities. (1) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award. (2) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports. Cause of Condition The Municipality does not have the necessary personnel assigned to prepare and present reports in a timely manner. Effect of Condition The program is not in compliance with the reporting requirements as established in the contract agreement. Recommendation We recommend that the Municipality maintain constant monitoring to improve program controls. The reports must be presented as established in the agreement and guidelines of the Department of Housing. This will ensure compliance with the reporting requirements under the Community Development Block Grants/State’s Program and Non-entitlement Grant in Hawaii agreement. Questioned Cost None Prior Year Finding Yes. This finding is similar to prior-year finding 2023-004 and 2024-004. Views of Responsible Officials and Planned Corrective Action We concur with the findings. The Municipality will be implementing the following measures to address the finding related to the late filing of the quarterly reports of the CDBG Program: 1. An accountant was hired to assume direct responsibility for the preparation, review, and filing of the CDBG Program's financial and programmatic reports. 2. Technical guidance was requested and received from the Department of Housing to ensure proper preparation and compliance with applicable reporting requirements. 3. All overdue quarterly reports and corresponding reports were filed until December 2025, including the reconciliation of the requisitioned balances versus the paid balances. 4. An internal compliance calendar was established, with deadlines and administrative supervision, to ensure timely filing in future periods. Implementation Date: December 31, 2025 Responsible Person: Pedro Santiago Federal Programs Director

Federal Agency: U.S. Department of Health and Human Services Federal Program Title: • Emerging Infections Programs • Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Numbers: • 93.317 • 93.323 Award Periods: • NU50CK000649 (1/1/2024 – 12/31/2028) (93.317) • NU50CK000548 (8/1/2019 – 7/31/2024) (93.323) • NU50CK000346 (8/1/2024 – 7/31/2029) (93.323) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement: Per §200.332, Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: We noted during our testing the programs did not evaluate the subrecipient’s risk of noncompliance with a subaward to determine appropriate subrecipient monitoring. While the Department has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with federal laws, regulations, and program compliance requirements as well as Department policy. Questioned Costs: None Cause: The Department continues to lack established subrecipient monitoring internal controls and procedures that comply with the uniform administrative requirements. Effect: The Department was not in compliance with federal award subrecipient monitoring requirements. Continued noncompliance could result in sanctions by the federal awarding agency, including withholding future funding. Repeat Finding: Yes 2025-008 (2024-005) Subrecipient Monitoring (Significant Deficiency, Other Noncompliance) (Continued) Recommendation: The Department should establish policies and procedures to ensure monitoring activities are performed for all subawards. Agency Response: The Department acknowledges this finding and provides a corrective action plan to prevent future similar findings. The Department does not have written procedures in place to ensure subrecipient expenditures are incurred for authorized purposes in accordance with the terms and conditions of the subaward. The Department has implemented new policies and procedures to ensure subrecipient activity controls and processes are performed for all subawards. The Division Heads will monitor their program staff and grant administrators to ensure that they are monitoring grantee activities of subrecipients to ensure that subaward is used for authorized purposes, in compliance with Federal statues, regulations and terms and conditions of the subaward. The Department is working on remediation of this finding and anticipates completion before June 30, 2026. This action plan will comply with 2 CFR Part 200 Uniform Administrative Requirements, Post Federal Award Requirements and Cost Principles for Federal Award. Responsible Persons: Federal Grants Director, Chief Procurement Officer, Contract Managers, Division Finance Directors, and Grant Administrators.

Condition: During our audit we reviewed the partnership agreement with the subrecipient. We noted the Organization did not include all required information in the partnership agreement. Criteria: As described in 2 CFR § 200.332, the Organization is required to have specific information described in the agreements with subrecipients. Cause: During the year, the Organization received a grant that specifically named the subrecipient. Due to this situation, the agreement between the Organization and the subrecipient was missing required information. Effect: Due to not including all required information in the partnership agreement with the subrecipient, this caused unclear or unknown requirements in the partnership agreement. Recommendation: After thoroughly reviewing the unique circumstance that led to this audit finding, we have determined that it is highly unlikely to recur. Given the Organization's strong compliance history and familiarity with subrecipient requirements under Uniform Guidance, we do not see a cost-effective benefit to revamping internal controls specifically for this issue. Instead, we recommend continuing to; review government awards, provide refresher trainings to staff, and conduct periodic reviews of internal controls to ensure ongoing compliance. These measures will effectively address the finding without incurring unnecessary costs. Views of Responsible Officials: Management agrees with the finding.

Program: AL 84.010 – Title I Grants to Local Educational Agencies – Subrecipient Monitoring Grant Number & Year: All open, including S010A230027, FFY 2024; S010A240027, FFY 2025 Federal Grantor Agency: U.S. Department of Education Criteria: 2 CFR § 200.332 (January 1, 2024, and January 1, 2025) requires a pass-through entity to monitor the activities of subrecipients as necessary to ensure that subaward funds are used for authorized purposes in compliance with Federal regulations, track Single audit requirements and verify that a Single audit was obtained if required, review financial and performance reports of the subrecipient, and follow-up and resolve all audit finding pertaining to the Federal award. 2 CFR § 200.501 (January 1, 2024), as it applies to audit requirements of entities for fiscal years ended prior to October 1, 2025, states the following: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single audit conducted in accordance with § 200.514[.] Good internal control requires policies and procedures to ensure that subrecipient monitoring is sufficiently designed and performed regularly to provide assurance that grant funds are used in accordance with Federal requirements. This includes maintaining adequate documentation to support fiscal monitoring performed for Federal programs and documentation of follow-up procedures performed when subrecipients are expected to have Federal expenditures exceeding Federal audit requirement thresholds but do not receive a Federal Single audit. Condition: The Agency’s procedures can be improved to ensure that: • Subrecipients’ uses of funds were monitored to ensure compliance with all Federal and grant requirements. • Subrecipients obtain Single audits mandated by Federal requirements. Repeat Finding: No Questioned Costs: None Statistical Sample: No Context: The Agency disbursed $106,911,261 of Title I Federal funds to 242 different subrecipients during the fiscal year ended June 30, 2025. We noted the following during our subrecipient monitoring testing. Insufficient Subrecipient Fiscal Monitoring Procedures Per its fiscal monitoring procedures and schedule, the Agency is to perform fiscal monitoring of the various subrecipients on a three-year rotational cycle. These procedures include reviewing subrecipient expenditures claimed for subgrant awards applicable for the period the Agency is monitoring. We randomly selected 25 subrecipients to review the fiscal monitoring documentation provided by the Agency. We noted the following for two subrecipients: • For one subrecipient tested, the fiscal monitoring was last completed in August 2021 for the 2019–2020 program year, during which no compliance errors were noted. Per the Agency, fiscal monitoring was scheduled to be performed again in calendar year 2023 for the 2022–2023 program year; however, this monitoring was never performed. As of June 30, 2025, no fiscal monitoring review had been initiated. Additionally, during a review of reimbursement requests submitted during the fiscal year, we noted some questionable expenditures, including $3,027 spent on hotels at Disney’s Animal Kingdom in Florida, which were reportedly in association with a teaching conference held eight miles away at the Orlando World Center Marriott. The daily rate charged by the hotel was $299 per night; the Government Services Administration’s rate for lodging in Orlando for June 2024 was $140 per night. We also noted that a possible travel expenditure of $955 was paid to Holiday Express for which no support was obtained. These types of higher-risk expenditures further highlight the need for subrecipient monitoring to be performed regularly. • For another subrecipient, the Agency last completed its fiscal monitoring in August 2025 for the 2023–2024 program year. However, monitoring documentation was not sufficient to determine what monitoring procedures were completed or whether that monitoring was adequate. While we did observe various records on file, including employee time and effort logs and invoices supporting supplies and service costs, the audit worksheet that the Agency is supposed to complete for all fiscal monitoring performed did not indicate what items were reviewed or the conclusion regarding those items. We did observe an exit letter issued by the Agency in August 2025, which indicated that no issues were found. Single Audit Tracking Procedures During our review of subrecipient audits and Single audit tracking procedures implemented by the Agency, we noted that, for one subrecipient tested, the Agency had identified the subrecipient as having more than $750,000 in Federal expenditures for the subrecipient’s fiscal year ended August 31, 2024, but noted that no Single audit was required. After we inquired with the Agency, no documentation could be provided to support that the Agency performed any follow-up procedures to verify that a Single audit was not required. Cause: Inadequate procedures to ensure that subrecipients complied with all Federal and grant requirements or to ensure that subrecipients obtained Single audits when required. Effect: Without adequate monitoring and review procedures, there is an increased risk that Federal awards could be used for unallowable costs. Recommendation: We recommend the Agency strengthen procedures to ensure that subrecipient monitoring is properly designed to ensure compliance with all Federal and grant requirements and that documentation is maintained to support procedures performed. We also recommend the Agency strengthen procedures to ensure that subrecipient Single audit requirements are properly tracked, and all Single audits are reviewed in a timely manner. Management Response: NDE agrees with this finding.

Program: AL 84.365 – English Language Acquisition State Grants – Subrecipient Monitoring Grant Number & Year: All open, including S365A230027, FFY 2024; T365A240027, FFY 2025 Federal Grantor Agency: U.S. Department of Education Criteria: 2 CFR § 200.332 (January 1, 2024, and January 1, 2025) requires a pass-through entity to monitor the activities of subrecipients as necessary to ensure that subaward funds are used for authorized purposes in compliance with Federal regulations, track Single audit requirements and verify that a Single audit was obtained, if required, review financial and performance reports of the subrecipient, and follow up and resolve all audit finding pertaining to the Federal award. Good internal control requires policies and procedures to ensure that subrecipient monitoring is sufficiently designed and performed regularly to provide assurance that grant funds are used in accordance with Federal requirements. This includes maintaining adequate documentation to support fiscal monitoring performed for Federal programs, such as documenting the populations of transactions that agree or reconcile to reimbursement requests, identifying the specific transactions that are being reviewed, and maintaining supporting documentation for those specific items reviewed. Condition: The Agency lacked adequate procedures for monitoring subrecipient use of funds to ensure compliance with all Federal and grant requirements. Repeat Finding: No Questioned Costs: None Statistical Sample: No Context: The Agency disbursed $6,255,240 of Federal funds to 26 different subrecipients during the fiscal year ended June 30, 2025. We randomly selected 10 subrecipients to ensure that subrecipient monitoring was adequate to ensure that funds were used in accordance with Federal requirements. We noted issues with monitoring procedures for eight subrecipients tested. The following table identifies the eight subrecipients, the total amount of aid paid during the fiscal year ended June 30, 2025, the last school year reviewed, and the funds subject to monitoring for those years. See Schedule of Findings and Questioned Costs for chart/table. Insufficient Subrecipient Fiscal Monitoring Procedures Per the Agency’s fiscal monitoring procedures and monitoring schedule, the Agency is to perform fiscal monitoring of the various subrecipients on a three-year rotational cycle. These procedures include reviewing subrecipient expenditures claimed for subgrant awards applicable for the period the Agency is monitoring. There are two subprograms that subrecipients may be awarded Federal funds by the Agency, Immigrant Education (IE) for schools that have experienced a significant increase in number of immigrant children and youth in their schools, and English Learners (EL) for schools to use to help identified students attain English proficiency and meet challenging State academic standards. During review of fiscal monitoring documentation provided by the Agency, we noted the following: • For one subrecipient tested, the Agency could not provide documentation to support the Agency’s last completed review. The Agency did provide an engagement letter, dated November 18, 2025, indicating that it had started a new monitoring review of the subrecipient for the 2023-2024 school year; however, this was after our audit period and was not yet completed. • For seven subrecipients tested, we were unable to determine how the Agency had sampled transactions for the subrecipients’ accounting records, such as a general ledger report of transactions, supporting the expenditures for the periods being reviewed. In one instance, no such records were provided in the review documentation. In another instance, the accounting records did not agree to the period being reviewed, and there was no documentation of a reconciliation by the Agency. For the remaining five, there were appropriate accounting reports; however, there was not adequate documentation of items selected for review. Additionally, when considering the specific IE and EL subprograms for which subrecipients are awarded funds, we noted the following: o For two subrecipients, there was no documentation that amounts awarded under the IE or EL subprogram were reviewed. For one of the subrecipients, documentation was provided, but it was not clear if it was actually reviewed by the Agency. o For four subrecipients, transactions were identified as being reviewed for the IE subprogram; however, there was no supporting documentation on file that could be provided to us for verification. o For four subrecipients that received EL subprogram funds, documentation was not adequate to support amounts reviewed. For one, there was no indication of amounts reviewed. Amounts were identified for the other three, but the Agency did not have any supporting documentation for the amounts identified, or it was not clear that supporting documentation was actually reviewed. We also noted that, for one subrecipient tested, the most recent fiscal monitoring review was completed in calendar year 2021, which was over three years prior. As the Agency’s procedures indicate every subrecipient should be subject to fiscal monitoring at least once every three years, we consider this review to be untimely. Other Issues Noted During our review of one subrecipient aid payment tested, we noted that the Agency’s reimbursement request review did not obtain documentation for credit card transactions, totaling $7,118, as required by the Agency’s grant management procedures. The Agency personnel that reviewed the request had indicated they reviewed the credit card transactions; however, no documentation was obtained and on file to support the transactions in accordance with the Agency’s grant management procedures. Additionally, we noted one instance of the Agency not having documentation on file to demonstrate that it followed up on corrective actions being taken by a subrecipient for issues the Agency identified during its subrecipient monitoring. Cause: Inadequate procedures to ensure that subrecipients complied with all Federal and grant requirements. Effect: Without adequate monitoring and review procedures, there is an increased risk that Federal awards could be used for unallowable costs. Recommendation: We recommend the Agency strengthen procedures to ensure that subrecipient monitoring is properly designed to ensure compliance with all Federal and grant requirements, and documentation is maintained to support procedures performed, including maintaining documentation of follow-up performed when corrective action plans are required for problems identified during the monitoring. Management Response: NDE agrees with this finding.

Program: AL 21.027 – COVID-19 – Coronavirus State and Local Fiscal Recovery Funds – Subrecipient Monitoring Grant Number & Year: SLFRP1965, March 3, 2021, through December 31, 2024 Federal Grantor Agency: U.S. Department of the Treasury Criteria: 2 CFR § 200.332 (January 1, 2024) states, in relevant part, the following: All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. * * * * (ii) Subrecipient’s unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date . . . . * * * * (x) Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; * * * * (5) A requirement that the subrecipient permit the pass-through entity and auditors to access the subrecipient’s records and financial statements for the pass-through entity to fulfill its monitoring requirements; and (6) Appropriate terms and conditions concerning the closeout of the subaward. * * * * (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the passthrough entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the passthrough entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward . . . . * * * * (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. 2 CFR § 200.318 (January 1, 2024) states, in relevant part, the following: (a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non-Federal entity’s documented procurement procedures must conform to the procurement standards identified in §§200.317 through 200.327. * * * * (i) The non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. 2 CFR § 180.300 (January 1, 2024) requires that the pass-through entity take specific steps to document that subrecipients are not suspended or debarred, as outlined below: When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM.gov Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. 2 CFR § 200.430(i) (January 1, 2024) states the following in relevant part: (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: * * * * (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities (for IHE, this per the IHE’s definition of IBS); * * * * (vii) Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (viii) Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards[.] Good internal controls and sound business practices require policies and procedures to ensure that adequate monitoring is performed to verify that subrecipients are using funds in accordance with all Federal and grant requirements. Condition: The State lacked procedures to ensure that: • Subrecipient use of funds was monitored to ensure compliance with all Federal and grant requirements. • Subrecipients obtained audits required by Federal requirements, and those audits were obtained and reviewed in a timely manner. Repeat Finding: No Questioned Costs: None Statistical Sample: No Context: The State paid $172,943,444 to subrecipients for 143 subawards during the fiscal year ended June 30, 2025. We selected 17 subrecipients to test. Additionally, we reviewed the single audit tracking procedures for all State agencies acting as pass-through entities. We noted the following: Insufficient Subrecipient Monitoring Procedures For 5 of 17 subawards tested, the APA noted that subrecipient monitoring was insufficient to ensure that the subrecipient complied with all Federal and grant requirements. Additionally, for one of the subawards tested, the APA noted that the pass-through entity did not have documentation on file to support it verified the subrecipient was not suspended or otherwise debarred. Deficiencies noted included the following: • One $86,650,000 subaward tested was issued by the Military Department (Military) to the University of Nebraska Board of Regents (University). During testing, the APA noted that the only monitoring performed by the Military was a review of the University’s single audit for fiscal year ended June 30, 2024. A total of $47,533,117 was paid to the University for the fiscal year ended June 30, 2025. • During our audit, we observed that for two subawards, one issued by the Department of Natural Resources (DNR) and one by the Department of Health and Human Services (DHHS), each valued at $2,000,000 for capital riverfront improvements and the construction of a youth activity center, respectively, significant disbursements were used to cover construction costs. However, neither pass-through entity could provide documentation supporting that subrecipient monitoring performed or planned included adequate procedures to ensure that the subrecipient had followed its written procurement policies, and procurement procedures were adequately documented. These subrecipients were paid $1,362,909 and $841,446, respectively, during the fiscal year ended June 30, 2025. • For one subaward tested, issued by the Department of Correctional Services (Corrections) for $1,505,826 to implement a transitional living and vocational skills program for former inmates, the APA did not observe any documentation supporting that Corrections had verified the subrecipient was not suspended or otherwise debarred from receiving Federal funds. Additionally, the APA noted that the subaward included significant costs for subrecipient payroll and benefit costs. For those salaried employees who had only a portion of their payroll coded to the grant, Corrections relied on budget estimates submitted at the beginning of the subaward to ensure the cost allocation was proper. The APA observed that six salaried employees had payroll costs coded to the grant, ranging from 2% - 98% of their total salaries. During the fiscal year ended June 30, 2025, the total paid to the subrecipient for this subaward was $204,302. • For one subaward issued by DHHS for $4,000,000 to be used towards increasing childcare license capacity, the APA noted that DHHS failed to perform the subrecipient monitoring procedures outlined in their monitoring policy. The monitoring policy for the subaward indicated that 10% of all expenses would be reviewed. DHHS claimed to have reviewed 10% of all reimbursements between July 2023 – April 2024; however, the APA observed $628,610 of reimbursed costs after April 2024, all of which was disbursed in August 2024 for which no review was performed. Additionally, the APA noted DHHS did not obtain appropriate documentation to support $387 of payroll costs coded to the grant. A total of $627,110 was paid to this subrecipient during the fiscal year ended June 30, 2025. Failure to Communicate all Required Subaward Information During our review of subrecipient monitoring, the APA noted that, for 4 of 17 subawards tested, the subaward did not contain all required information or contained erroneous information, as follows: • In two instances of subawards issued by DHHS, the subaward listed the Federal Award Identification Number (FAIN) as SLFRP3145; however, the primary CLSFRF award to the State of Nebraska was SLFRP1965, while the SLFRP3145 award merely passed through the State to various Non-Entitlement Units (NEU’s) in the State that were the primary recipients. • One subaward issued by DNR and one subaward issued by Corrections lacked required information, as noted below. Neither department could provide documentation showing that this information had otherwise been communicated to the subrecipient. See Schedule of Findings and Questioned Costs for chart/table. Single Audit Tracking Procedures During our review of single audit tracking procedures implemented by the State, we noted the following: • DNR and the Department of Labor (DOL) lacked procedures for determining if subrecipients were required to have a single audit or obtain and review such audits. DOL had 10 subrecipients who had received cumulative payments as of June 30, 2025, ranging from $1,000 to $318,669. DNR had 13 subrecipients that received cumulative payments as of June 30, 2025, ranging from $12,557 to $32,256,022. Three of DNR’s subrecipients have received payments over $750,000 as of June 30, 2025. In reviewing the Federal Audit Clearinghouse (FAC), two of these subrecipients had single audits for the subrecipients’ fiscal year 2024, which listed CSLFRF (ALN 21.027) as a major program and reported no findings. • During testing, the APA identified three instances of DHHS failing to obtain and review subrecipient single audits due to errors in that agency’s tracking procedures. The three subrecipients had received $2,209,137 in CSLFRF funds as of June 30, 2025. The APA obtained the fiscal year 2024 single audits for all three subrecipients from the FAC and noted that ALN 21.027 was listed as a major program on all three audits. None of the audits noted any program-related findings. Cause: Inadequate procedures to ensure that subrecipients complied with all Federal and grant requirements or to ensure that subrecipients obtained single audits when required. Effect: Without adequate monitoring and review procedures, there is an increased risk of Federal awards being used for unallowable costs. Recommendation: We recommend the State strengthen procedures to ensure that subrecipient monitoring is designed properly to ensure compliance with all Federal and grant requirements. We also recommend the State strengthen procedures to ensure that subrecipient single audit requirements are tracked properly, and all single audits are reviewed in a timely manner. Management Response: Military Department The Department of Military disagrees with this finding. The subrecipient submitted an independent audit on 4/1/2025. The independent auditor employed auditing standards generally accepted in the United States (GAAS). Major federal programs included COVID-19, Coronavirus State and Local Fiscal Recovery Funds, Assistance Listing Number 21.027. The independent auditor concluded there were no significant deficiencies or material weaknesses. The auditee was deemed “low risk.” In NEMA’s risk evaluation, it considers two separate University of Nebraska offices whose responsibility includes work to monitor and ensure compliance with Federal regulations. When determining risk appetite and risk tolerance, the “…cost of internal control should never exceed anticipated benefits. Thus, an entity must accept a certain level of risk.” Findings by the independent auditor and Auditor of Public Accounts exceed any benefit that might have been gained by additional subrecipient monitoring. In October 2025, the Agency formally adopted the Subrecipient Monitoring policy and procedure it has informally used the last several years. APA Response: 2 CFR § 200.332(d)(4) (January 1, 2024) requires pass-through entities to perform subrecipient monitoring, which includes obtaining and reviewing subrecipient Single Audit reports. Subsection (d)(4) of this regulation states: If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant audit agency or cognizant oversight agency to perform audit follow-up . . . . Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Department of Natural Resources While DNR conducted general subrecipient monitoring activities, documentation did not sufficiently demonstrate that monitoring procedures included a review of subrecipient procurement practices for compliance. DNR communicated the required federal award information to the subrecipient through other means, it was not consistently incorporated into the formal subaward agreement as required. While DNR does require Single Audits per their contracts, they did not have formalized, written procedures to consistently determine whether subrecipients met the Single Audit threshold, to ensure timely receipt and review of Single Audit reports when required. The Department acknowledges that documented procedures are necessary to ensure compliance with applicable federal regulations and to strengthen subrecipient oversight. Department of Health and Human Services Agency agrees with finding. Department of Correctional Services Management agrees with the finding.

U.S. Departments and Pass-Through Programs with various assistance listings as listed in the Schedule of Expenditures for the Research and Development Cluster Subrecipient Monitoring Material Weakness in Internal Control over Compliance and Material Noncompliance Grant Award Number: Potentially affects all grant awards with pass-through payments included under the Research and Development Cluster for DRI, NSU, UNLV, and UNR on the Schedule of Expenditures of Federal Awards. Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.332 requires that: • Pass-through entities establish policies for subrecipient monitoring that have a risk-based approach to determine the appropriate monitoring. • Pass-through entities evaluate the risk of noncompliance with a subaward to determine the appropriate monitoring. • Pass-through entities ensure that every subaward includes certain information at the time of the subaward. • Pass-through entities monitor the activities of a subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. • Pass-through entities verify every subrecipient is audited as required by Uniform Guidance, issue management decisions for audit findings, as applicable, and ensure the subrecipient take timely corrective action on all audit findings, as applicable. Condition: Subrecipient monitoring policies are not documented, risk assessments were not performed, subawards were missing required information, monitoring of activities was not performed, and subrecipient audit reports were not monitored or reviewed. Cause: Adequate internal controls were not in place to ensure compliance with subrecipient monitoring requirements for the following institutions: • Desert Research Institute (DRI) • Nevada State University (NSU) • University of Nevada, Las Vegas (UNLV) • University of Nevada, Reno (UNR) Effect: Noncompliance may occur at a subrecipient and not be detected. Questioned Costs: None Nevada System of Higher Education Schedule of Findings and Questioned Costs Year Ended June 30, 2025 Context/Sampling: A nonstatistical sample of 60 subrecipients out of a population greater than 250 across the Nevada System of Higher Education was selected for testing. The following errors were noted by institution: Desert Research Institute DRI had five subrecipients selected for testing out of the sample of 60. • Risk assessment was not performed for one of the subrecipients selected for testing. The subaward period of performance had ended during the year and thus a risk assessment was not deemed necessary by DRI. • Subawards were missing required information for two of the subawards to subrecipients selected for testing. These two subawards were entered into in prior years but had current year payments. We were unable to see subsequent communication (after the initial subawards) that required information had been communicated. • Monitoring activities were not documented adequately to provide for reasonable assurance that two of the subrecipients were using the award for authorized purposes and meeting performance objectives. • Audit reports for one subrecipient were not reviewed timely to ensure a management decision letter would be issued within six months of the clearinghouse acceptance date, if required. Nevada State University NSU had one subrecipient selected for testing out of the sample of 60. • Risk assessment was not performed for the subrecipient selected for testing. University of Nevada, Las Vegas UNLV had 23 subrecipients selected for testing out of the sample of 60. • UNLV does not have written subrecipient monitoring policies. • Risk assessment was not performed for four of the subrecipients selected for testing. • Subawards were missing required information for three of the subawards to subrecipients selected for testing. • Monitoring activities were not documented adequately for 21 subrecipients to provide for reasonable assurance that the subrecipient was using the award for authorized purposes and meeting performance objectives. • Audit reports for five subrecipients were not reviewed timely to ensure a management decision letter would be issued within six months of the clearinghouse acceptance date, if required. University of Nevada, Reno UNR had 30 subrecipients selected for testing out of the sample of 60. • Subawards were missing required information for two of the subawards to subrecipients selected for testing. • Audit reports for two subrecipients were not reviewed timely to ensure a management decision letter would be issued within six months of the clearinghouse acceptance date, if required. Repeat Finding from Prior Year: Yes – prior year finding 2024-009. Recommendation: We recommend UNLV establish subrecipient monitoring policies. In addition, we recommend DRI, NSU, UNLV, and UNR enhance internal controls to ensure compliance with subrecipient monitoring requirements. Views of Responsible Officials: The University of Nevada, Las Vegas agrees with this finding. The Desert Research Institute agrees with this finding. The Nevada State University agrees with this finding. The University of Nevada, Reno agrees with this finding.

U.S. Department of Commerce Direct and Pass-through Nevadaworks as listed in the Schedule of Expenditures of Federal Awards Economic Development Cluster, 11.307 Subrecipient Monitoring Material Weakness in Internal Controls of Compliance Grant Award Number: Affects grant award 077907854 included under assistance listing 11.307 as a direct award for UNLV on the Schedule of Expenditures of Federal Awards. Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.332 requires that: • Pass-through entities establish policies for subrecipient monitoring that have a risk-based approach to determine the appropriate monitoring. • Pass-through entities verify every subrecipient is audited as required by Uniform Guidance, issue management decisions for audit findings, as applicable, and ensure the subrecipient take timely corrective action on all audit findings, as applicable. Condition: Subrecipient monitoring policies are not documented and subrecipient audit reports were not reviewed or confirmed to not be required. Cause: The University of Nevada, Las Vegas (UNLV) did not have adequate internal controls in place to ensure subrecipients obtained required single audits or confirmed they were not required to have one. Effect: Noncompliance may occur at a subrecipient and not be detected. Questioned Costs: None Context/Sampling: No sampling was used; there is only one subrecipient applicable to this program. UNLV does not have risk-based monitoring policies for its subrecipients. In addition, for the one subrecipient tested, an inquiry was performed by UNLV to receive the single audit from the subrecipient. There was no documentation available that the subrecipient ever responded to the inquiry or that UNLV concluded the inquiry with whether a single audit was required or not. Repeat Finding from Prior Year: No Recommendation: We recommend that UNLV establish subrecipient monitoring policies and enhance internal controls to ensure subrecipients obtain a required single audit or confirm they are not required to have one. Views of Responsible Officials: The University of Nevada, Las Vegas agrees with this finding.

U.S. Department of Health and Human Services Pass-through the State of Nevada as listed in the Schedule of Expenditures of Federal Awards Epidemiology and Laboratory Capacity for Infectious Diseases, 93.323 Subrecipient Monitoring Significant Deficiency in Internal Control over Compliance Grant Award Number: Affects award SG26176 included under assistance listing 93.323 for UNLV on the Schedule of Expenditures of Federal Awards. Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.332 requires that: • Pass-through entities establish policies for subrecipient monitoring that have a risk-based approach to determine the appropriate monitoring. • Pass-through entities evaluate the risk of noncompliance with a subaward to determine the appropriate monitoring. Condition: Subrecipient monitoring policies are not documented and risk assessment was not performed. Cause: The University of Nevada, Las Vegas (UNLV) did not have adequate internal controls to ensure subrecipient monitoring policies were established and to ensure risk assessments were performed. Effect: Noncompliance may occur at a subrecipient and not be detected by UNLV. Questioned Costs: None Context/Sampling: No sampling was performed, the one subrecipient applicable to the grant was tested. We noted UNLV does not have documented subrecipient monitoring policies and a risk assessment was not performed for the subrecipient. Repeat Finding from Prior Year: No Recommendation: We recommend that UNLV establish subrecipient monitoring policies and enhance internal controls to ensure risk assessments are performed. Views of Responsible Officials: The University of Nevada, Las Vegas agrees with this finding.

U.S. Department of Health and Human Services Pass-through the State of Nevada and others as listed in the Schedule of Expenditures of Federal Awards Block Grant for Community Mental Health Services, 93.958 Subrecipient Monitoring Material Weakness in Internal Control over Compliance Grant Award Number: Affects grant award SG-2025-00677, SG-2025-00820, and SG-26361 included under the under assistance listing 93.958 for UNLV on the Schedule of Expenditures of Federal Awards. Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.332 requires that: • Pass-through entities establish policies for subrecipient monitoring that have a risk-based approach to determine the appropriate monitoring. • Pass-through entities monitor the activities of a subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: Subrecipient monitoring policies are not documented and monitoring of activities was not performed. Cause: The University of Nevada, Las Vegas (UNLV) did not have adequate internal controls to ensure required subrecipient monitoring policies were established and perform monitoring activities. Effect: Noncompliance may occur at a subrecipient and not be detected. Questioned Costs: None Context/Sampling: The entire population of three subrecipients/subawards was selected for testing across both UNLV (one) and UNR (two). The following error was noted: University of Nevada, Las Vegas • UNLV does not have written subrecipient monitoring policies. • Monitoring activities were not documented adequately to provide for reasonable assurance that the subrecipient was using the award for authorized purposes and meeting performance objectives. Repeat Finding from Prior Year: Yes – prior year finding 2024-023. Recommendation: We recommend UNLV establish subrecipient monitoring policies and enhance internal controls to ensure subrecipients are monitored for compliance with award terms and conditions. Views of Responsible Officials: The University of Nevada, Las Vegas agrees with this finding.

Department of Aging Finding 2025 – 003: ALN 93.044, 93.045, and 93.053 – Aging Cluster (including COVID-19) A Material Weakness and Material Noncompliance Exist in the Department of Aging Related to Subrecipient Monitoring (A Similar Condition Was Noted in Prior Year Finding 2024-003) Federal Grant Number(s) and Year(s): 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PASTPH (1/01/2022 – 9/30/2025), 2301PAOACM (10/01/2022 – 9/30/2025), 2301PAOAHD (10/01/2022 – 9/30/2025), 2301PAOASS (10/01/2022 – 9/30/2025), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2501PAOASS (10/01/2024 – 9/30/2026), 2501PAOACM (10/01/2024 – 9/30/2026), 2501PAOAHD (10/01/2024 – 9/30/2026), 2501PAOANS (10/01/2024 – 9/30/2026) Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Compliance Requirement: Subrecipient Monitoring Condition: Within the Aging Cluster, the Pennsylvania Department of Aging (PDOA) contracts with 52 Area Agency on Aging subrecipients to provide various services that include cares support, preventive health, and nutrition services, among others. Our audit testing disclosed that PDOA performed subrecipient monitoring on 18 of the 52 subrecipients during the fiscal year ended June 30, 2025. The review period for the 18 subrecipients monitored was 2019 through 2023, representing old grant years. The monitoring performed did not include grants in years 2024 and 2025 to ensure timely compliance. The Aging Cluster subrecipients received $66.3 million, or 97 percent, of Aging Cluster Program expenditures totaling $68.1 million reported on the Schedule of Expenditures of Federal Awards (SEFA). Criteria: 45 CFR Section 1321.9 State agency policies and procedures, states in part: (a) The State agency on aging shall develop policies and procedures governing all aspects of programs operated as set forth in this part… The State agency is responsible for implementing, monitoring, and enforcing policies and procedures, where: (1) The policies and procedures developed by the State agency shall address how the State agency will monitor the programmatic and fiscal performance of all programs and activities initiated under this part for compliance with all requirements, and for quality and effectiveness. 2 CFR Section 200.332, Requirements for pass-through entities, states: (e) Monitor the activities of the subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. Finding 2025 – 003: (continued) (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity… (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. PDOA’s Policy and Procedures Manual, Section B. Roles and Responsibilities of the State Authority states: In accordance with the State’s administrative authority, the Department’s functions and responsibilities include the following: • The establishment and maintenance of policies and procedures for the fiscal and programmatic operation of the programs. • The establishment of minimum standards for the provision of services and benefits. • Enter into contracts or grants between the State and the Area Agencies on Aging (AAA) to set forth the responsibilities and performance requirements. • Provide oversight and monitoring of the AAAs for compliance with all program's standards. • Provide oversight and fiscal management of fund utilization based on funding source requirements. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Finding 2025 – 003: (continued) Cause: In response to the lack of monitoring procedures conducted in the prior year, PDOA has started monitoring subrecipients but continues to have a backlog. PDOA accelerated the monitoring schedule to include prior year review periods to bring the monitoring process current but did not monitor the current audit period. PDOA’s policy did not include a defined monitoring cycle of its subrecipients to ensure adequate monitoring was performed on a timely basis. We acknowledge that PDOA has implemented a new phase of their monitoring process. They enhanced the monitoring instrument used to monitor subrecipients and are working to eliminate the monitoring backlog. Effect: Without proper subrecipient monitoring, PDOA cannot ensure compliance with grant requirements and federal regulations, including allowable costs and other requirements. Recommendation: PDOA should perform adequate during-the-award monitoring procedures for all Aging Cluster subrecipients to ensure timely compliance with all applicable federal regulations. PDOA policy should include a defined monitoring cycle to ensure timely monitoring visits in addition to the compliance procedures. Monitoring by state officials should be supported by documentation to show the monitoring performed, areas examined, conclusions reached, and that the monitoring was performed in compliance with applicable regulations. Agency Response: PDOA agrees with the finding. Questioned Costs: The amount of questioned costs cannot be determined.