Findings Citing § 200.332

Finding Number: 2025-003 Federal Program: Coronavirus State and Local Fiscal Recovery Funds Federal Award Identification Number: 31-6400223 Assistance Listing Number (ALN): 21.027 Federal Awarding Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Pass-through Entity: Direct Award Repeat Finding: No Prior Audit Finding Number: N/A Significant Deficiency and Noncompliance – Subrecipient Monitoring Criteria Under 2 CFR § 200.332, pass-through entities are required to monitor the activities of subrecipients to ensure compliance with applicable federal statutes, regulations, and the terms and conditions of the subaward. This includes reviewing financial and performance reports, following up on deficiencies, and ensuring corrective action is taken. Condition During our testing of three subrecipient agreements, we noted that the City did not perform or document monitoring procedures for one subrecipient. Specifically, there was no evidence of review of financial reports, site visits, or other oversight activities for this subrecipient during the audit period. This condition only applies to subawards below a certain threshold, of which, the subrecipient activity is immaterial. For subawards above that threshold, the City utilizes a third-party consulting firm to perform subrecipient monitoring. The subawards tested that were monitored by the consulting firm did not indicate noncompliance. Cause The City does not have a consistent process in place to ensure all subrecipients are monitored in accordance with federal requirements. In this instance, monitoring procedures were either not performed or not documented. Effect Without proper monitoring, the City cannot ensure that subrecipients are using funds in compliance with program requirements. This increases the risk of noncompliance, improper use of funds, and undetected errors or irregularities. Recommendation We recommend the City implement and consistently follow formal subrecipient monitoring procedures. These should include documenting reviews of financial and performance reports, performing risk-based monitoring activities, and maintaining evidence of oversight for each subrecipient. Officials’ Response: See Corrective Action Plan.

Finding Number: 2025-004 Finding Type: Federal award finding Federal Assistance Listing No.: 15.685 Program Name: National Fish Passage Federal Agency: U.S. Department of the Interior Pass-Through Entity: n/a Grant Number: F24AC01768-00 Award Project Period: July 1, 2024 through July 1, 2029 Control Deficiency Type: Significant deficiency Instance of Noncompliance: Yes Compliance Requirement: Subrecipient monitoring Repeat Finding: No Criteria: Under 2 CFR 200.332 a pass-through entity must: • Evaluate each subrecipient’s risk of compliance to determine appropriate monitoring • Conduct monitoring activities based on risk, which may include reviewing financial and programmatic reports, following up on deficiencies, and verifying that subrecipients have required audits • Verify that subrecipients are not suspended or debarred prior to issuing a subaward • Ensure subrecipients submit required reports timely and comply with federal requirements • Include all applicable requirements imposed, including audit requirements under 2 CFR 200 Subpart F, the subaward • Issue management decisions for audit findings within 6 months of receiving the audit report Condition: The Council did not fully implement the required subrecipient monitoring procedures for its federal subaward. Specifically: • A formal written risk assessment was not performed prior to issuing the subaward. The Council relied on its prior working relationship with and knowledge of the subrecipient on non-federally funded projects rather than evaluating federal compliance risk. • Procurement and suspension/debarment verification were performed after the start of the subaward date. • Monitoring procedures performed were not thoroughly documented • The subaward did not include certain necessary language related the audit requirements under 2 CFR 200, Subpart F Cause: This is the Council’s first experience with awarding federal funds to a subrecipient. Staff relied on familiarity with the subrecipient rather than formalizing and documenting the required federal oversight steps. Effect: Without a documented risk assessment, timely debarment verification, documented monitoring activities, and required subaward language, the Council cannot fully demonstrate that it mitigated the risk of subrecipient noncompliance. This increases the likelihood that federal requirements may not be met or that noncompliance may go undetected. Questioned Costs: None. Audit Recommendation: The Council should strengthen its subrecipient monitoring processes by: • Developing and implementing a formal risk assessment process for all subrecipients of federal funds. • Performing and documenting suspension/debarment checks prior to issuing any subaward. • Reviewing its subaward requirements to ascertain that they include all the applicable requirements • Establishing monitoring procedures that include: • Tracking and reviewing required financial and programmatic reports for timeliness and completeness. • Obtaining and reviewing the subrecipient’s Single Audit or alternative audit documentation. • Issuing management decisions on findings within 6 months • Documenting follow up on any identified issue Management’s Response: Rogue River Watershed Council’s sub-recipient award in 2025 represents our first (and only) such award to date. While we don’t expect any sub-recipient awards in the near future, we will develop a set of procedures guiding such awards including the steps and the required timing for conducting a risk assessment, suspension/ debarment verification, required monitoring procedures, and the required language under 2 CFR 200, Subpart F. These procedures will be contained within a stand-alone policy for sub-recipient awards.

Federal Program Name: Research and Development Cluster: Uniformed Services University Medical Research Projects Federal Agency: U.S. Department of Defense Federal Assistance Listing Number: 12.750 Criteria or Specific Requirement: Subrecipient Monitoring Condition: During testing of subrecipient monitoring, it was noted that the Organization awarded three awards to subrecipients during the year and did not inform these subrecipients of the federal nature of the award at the time of the subaward. Specifically, the required federal award information was not included in the subaward documentation. Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance with federal requirements. Questioned Costs: None Context: In accordance with 2 CFR section 200.332(a), pass-through entities are required to clearly identify to the subrecipient the federal award information at the time of the subaward. This includes the federal award identification number, the federal awarding agency, the assistance listing number (ALN), and the amount of federal funds obligated. This information was not communicated to the subrecipients Cause: The Organization did not have adequate procedures in place to ensure that all required federal award information was communicated to subrecipients. Repeat Finding: Yes Recommendation: We recommend that the Organization implement procedures to ensure that all required federal award information is included in subaward agreements and communicated to subrecipients at the time of the award. Views of Responsible Officials and Planned Corrective Action: The Organization agrees with the comment and has revised policies to communicate all required federal award information to subrecipients.

Subrecipient Monitoring ALN 10:854: Rural Economic Development Loan and Grant Criteria: if the Cooperative serves as a passthrough entity, in accordance with 2 CFR 200.332 they must: • Clearly identify the award and applicable requirements to the subrecipient; • Monitor the activities of the subrecipient as necessary to ensure the subrecipient complies with federal requirements; • Verify that a subrecipient is audited. Condition: The Cooperative does not have written procedures that discuss subrecipients and how they will comply with the federal requirements as a passthrough entity, did not verify that the subrecipient was audited, and did not clearly identify to the subrecipient all the information required in the regulations. Context: There was a promissory note and loan agreement signed between the Cooperative and the subrecipient, and the agreement references to 2 CFR 200 via the incorporated Rural Economic Loan Agreement. Effect: The Cooperative is not fully following federal regulations regarding subrecipient monitoring. Questioned Costs: None. Cause: This is the first year the Cooperative received these loan funds, and written procedures were not in place prior to receiving the funds and not all of the requirements for pass through entities were followed. Auditor Recommendation: We recommend the Cooperative create procedures addressing the requirements in 2 CFR 200.332 and retain documentation showing that all required steps for passthrough entities were followed. Fergus Electric Cooperative Response: Fergus worked in conjunction and regularly communicated with the local Montana USDA REDL/G office to understand program requirements, provide requested information, and meet federal guidelines. Loan agreement RD 4280-5, (Dated 10/31/2024) refers to 7 CFR part 4280, Subpart A, as (“Regulations”). Fergus was unaware that 2 CFR 200 regulations are associated with 7 CFR part 4280, Subpart A. Fergus regretfully acknowledges that we were not informed or aware of obligations to meet the regulatory requirements within 2 CFR 200. Fergus has adopted and implemented a policy, Federal Funding Compliance, to establish formal procedures and ensure ongoing compliance with applicable federal regulations, including 7 CFR 4280, Subpart A and 2 CFR 200.

Federal Program Name: HOME Investment Partnerships Program Federal Agency: U.S. Department of Housing and Urban Development Assistance Listing Number: 14.239 Criteria Per 2 CFR 200.332, pass-through entities are required to evaluate each subrecipient’s risk of noncompliance to determine the appropriate level and type of monitoring, monitor the activities of the subrecipient to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and ensure subrecipients meet applicable program requirements, including financial and performance reporting and taking corrective action when issues are identified. Condition The City of Lafayette did not have formal, documented subrecipient monitoring policies in place during 2025, resulting in a lack of a consistent and structured monitoring framework. While the City performed several compensating controls (e.g., desk reviews, pre-disbursement reviews, and training), these activities were not formally defined or applied uniformly to ensure full compliance with Uniform Guidance. Cause The City has an agreement with Lafayette Housing Authority to administer and monitor the HOME program. Due to staff transitions during the year, the Authority relied on informal oversight procedures rather than implementing a structured monitoring plan, including risk-based assessments and documented monitoring activities. Effect The lack of formal subrecipient monitoring increases the risk that noncompliance with HOME program requirements may not be identified or corrected in a timely manner. Recommendation We recommend the Authority implement formal subrecipient monitoring procedures for the HOME program, including: • Performing and documenting annual risk assessments to determine the appropriate level of monitoring; • Conducting and documenting monitoring procedures (e.g., desk reviews and/or on-site reviews); and • Maintaining evidence of supervisory review and follow-up on any identified issues. Views of Responsible Officials and Planned Corrective Actions: For the views of responsible officials, refer to the Corrective Action Plan

Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Assistance Listing Number: 21.027 Compliance Requirement: Subrecipient Monitoring Criteria: 2 CFR 200.332 establishes standards to evaluate subrecipient risk, monitor subrecipient activities, follow up on identified deficiencies, and maintain documentation of monitoring to ensure compliance with federal requirements Condition: The City of Noblesville does not have a formal policy or standardized process in place to track and perform consistent subrecipient monitoring procedures for all subrecipients receiving Coronavirus State and Local Fiscal Recovery Funds. Cause: The City has not established formal written procedures or implemented a centralized tracking mechanism to ensure all required subrecipient monitoring activities are performed and documented in accordance with federal requirements. Effect: Without a formal policy and tracking process, there is an increased risk that subrecipient monitoring procedures may not be performed consistently or timely, which could result in noncompliance with Uniform Guidance requirements and improper use of federal funds by subrecipients going undetected. Questioned costs: There were no identified questioned costs Context: We tested a sample of one subrecipient that received payments under the program totaling $249,857 of disbursements out of 4 total recipients, with total payments of $475,638 during 2025. Based on our procedures, we noted that the City has not established formal subrecipient monitoring procedures and that monitoring activities were not performed consistently across subrecipients. Our sampling methodology is not considered statistically valid. Recommendation: We recommend the City develop and implement a formal subrecipient monitoring policy and establish a centralized tracking system to ensure all required monitoring activities are performed consistently and documented for all subrecipients. The policy should align with 2 CFR 200.332 and include procedures for risk assessment, monitoring activities, and follow-up on identified issues. Views of Responsible Officials and Planned Corrective Actions: For the views of responsible officials, refer to the Corrective Action Plan

Federal Programs – AL 93.568 – Low Income Home Energy Assistance Program Criteria – Uniform Guidance requires, for any funds passed through to a subrecipient, that the pass-through entity (CAPND) must perform certain activities to ensure that the subrecipient uses the funds within provisions of the grant award and Uniform Guidance, 2 CFR sections 200.332 (b). This includes issuing subawards granted to subrecipients. Condition – For the year ended December 31, 2025, we reviewed any subawards between CAPND and subrecipients under the Low Income Home Energy Assistance Program (LIHEAP). We noted one subrecipient was missing a subaward during the year. Cause – There was one missing subaward between CAPND and the subgrantee. Effect – Increased risk of potential noncompliance with subrecipient monitoring requirements under Uniform Guidance. Questioned costs – None. Repeat Finding – This is not a repeat finding. Recommendation – The entity should include all required information as determined in CFR Section 200.332(b) in all subawards. Views of Responsible Officials - Management recognizes the deficiency and plans to implement the auditor’s recommendation.

Federal Award Identification: 2023-70417-39322 Federal Program: American Rescue Plan Technical Assistance Investment Program Assistance Listing: 10.234 Federal Agency: U.S. Department of Agriculture Pass-through Entity: Not applicable - direct award Award Period Audited: Fiscal year ended December 31, 2025 Criteria: 2 CFR 200.332(c) requires pass through entities to evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring. In addition, 2 CFR 200.332(e) requires pass through entities to monitor subrecipients to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward, including review of financial and performance information and follow up on identified issues. Condition: During the audit, it was determined that for all (2) subrecipients tested, the Organization did not document subrecipient risk assessments and, for one subrecipient tested, did not demonstrate that elevated risks were used to determine or adjust the nature, timing, or extent of subrecipient monitoring. Management identified one subrecipient as having recurring federal award findings, including material weaknesses reported in prior Single Audits. Despite this known elevated risk, the Organization applied the same baseline subrecipient monitoring procedures to all (2) subrecipients under the major program. Context: The deficiency was identified during audit testing of subrecipient monitoring controls and inquiry of management. Cause: The deficiency resulted from the absence of formal policies and procedures requiring documentation of subrecipient risk assessments and requiring that identified risks be used to determine and document the appropriate level of subrecipient monitoring. Effect: This significant deficiency in internal control over compliance created a reasonable possibility that material noncompliance with subrecipient monitoring requirements would not be prevented or detected on a timely basis. However, no instances of noncompliance were identified. Although no questioned costs were identified, the deficiency increased the risk that noncompliance could occur and remain undetected. Known Questioned Costs: None. Repeat Finding Status: This is a new finding for the year ended December 31, 2025. Recommendation: The Organization should implement formal, documented policies and procedures for risk-based subrecipient monitoring to ensure that monitoring activities are tailored based on subrecipient risk levels. This should include documented consideration of subrecipient audit results and retention of documentation supporting the performance and results of enhanced monitoring procedures for higher risk subrecipients. Views of Responsible Officials: Management agrees with the finding. Management acknowledges that subrecipient risk assessments were not formally documented and that monitoring activities were not adjusted based on identified risk levels. Management has indicated that corrective actions will be taken to implement a documented, risk based approach to subrecipient monitoring.

Subrecipient Monitoring and Special Tests: Housing Quality Standards Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: M17-DC170213 and 2017 M18-DC170213 and 2018 M21-DC170213 and 2021 M22-DC170213 and 2022 Home Investment Partnerships Program (HOME), Federal Assistance Listing #14.239 County Department – Department of Planning and Development (DPD) Finding 2025 – 001 CRITERIA Subrecipient Monitoring 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4) Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. DPD’s HOME Program Policies and Procedures Manual (updated January 2025), Monitoring Section (pages 114 to 129), under the Annual Monitoring Plan/Schedule Update, states the plan should identify the participating jurisdiction (PJ) monitoring goals and strategies, highlighting areas to which staff should pay special attention during the monitoring year. A specific schedule detailing annual, bi-annual, and tri-annual monitoring visits as required by HUD must be developed and maintained. To assure that adequate records are kept regarding each property and its compliance status, the monitor should establish a monitoring file for each property. The basic items in the file should include written agreement, written tenant selection criteria, property and unit inspections and results, etc. Also, HOME Program Compliance should conduct a risk assessment of its portfolio of the PJ’s HOME projects so that the highest risk projects can be identified and monitored first. In addition, HOME Program Compliance must conduct a desk review of all properties in the monitoring workload each year, as well as on-site reviews periodically, ranging from annually to every 3 years based on the number of units in property (i.e. 26 or more units require an annual review). Special Tests: Housing Quality Standards Per 24 CFR Section 92.209(i), Tenant-based rental assistance: Eligible costs and requirements, Housing Standards, states “The participating jurisdiction must require the housing occupied by a family receiving tenant-based rental assistance under this section to meet the participating jurisdiction's property standards under § 92.251. Initially and annually thereafter, the participating jurisdiction must determine the housing complies with its property standards and is decent, safe, sanitary, and in good repair in accordance with § 92.251(f). During the period of affordability (i.e., the period for which the nonfederal entity must maintain subsidized housing) for HOME assisted rental housing, the PJ must perform on-site inspections to determine compliance with property standards and verify the information submitted by the owners no less than (a) every three years for projects containing one to four units, (b) every two years for projects containing five to 25 units, and (c) every year for projects containing 26 or more units. CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not provide sufficient evidence to document annual monitoring performed, as well as performed the required inspections to ensure property standards were met, as required by Federal regulations and its internal policies. CAUSE Based on discussions with management, the cause of the findings occurred as a result of post pandemic allocations to the County which included several housing related fundings and initiatives, including Emergency Rental Assistance I & II (ERA I& II), Homeless Sheltering, Homeless and Transitional Sheltering Physical Site Acquisition and Development, HOME ARPA (HUD Allocation), and HOME, CDBG CV development delays that challenged the Housing teams provision of services and compliance requirement. While HUD had extended post pandemic compliance moratoriums into fiscal year 2024, Housing team hiring, training and implementation of compliance activities were unable to activate fully in the subject fiscal year to meet compliance. Additionally, for subrecipient monitoring of the HOME program, costs paid to developers were misclassified as subrecipient expenditures. The HOME program does not have contracts with subrecipients. EFFECT Failure to adequately monitor the activities and performance of subrecipients (and developers) could result in Federal awards being used for unauthorized purposes and DPD’s inability to adequately perform required risk assessments. Failure to perform the required inspections to ensure property standards were met is a violation of Federal regulations. QUESTIONED COSTS None. CONTEXT Subrecipient Monitoring During the current audit period, we noted a total of thirty-seven (37) projects were included on the Program Year 2024 (Fiscal Year 2025) HOME monitoring rental portfolio schedule provided, which required annual monitoring per DPD’s internal policies. Of the 37 projects, we noted three projects had some monitoring conducted during the period, which included some review of tenant files (for income verification/eligibility) and limited physical inspections of HOME units. No additional documentation was provided to verify compliance with federal regulations and the HOME Program Policies and Procedures Manual which required annual monitoring of each project (property). In addition, we noted approximately $7.3 million was reported on the SEFA as pass-through to two subrecipients under the program for the fiscal year ended November 30, 2025. Based on further discussions, DPD noted that these subrecipients are the two title companies used to pay the developers under the HOME program in accordance with its escrow agreement(s). We also reviewed a sample of these payments noting the supporting documentation referenced the developers as subrecipients. No documentation was provided to support compliance with subrecipient monitoring as required by 2 CFR Part 200.332. Special Tests: Housing Quality Standards We were provided with the same 37 projects reviewed under subrecipient monitoring to verify that DPD performed the required inspections to ensure that property standards were met. Based on our review, we noted the list included projects with HOME assisted units ranging from one (1) to 99 units, which would have required inspections every one to three years. However, the listing provided did not identify those units on which housing quality inspections were due. In addition, of the 37 projects, we were provided with documentary evidence to support only one (1) project whereby the required unit inspection reports were completed. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPD ensure procedures should be in place to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance, as required by Federal regulations and internal policies. Also, documentation should be maintained to support that required inspections are performed to ensure that property standards are met, including identification of those units on which housing quality inspections are due, in accordance with 24 CFR 92.251(f). VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 42-43.

Subrecipient Monitoring Federal Department – U.S. Department of Treasury Federal Award Identification Number and Year: SLFRP0143 and 2021 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds, Federal Assistance Listing #21.027 County Department(s) – Various Finding 2025 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (b) ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: (1) Federal award identification. (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN)…(c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. The Cook County, Illinois ARPA: Subrecipient Risk Assessment and Risk Reassessment Process Manual (dated May 16, 2024), states "If a subrecipient does not complete the risk reassessment by the assigned due date, their risk level will remain the same and they will be eligible for reimbursements only. Advancement requests will not be considered until the subrecipient completes the risk reassessment." Also, the level of monitoring to which the subrecipient must adhere to will vary by risk level assigned. The monitoring expectations associated with each risk level will be communicated to the subrecipient in the form of the risk reassessment and financial monitoring letter”. The monitoring parameters associated with each risk level are outlined below: • High Risk – minimum of monthly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Medium Risk – minimum of monthly to quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Low Risk - minimum of quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns The Cook County ARPA Grants Compliance Guide, under External Risk Management, states "Federal grant regulations in Uniform Guidance require that all SLFRF-funded programs be conducted in a risk-informed manner, particularly the selection and monitoring of subrecipients that implement programming on behalf of Cook County. In order to assess the risk potential of external subrecipient partners, each subrecipient organization is assessed for risk as the beginning of their partnership with the County and assigned a risk rating of High, Medium, or Low. This rating informs the monitoring and documentation requirements for that subrecipient. Subrecipients are reassessed for risk annually to reflect any changes or improvements in their risk potential”. The Cook County ARPA SLFRG Grant Subaward Financial Management Manual (revised March 3, 2025), under Subaward Financial Management Roles and Responsibilities states that “as outlined in the risk assessment form, the level of monitoring will be based on subrecipient’s risk designation. The subrecipient will receive a risk assessment and financial management letter apprising it of the expectations associated with its assigned risk level”. In addition, under Section A. Advancement of Funds Process, Item VI. Shifting to Reimbursement Model, states “nine months prior to the program’s conclusion, no further advancements can be provided to a subrecipient. Unspent advance balances will be applied against subsequent expenses incurred and reported to the County. Some subrecipients may need working capital to maintain operations, and it will be the responsibility of the Department to create a drawdown schedule to ensure to the best of its ability that all advanced funds are expended and/or recouped by program-end”. CONDITION During the current audit period, the County performed inadequate monitoring of its subrecipients as required by its internal policies. CAUSE Based on discussions with management, the County instituted new internal guidelines for program and financial management of its State and Local Fiscal Recovery Funds (SLFRF) award. These guidelines included more strict monitoring controls than federal regulations require. Additionally, the County deployed a new grants management system specifically to assist in collection and reporting on program metrics and subrecipient financials. The grants management system went live in spring of 2024. The County continues to invest in compliance oversight and technical assistance to ensure its new guidelines are effectively implemented, particularly in relation to utilization of its grants management system. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of 40 subrecipients (of a population of 250 subrecipients), we noted the following:  For 1 subrecipient file, we noted one (1) monitoring log was completed. However, based on risk rating(s) assigned, a total of four (4) monitoring logs were required.  For 11 subrecipients, we noted the risk reassessments were expired, ranging from 167 to 920 days over the assigned due date. Of the 11 subrecipients, 6 had risk reassessments currently outstanding and 3 had advancement requests approved without a risk reassessment, both of which were contrary to County’s internal policies. The total amount advanced to the 3 subrecipients was $772,214.  We noted one subrecipient submitted advancement requests totaling $852,757 during the County’s fiscal year. Based on review of the supporting documentation, it appears these funds are actual reimbursement of costs previously incurred by the subrecipient and should have been submitted via a payment request(s) as opposed to an advancement request(s). Consequently, the SEFA reported total expenditures incurred of $594,815, instead of the total $852,757, resulting in a net understatement of $257,942. However, the subrecipient was compensated for all work that was performed.  We noted the County executed a subrecipient agreement (signed December 20, 2024) prior to verifying the subrecipient had an active Unique Entity Identifier (UEI) number (active date January 20, 2025) which is required by Federal regulation. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend County implement procedures to ensure adequate documentation (monitoring log) is maintained and timely completion of risk reassessment is conducted to support the evaluation of each subrecipient’s risk of noncompliance as required by Federal regulations and its internal policies. Also, the County should adhere to its written internal policies which require that advancement requests not be considered until the subrecipient completes the risk reassessment. In addition, the agreement with a subrecipient should not be executed without an active UEI, unless exceptions to these policies are clearly documented. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 44-45.

Finding 2025-001 Subrecipient Monitoring (Significant Deficiency) Information on the Federal Programs: Fish and Wildlife Cluster Criteria or Specific Requirement: Under 2 CFR 200.332, pass-through entities are required to evaluate each subrecipient’s risk of noncompliance to determine the appropriate monitoring, monitor subrecipient activities as necessary to ensure compliance with Federal requirements, and verify whether subrecipients that meet the Federal expenditure threshold have obtained a Single Audit. These responsibilities include performing and documenting a subrecipient risk assessment, conducting monitoring activities based on the assessed risk, and obtaining, reviewing, and following up on subrecipient Single Audit reports when applicable. Condition: The Organization does not maintain written policies or procedures that address required subrecipient monitoring activities. The Organization does not perform or document a risk assessment of subrecipients to evaluate their risk of material noncompliance and does not have monitoring procedures that correspond to an assessed level of risk. Additionally, the Organization does not have a policy or consistent practice for determining whether subrecipients are subject to Uniform Guidance Subpart F Single Audit requirements, nor does it obtain or review Single Audit reports from subrecipients that meet the required threshold. Cause: This condition exists because the Organization has not established formal internal controls or written procedures to ensure compliance with all Federal requirements related to subrecipient monitoring. Effect or Potential Effect: As a result, the Organization is not fully compliant with the requirements of 2 CFR 200.332, and there is an increased risk that subrecipient noncompliance may occur and remain undetected. The absence of appropriate risk assessment and monitoring procedures increases the likelihood that programmatic or financial issues at the subrecipient level could go unidentified. Failure to obtain and review required Single Audit reports also increases the risk that audit findings, questioned costs, or other compliance concerns may not be addressed by the Organization in a timely manner. Although no questioned costs were identified during our audit, the control deficiencies described above increase the risk of future questioned costs. Questioned Costs: N/A. Context: This finding was noted during our review of the Organization’s subrecipient monitoring practices and reflects a systemic lack of documented policies and procedures governing the required elements of risk assessment, monitoring, and Single Audit verification. Identification as a Repeat Finding, if Applicable: No. Recommendation: We recommend that the Organization develop and implement comprehensive written subrecipient monitoring policies and procedures that align with 2 CFR 200.332. These procedures should include conducting and documenting a risk assessment for each subrecipient, establishing monitoring activities that are responsive to the level of assessed risk, and implementing a process to determine whether subrecipients are required to obtain a Single Audit and to obtain, review, and follow up on those audit reports as necessary. Establishing these controls will help ensure compliance with Federal requirements and reduce the risk of undetected noncompliance at the subrecipient level.

Finding number: 2025-003 Significant Deficiency – Lack of Internal Control Over Compliance with Subrecipient Monitoring Policy Assistance Listing Number 21.027 (Contract # 902060-23133) Criteria: Pursuant to CFR section 200.332(b), pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: The Unity Council did not perform a risk assessment of subrecipients. This is a repeat finding. Cause: The Organization does not have a formally documented policy for performing a risk assessment over subrecipients. Effect or potential effect: A risk assessment for purposes of determining the appropriate subrecipient monitoring was not performed. Recommendation: Management should develop a risk assessment policy to evaluate the risk profile of each subrecipient. Factors included during the evaluation can include the subrecipient's prior experience with the same or similar subawards, results of previous audits, whether the subrecipient has new personnel or new or substantially changed systems, and the extent and results of federal awarding agency monitoring. View of responsible officials: Management is in agreement with the finding, however the contract ended during 2025 and was not renewed. The Organization has no other subrecipients.

Subrecipient Monitoring – Risk Assessment (Noncompliance) and significant deficiency in Internal Control Finding 2025-002 Identification of the Federal Program: 93.600 – Head Start Cluster, 93.387 – National and State Tobacco Control Program, and 93.872 – Tribal Maternal, Infant, and Early Childhood Home Visit Criteria: According to 2 CFR § 200.332, a pass-through entity must evaluate each subrecipient's fraud risk and risk of noncompliance as a form of subrecipient monitoring. In doing so, a pass-through entity must review financial reports, including their financial audits, ensure that the subrecipient takes corrective action on all significant developments affecting the subaward, issue a management decision on any audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through and resolve audit findings specifically related to the subaward. If a finding rises to a certain level, the pass-through should consider taking action against noncompliant subrecipients. Condition: The organization does not have a formal risk assessment process in place. As of the date of fieldwork, audit reports of member tribes receiving subrecipient payments were not all received and therefore, were not reviewed to perform a proper risk assessment. We additionally noted that a quarterly report was not submitted as required per the agreement and funds were still distributed. Cause: Management's unfamiliarity with 2 CFR § 200.332 requirements and overall relationship with the Tribes. Effect: Risk assessment is significant to performing sufficient subrecipient monitoring. The structure of the organization being governed by the chairs of each Tribe and created to obtain grants to further support the Tribes creates a level of trust amongst the Tribes and the Organization; however, this does not eliminate the need to perform a risk assessment and ensure that the individual Tribes are in compliance at a Federal level. Questioned Costs: $0 Repeat Finding: No Recommendation: We recommend that management and program managers familiarize themselves with the requirements of 2 CFR § 200.332 and create a formal risk assessment process. We also recommend that Tribes are held accountable for not submitting a timely audit (i.e. withholding funds until provided). Management Response: Management agrees with the finding. The Council will work on implementing an efficient, yet effective risk assessment process for all subrecipients.

Finding 2025-002 – Incomplete Subrecipient Agreements and Inaccurate Subrecipient SEFA Reporting Federal Program: Violence Against Women Formula Grants Assistance Listing Number: 16.588 Compliance Requirement: Subrecipient Monitoring Internal Control Deficiency: Material Weakness - Insufficient controls over subaward agreement content and subrecipient reporting oversight Compliance Finding: Subaward agreements missing required elements; subrecipient failed to report pass-through funds on its SEFA Questioned Costs: None Criteria: Under 2 CFR § 200.332, pass-through entities must ensure that all subaward agreements contain specific federal award information, monitoring expectations, and required terms and conditions. Subrecipients must report federal expenditures on their SEFA in accordance with 2 CFR § 200.510(b). Condition: During our testing of subrecipient monitoring and federal reporting, we noted that subrecipient agreements did not include several elements required under 2 CFR § 200.332(b), (c), and (e)–(i). Specifically, the agreements reviewed were missing one or more of the following required components: • Federal award identification information, including unique entity identifier (UEI), Federal Award Identification Number (FAIN), ALN, award date, and other required identifiers. • Required access-to-records language granting the pass-through entity, auditors, and federal agencies the right to access pertinent records. • Subaward-level closeout requirements, including timelines and documentation expectations. In addition, during compliance testing we noted that the subrecipient did not include the pass-through funds received in its own SEFA, resulting in incomplete federal expenditure reporting. Cause: The deficiencies appear to result from the absence of a standardized subaward agreement template and insufficient review procedures to ensure all Uniform Guidance elements are included. The subrecipient’s SEFA omission appears to stem from a lack of communication and monitoring regarding reporting requirements. Effect: Incomplete subaward agreements increase the risk that subrecipients may not understand federal requirements, may apply incorrect cost principles, or may fail to comply with federal terms. Missing SEFA reporting by the subrecipient results in inaccurate federal expenditure reporting and may affect federal oversight, risk assessments, and audit coverage.Recommendation: Management should implement a standardized subaward agreement template that incorporates all elements required under 2 CFR § 200.332. If any of the required elements are missing, adding a short federal award information/Uniform Guidance appendix and an explicit records-access and closeout article would bring the contracts into compliance. Management should also strengthen monitoring procedures to ensure subrecipients understand and comply with SEFA reporting requirements, including verifying that pass-through funds are properly reported. Management’s Response and Corrective Action Plan is found on page 28-29.

FINDING 2025-030 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Subrecipient Monitoring - Subaward Information See Schedule of Findings and Questioned Costs for chart/table. Condition MSF did not report to its subrecipients all subaward information as required by the Uniform Guidance. We noted MSF did not report one or more of the following for 3 of 4 sampled CSLFRF subrecipients: identification of whether the award is for research and development (R&D), indirect cost rate for the federal award, and an approved federally recognized indirect cost rate for the subrecipient. Criteria Federal regulation 2 CFR 200.332(b) requires all pass-through entities ensure every subaward includes certain information. Cause MSF incorrectly interpreted federal regulation notification requirements for two subrecipients. For the remaining subrecipient, MSF informed us staff turnover and limitations contributed to a delay in complete communication of required subaward information to current subrecipients. Effect Subrecipients and their auditors may not be aware of the federal award information needed to ensure compliance with the federal requirements. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MSF report to its subrecipients all subaward information as required by the Uniform Guidance. Management Views MSF agrees with the finding.

FINDING 2025-031 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Subrecipient Monitoring - Subrecipient Audits See Schedule of Findings and Questioned Costs for chart/table. Condition The Department of Environment, Great Lakes, and Energy (EGLE) and DNR did not properly monitor their subrecipients to ensure they complied with the Uniform Guidance. We noted: a. EGLE did not appropriately identify or document if its subrecipients required a single audit for 7 (27%) of 26 sampled subrecipients. We reviewed the federal audit clearinghouse (FAC) and noted 5 of the 7 subrecipients had single audit reports submitted to the FAC in fiscal year 2025 and one required a management decision letter on its findings. b. DNR did not appropriately identify or document if the subrecipients required a single audit for 5 of 8 sampled subrecipients. Therefore, DNR did not monitor these subrecipients to ensure the status or submission of their single audit reports, if applicable. For these five subrecipients, we reviewed the FAC and noted the subrecipients did not submit a single audit report to the FAC during fiscal year 2025. Criteria Federal regulation 2 CFR 200.501 requires nonfederal entities who expend $750,000 or more in federal awards during their fiscal year to obtain a single audit for that fiscal year. Also, federal regulation 2 CFR 200.332(f) requires the pass-through entity to verify these subrecipients are audited as required by Subpart F of the Uniform Guidance, Audit Requirements, when it is expected the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the $750,000 threshold. In addition, federal regulation 2 CFR 200.521(d) requires the pass-through entity to issue a management decision letter on the appropriateness of all audit findings related to its federal awards and the subrecipient's corrective action plan within six months of acceptance by the FAC. Cause For part a., EGLE informed us its subrecipient expenditure query was limited to only EGLE expenditure data because of an oversight, which prevented the identification of all subrecipients exceeding the single audit threshold. For part b., DNR informed us its subrecipient expenditure query did not include sufficient CSLFRF coding because of an oversight, which prevented the identification of all CSLFRF subrecipients. Effect EGLE and DNR limited the State's assurance their subrecipients complied with grant requirements and implemented corrective actions for audit findings to prevent future sanctions or disallowed costs, which could necessitate adjustments to their records. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend EGLE and DNR properly monitor their subrecipients to ensure they comply with the Uniform Guidance. Management Views EGLE and DNR agree with the finding.

FINDING 2025-052 Low-Income Home Energy Assistance, ALN 93.568, Subrecipient Monitoring - Subrecipient Audits See Schedule of Findings and Questioned Costs for chart/table. Condition The Department of Licensing and Regulatory Affairs (LARA) did not properly monitor its Michigan Energy Assistance Program (MEAP) subrecipients to ensure they complied with the Uniform Guidance. LARA did not have an adequate process to identify or document if the subrecipient required a single audit and steps taken to determine whether a management decision letter was needed. We reviewed the FAC and noted 6 of 8 MEAP subrecipients submitted single audit reports to the FAC in fiscal year 2024 and/or fiscal year 2023. We verified there were no findings related to the subrecipients' LIHEAP federal awards. Criteria Federal regulation 2 CFR 200.501 requires nonfederal entities who expend $750,000 or more in federal awards during their fiscal year to obtain a single audit for that fiscal year. Also, federal regulation 2 CFR 200.332(f) requires the pass-through entity to verify these subrecipients are audited as required by Subpart F of the Uniform Guidance, Audit Requirements, when it is expected the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the $750,000 threshold. In addition, federal regulation 2 CFR 200.521(d) requires the pass-through entity to issue a management decision letter on the appropriateness of all audit findings related to its federal awards and the subrecipient's corrective action plan within six months of acceptance by the FAC. Cause LARA informed us it did not have a process in place to document its review of MEAP subrecipient single audits. Effect LARA limited the State's assurance its subrecipients complied with grant requirements and implemented corrective actions for audit findings to prevent future sanctions or disallowed costs, which could necessitate adjustments to their records. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend LARA monitor its MEAP subrecipients to ensure they comply with the Uniform Guidance. Management Views LARA agrees with the finding.

2025-002 – Subrecipient Monitoring - Lack of evidence of subrecipient Uniform Guidance report reviews Cluster: Research and Development Sponsoring Agency: Various agencies Award Names: Southeast Region Cybersecurity Collaboration Center (SERC3), Establish, manage, and maintain a public-private partnership (PPP) additive manufacturing (AM) consortium for the Rapid Manufacturing Propulsion Technology (RAMPT), Developing effective adaptation strategies to enhance the resilience of farmers under changing climate, Towards a sustainable bioeconomy: Biotransformation of paper mill sludge for value-added chirally pure (R)-1,3-butanediol production, A systems approach to perennial forage management using plant growth-promoting rhizobacteria Award Numbers: 212514, 208409, 200987, 205258, and 205264 Assistance Listing Title: Cybersecurity, Energy Security & Emergency Response (CESER), Science, Integrative Activities, and Agriculture and Food Research Initiative (AFRI) Assistance Listing Number: 81.008, 43.RD, 47.083, and 10.310 Award Year: 2024 - 2025 Pass-through entity: UT-Batelle LLC, RPM Innovations, Inc., New Mexico State University, Regents of the University of California, and University of Tennessee Criteria 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Condition Through our testing of 24 subrecipients, we noted the following: • For the Research and Development Cluster, 5 out of 24 samples tested did not have supporting documentation to verify Auburn’s review of subrecipient’s financial statements and/or Uniform Guidance report available. Cause The University indicated subrecipient reviews were not consistently performed in accordance with 2 CFR 200.501. Additionally, due to a lack of clearly defined roles, responsibilities, and documentation practices among the existing team members within the Office of Sponsored Programs, the Uniform Guidance requirements (and related University procedures) around subrecipient reviews were not consistently performed and/or documented. Effect The inconsistency of reviews performed over subrecipient financial statements and Uniform Guidance reports may result in ineligible subrecipients receiving federal awards, subrecipient findings not being fully remediated, and other applicable procedures not being performed timely and appropriately. Questioned Costs None noted. Repeat Finding Yes. Repeat of finding 2024-002. Recommendation We recommend that the University reassess the design of its controls around the review process of subrecipient financial statements and Uniform Guidance reports. The University should ensure its procedures properly address the review process of this information, including timeliness and appropriate personnel. The University should also ensure these annual reviews are being appropriately documented and the documentation is being maintained properly. Management’s Views and Corrective Action Plan Management’s Views and Corrective Action Plan are included at the end of this report after the summary schedule of prior audit findings and status

The Uniform Guidance, 2 CFR 200.332(e), requires non-Federal entities to monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. During our review of subrecipient monitoring, the Alabama Law Enforcement Agency (ALEA) did not provide documentation to support its monitoring activities for the 7 subrecipients reviewed. ALEA did not have adequate procedures in place to ensure subrecipients were monitored in accordance with the Uniform Guidance. As a result, ALEA did not ensure subrecipients were in compliance with federal requirements.

Finding Number 2025-003 Instance of Non-Compliance: Reporting Assistance Listing Numbe: 11.012 Questioned Cost: $ 0 Significant Deficiency Federal Agency: U.S. Department of Commerce Criteria: According to grant terms & conditions and 2 CFR Section 200.332, all awardees of applicable grants and cooperative agreements are required to report to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System on all subawards over $30,000. Required reporting includes timely and accurate information regarding subaward amounts, dates, and other key subaward data. Condition: NERACOOS submitted FFATA reports for the initial subaward agreements; however, the reports were not updated timely for subsequent subaward amendments. Specifically, amended subaward amounts and amendment dates were not reported timely and accurately in SAM.gov. Context: The condition was identified during our review of grant terms and conditions, 2 CFR § 200.332 requirements, and FFATA reporting for selected subawards subject to reporting requirements. Cause: NERACOOS did not have sufficient controls in place to ensure that amendments to subaward agreements were identified, tracked, and reported timely in SAM.gov. In addition, the review process did not ensure that amended subaward amounts and amendment dates were updated accurately after subaward modifications were executed. Effect: NERACOOS was not in compliance with FFATA reporting requirements for fiscal year 2025. Although all initial subawards tested were reported, subsequent amendments were not reported timely and the reported subaward amounts were not updated accurately. Following is a summary of the finding: (See pdf for table) Identification of a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that management strengthen controls over FFATA reporting by implementing procedures to identify and track all subaward amendments subject to FFATA reporting requirements. Management should ensure that amended subaward amounts, amendment dates, and other required information are updated in SAM.gov timely and accurately. We further recommend that management perform a periodic review of FFATA reports on SAM.gov to verify completeness and accuracy of reported subaward information. Views of Responsible Officials and Planned Corrective Action Plan: Management concurs with this finding. NERACOOS acknowledges that while initial subaward reporting was completed as required, the organization did not have adequate controls to ensure that subaward amendments were identified, tracked, and reported timely and accurately in SAM.gov pursuant to 2 CFR § 200.332 and FFATA requirements. NERACOOS will develop and implement written FFATA reporting procedures that specifically address the identification and reporting of subaward amendments, including trigger points for updating SAM.gov following execution of any subaward modification. Responsible Official: Emily Silva, Administrative Director Anticipated Completion Date: August 31, 2026 (retroactive corrections); ongoing quarterly reconciliation beginning July 2026

2025 – 002 Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: HIV Emergency Relief Project Grants HIV Care Formula Grants ALN: 93.914 93.917 Pass-Through Agency: Texas Department of State Health Services Pass-Through Number(s): N/A Award Number and Period: HIV Emergency Relief Project Grants H89HA00014-34, H89HA00014-35 March 1, 2024 – February 28, 2025, March 1, 2025 – February 28, 2026 HIV Care Formula Grants HHS001122200003 April 1, 2022 – March 31, 2026 Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Section III – Findings and Questioned Costs – Major Federal Programs (Continued) 2025 – 002 Subrecipient Monitoring – Missing Contract Elements (Continued) Criteria or specific requirement: Per 2 CFR 200.303(a), Dallas County must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), federal award identification number (FAIN), federal award date of award to the recipient by the granting agency, and the name of federal awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: HIV Emergency Relief Project Grants – The UEI was not included in any of the five subaward agreements selected for testing. The start and end dates for the agreements were March 1, 2024 – February 28, 2025. HIV Care Formula Grants – The UEI, FAIN, federal award date of award to the recipient by the granting agency, and the name of federal awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity were not included in any of the five subaward agreements selected for testing. The start and end dates for the agreements were March 1, 2024 – February 28, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR 200 §200.332 prior to execution is not at the correct precision level. Effect: As required subaward information was left out of contracts, Dallas County increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing contract elements may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) 2025 – 002 Subrecipient Monitoring – Missing Contract Elements (Continued) Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: See corrective action plan.

2025-001 – Communications with Subrecipients Finding Type: Significant Deficiency in internal control over compliance / noncompliance Program: ALN 93.788 – State Opioid Response Criteria: As required by 2 CFR 200.332, the pass-through entity must communicate specific information to subrecipients, as applicable. Condition: Contracts with subrecipients did not include portions of required disclosures. Cause/Effect: Inadequate internal controls over compliance. Select contracts were not in compliance with 2 CFR 200.332. Questioned Cost: None. Recommendation: We recommend that the PIHP update all contracts with subrecipients to include required language. View of Responsible Official: Management is in agreement with this recommendation.

Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Special Education – Grants for Infants and Families Temporary Assistance for Needy Families (TANF) Block Grants for Prevention and Treatment of Substance Abuse ALN: 84.181 93.558 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Special Education – Grants for Infants and Families H181A200171, H181A210171, H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024, July 1, 2024 – September 30, 2025, July 1, 2025 – September 30, 2026 TANF 2001TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF and 2501TXTANF October 1, 2019 – September 30, 2020, October 1, 2020 – September 30, 2021, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI083054, 1B08TI083478, 1B08I084673, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2019 – September 30, 2021, October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), assistance listings numbers (ALN), and title of the program. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Special Education – Grants for Infants and Families (SEGIF) –The UEI was not included in the base subaward agreement for seven of the eight agreements selected for testing. The last amendment to the original agreement included the UEI number, however, it did not reference the ALN and title of the program. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Temporary Assistance for Needy Families – The ALN and title of the program was not included in four of the seven subaward agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Block Grants for Prevention and Treatment of Substance Abuse –The UEI was not included in one of the 18 agreements selected for testing. The start and end dates for the agreement was September 1, 2020 – August 31, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR §200.332 prior to execution is not at the correct precision level. Effect: Because required subaward information was omitted, HHSC increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing UEI, ALN, and program titles may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: HHSC concurs with the recommendation.

Findings and Questioned Costs Relating to Federal Awards: Finding 2025 001 Timeliness of Subrecipient Monitoring Federal Agency: National Science Foundation U.S. Department of Defense U.S. Department of Health and Human Services Program Name: Research and Development (R&D) Cluster ALN #: 12.910/47.041/47.049/93.213/93.286/93.399/93.837/93.838/93.865 Federal Award Numbers: FA8650 21 2 7119 P00014/EEC 2330040 001/CHE 2221346/ 5R01AT010413 04/5U54EB027049 08/5UG1CA242643 06/ 5UH3HL165065 04/5U01HL146240 07 Revised/ 5U01HL146408 06 Revised Federal Award Year: September 1, 2024 – August 31, 2025 Compliance Requirement: Subrecipient Monitoring Criteria According to 2 CFR 200.332(d), a pass through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subawards, and that the subaward performance goals are achieved. According to 2 CFR 200.332(d)(3) and 2 CFR 200.521, a pass through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure subrecipient single audit reports are reviewed and completed in a timely manner and management decisions are issued within required timeframes. Condition Found The University is required to review the single audit reports received from its subrecipients and issue management decision letters (MDL) within six months of the date of acceptance of the single audit report by the Federal Audit Clearinghouse (FAC). During our testwork over 40 subrecipients, we noted the following: For 3 subrecipients, the University did not issue an MDL in a timely manner. The delay in issuing this MDL was 42 to 167 days beyond the required timeframe. For 11 subrecipients, while the University did review the subrecipient’s single audit report, the review did not occur within the prescribed six month timeframe. The delay in reviewing the subrecipient's single audit reports was 2 to 140 days beyond the required timeframe. Cause The management review controls implemented by the University were not operating at a level of precision to ensure the University completed and documented the monitoring procedures timely primarily due to turnover. The delay occurred during the University’s corrective action period related to a similar finding from the previous year. Possible Asserted Effect Failure to complete and perform reviews of subrecipient single audit reports and issue MDLs in a timely manner may result in subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Questioned Costs None Repeat Finding A similar finding was reported in the prior year audit as finding 2024 001. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Recommendation We recommend the University establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Views of University Officials The University agrees with this finding. Delays occurred during the corrective action period associated with the prior year findings. The University has implemented additional monitoring and tracking procedures indented to strengthen the timeliness of subrecipient reviews and management decision issuance going forward

Item: 2025-002 Assistance Listing Number: 17.280 Program: WIOA Dislocated Worker National Reserve Demonstration Grants Federal Agency: U.S. Department of Labor Pass-Through Agencies: n/a Contract/Pass-Through Grantor Identifying Number: 23A60YP000003 Award Year: September 30, 2023 to September 30, 2026 Compliance Requirement: Subrecipient Monitoring Criteria: A Pass-Through Entity (PTE) is required to monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: (a) reviewing financial and programmatic (performance and special reports) required by the PTE, (b) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means, and (c) issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR 200.521. Condition: The Foundation did not complete the required subrecipient monitoring related to review of subrecipient Single Audits and financial statements. Specifically, we noted no evidence that the Foundation verified whether certain subrecipients met the Single Audit threshold under 2 CFR 200.501 or obtained the subrecipients’ Single Audit reporting packages from the Federal Audit Clearinghouse. Additionally, the Foundation did not obtain or document a review of the subrecipients’ audited financial statements (or other financial information) to inform the subrecipient risk assessment under 2 CFR 200.332(b). Questioned Costs: n/a Context: Our testing included the Foundation’s two subrecipients with subawards totaling $225,335 during the audit period. For each subrecipient, we noted that the Foundation did not complete the required subrecipient monitoring related to review of subrecipient Single Audits and financial statements. Specifically, we noted no evidence that the Foundation verified whether certain subrecipients met the Single Audit threshold under 2 CFR 200.501 or obtained their Single Audit reporting packages from the Federal Audit Clearinghouse. Additionally, the Foundation did not obtain or document a review of the subrecipients’ audited financial statements (or other financial information) to inform the subrecipient risk assessment under 2 CFR 200.332(b). Effect: The Foundation is not in compliance with certain subrecipient monitoring requirements. This is deemed to be a material weakness in internal control over compliance. Cause: The Foundation did not have sufficient internal controls over subrecipient monitoring. Specific contributing factors included: (a) lack of formal, documented procedures assigning responsibility for obtaining and reviewing subrecipient single audit reports and/or reviewing financial statements, and (b) lack of formal training on Uniform Guidance subrecipient monitoring requirements. Identification as a Repeat Finding: Not a repeat finding. Recommendation: For the current audit period, we recommend the Foundation obtain missing Single Audit reports and financial statements, complete and document the required reviews, update subrecipient risk ratings, and perform any necessary follow-up or management decisions. Additionally, we recommend the Foundation establish formal written procedures to comply with 2 CFR 200.332(b), (d), and (f), 2 CFR 200.501, and 2 CFR 200.521, including clear steps and timelines for verifying Single Audit applicability, obtaining and reviewing Single Audit reports, and issuing management decisions when applicable. Additionally, for subrecipients not subject to the Single Audit, the Foundation should obtain annual audited financial statements (or other appropriate financial information) and performing a documented financial review to inform the risk assessment. Lastly, the Foundation should provide periodic training to finance and program staff on subrecipient monitoring requirements under the Uniform Guidance. Views of Responsible Officials: Management of the Foundation concurs with the finding. See Corrective Action Plan.

Assistance Listing, Federal Agency, and Program Name - 20.507, Department of Transportation, Federal Transit Cluster Federal Award Identification Number and Year - MI 2022-032, MI 2022-048, and MI 2023-027 Pass through Entity - N/A Finding Type - Significant deficiency and material noncompliance with laws and regulations Repeat Finding - No Criteria - Per the Uniform Guidance at 2 CFR 200.332, the pass through entity (SMART) must monitor the activities of a subrecipient as necessary to ensure that the subawards comply with federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition - The Authority did not provide sufficient evidence that there was adequate monitoring of subrecipients. Questioned Costs - None If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - Not applicable Identification of How Questioned Costs Were Computed - Not applicable Context - It was identified in the 2025 triennial review that the Authority's procedures and documentation of subrecipient oversight was not adequate. The Authority had two subrecipients during fiscal year 2025, and one of the subrecipients was not adequately monitored based on the funding received. Cause and Effect - The Authority did not provide sufficient evidence for adequate monitoring of subrecipients during the triennial review. Recommendation - We recommend the Authority strengthen subrecipient procedures and maintain evidence that these procedures were performed according to schedule. Views of Responsible Officials and Corrective Action Plan - The Authority is in agreement with this finding. The Authority has reviewed and corrected procedures related to monitoring subrecipients.

Finding 2025 - 001 Lack of Subrecipient Monitoring Procedures – Subrecipient Risk Assessments Federal Agencies: U.S. Department of State and U.S. Agency for International Development Federal Programs: Bureau of Population, Refugees and Migration Overseas Refugee Assistance Programs East Asia; Foreign Assistance for Programs Overseas Assistance Listing Numbers:19.523 and 98.001 Pass-through Entities: JSI Research & Training Institute, Inc. and RTI International Award Identification Number and Year: SPRMCO24CA0083, 2024; 7200AA22CA00011, 2022 and 72066923CA00003, 2023 Criteria or Specific Requirement: According to 2 CFR § 200.332(c), pass-through entities are required to: “Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring.” This risk assessment must consider factors such as the subrecipient’s prior experience with similar awards, results of previous audits, new personnel or systems, and the extent of Federal monitoring. Condition: BRAC USA did not adequately document the results of it's risk assessment procedures of its subrecipients prior to issuing subawards, as required by 2 CFR § 200.332(c). During our review of two subawards issued during the audit period, we noted that management did not formally document any evaluation of subrecipient risk related to program compliance, financial stability, or internal controls. Cause: The entity had not developed or implemented formal procedures to adequately document subrecipient risk prior to making subawards. Management was not aware of the documentation requirement or had not prioritized its implementation. Effect or Potential Effect: Without documenting subrecipient risk assessments, BRAC USA cannot ensure that the level of subrecipient monitoring is appropriate to mitigate risks of noncompliance or misuse of Federal funds. This increases the likelihood of unallowable costs, noncompliance with Federal regulations, and potential questioned costs. Questioned Costs: Costs associated with qualitative monitoring measures are not identifiable. Context: During our audit, we examined subawards for two subgrantees for which total expenditures aggregated $1,683,098 (approximately 67% of the total Federal expenditures passed through to subrecipients). Identification as a Repeat Finding, if applicable: Not a repeat findingRecommendation: The entity should establish and implement written procedures to perform and document subrecipient risk assessments prior to awarding Federal funds. The procedures should include standardized criteria—such as prior audit results, experience with similar programs, financial stability, and management capacity—to determine risk levels and guide monitoring activities.

2025-003 Lack of Formal Subrecipient Monitoring Program Name/Assistance Listing Number: 93.788 Opioid STR Federal Agency: Department of Health and Human Services Type of Finding: Significant Deficiency Compliance Requirement: Subrecipient Monitoring Criteria: According to 2 CFR §200.332 (Requirements for Pass-Through Entities), a pass-through entity must monitor the activities of subrecipients as necessary to ensure that federal funds are used for authorized purposes and in compliance with applicable statutes, regulations, and terms and conditions of the Federal award. Required monitoring includes, but is not limited to, the following: a. Reviewing financial and programmatic reports; b. Performing risk assessments of subrecipients; c. Following up on deficiencies identified through audits or reviews; and d. Ensuring subrecipients have required audits under 2 CFR §200.501. Lack of documented subrecipient monitoring constitutes noncompliance with Uniform Guidance. Condition: During our walkthrough and review of the Organization’s grant management processes, we noted that the Organization does not have formal subrecipient monitoring policies or procedures in place. While a monitoring memo exists, it documents only an informal process and does not provide structured oversight. Specifically: - No risk assessments, monitoring checklists, or follow-up documentation were maintained. - There is no formalized, structured process or standard for overseeing subrecipient activities. - Required monitoring under 2 CFR §200.332 could not be performed. Cause of Condition: Management has not developed formal policies and procedures for subrecipient monitoring or consistent documentation standards. Potential Effect of Condition: Noncompliance: Failure to monitor subrecipients increases the risk of noncompliance with Uniform Guidance requirements. Questioned Costs: Federal program expenditures passed through to subrecipients may become subject to questioned costs if insufficient oversight results in unallowable or unsupported charges. Financial & Operational Risk: The Organization may be exposed to reputational or financial consequences, including funding restrictions, if the lack of monitoring persists. Questioned Cost: Not quantifiable. Recommendation: We recommend the Organization develop and implement formal policies and procedures for subrecipient monitoring, including: a. Conducting and documenting subrecipient risk assessments; b. Establishing structured monitoring procedures, such as periodic reviews, report evaluations, and follow-ups; c. Maintaining written documentation of all monitoring activities; and d. Implementing policies to ensure consistent oversight of subrecipient performance and compliance. Description of the Nature and Extent of Issues Reported: The Organization did not perform or document any formal subrecipient monitoring activities during the fiscal year. This constitutes noncompliance with 2 CFR §200.332. Management Response: Management concurred with the finding. In the future, the organization will require midyear and year-end impact reports from each grant subrecipient.

Subrecipient Monitoring Departments of Education Passed through Minnesota Department of Education Federal Financial Assistance Listing 84.027/84.173 Special Education Cluster Condition: During our audit, we found that RAED did not have proper subrecipient monitoring documentation related to approvals and communication of subaward terms and conditions. Criteria: 2 CFR section 200.332, Requirements for pass-through entities, requires RAED to communicate subaward terms and conditions with subrecipient and to monitor the subawards for authorized purposes in compliance with Federal statutes, regulation and the terms and conditions. Cause: Communication to subrecipients about terms and conditions of the subaward was not sent out during the fiscal year. It was also noted that there was a missed approval of a reimbursement request during staff turnover. Effect: RAED is not incompliance with Federal Award Programs. Recommendation: We recommend RAED review their procedures in place to determine if any improvements can be made to ensure compliance with subrecipient monitoring. Management Response: There is no disagreement with the audit finding.

Finding 2025-002: Subrecipient Monitoring Criteria: The Uniform Guidance (2 CFR §200.332) requires a non-Federal entity to monitor the activities of its subrecipients as necessary to ensure that Federal awards are used for authorized purposes in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specifically, the Sponsoring Organization is required to perform specific monitoring activities, including site visits, for its CACFP subrecipients (centers/homes). To ensure that these required monitoring activities are occurring timely and correctly, the Sponsoring Organization's internal controls include a requirement for monthly meetings between the Program Manager and the Monitoring Specialist to review the status of subrecipient monitoring. Condition: During the review of internal controls related to subrecipient monitoring, it was noted that the required monthly meetings between the Program Manager and the Monitoring Specialist were not consistently performed throughout the fiscal year. Specifically, for the 12-month period tested, the required monthly reviews were not documented for 3 out of 12 months. Cause: The lapse in the required monthly reviews was attributed to staff turnover in the program office and competing priorities that diverted staff time away from this control activity. Effect: The lack of consistent management oversight through the required monthly meetings increases the risk that mandatory subrecipient monitoring activities (e.g., required site visits, review of subrecipient documentation) could be delayed, missed, or performed inadequately. This could result in non-compliance by the subrecipients going undetected, potentially leading to inaccurate claims and funds being used for unauthorized purposes. Questioned Costs: None noted. Context: This is the first year this finding has been reported. The internal control deficiency appears to be a breakdown in the execution of the established procedure rather than an absence of a control. Repeat Finding: No. This is the first time this specific finding has been identified. Recommendation: We recommend that management reinforce the importance of this control and implement a documented process to ensure that the monthly meetings between the Program Manager and the Monitoring Specialist occur consistently. This should include establishing a recurring meeting schedule and requiring documentation (e.g., signed meeting minutes, checklist) that demonstrates the review of monitoring status took place each month, even during periods of staff turnover or high-priority competing demands.

Finding 2025-003: Subrecipient Monitoring Criteria: The Uniform Guidance (2 CFR §200.332) requires a non-Federal entity to monitor the activities of its subrecipients as necessary to ensure that Federal awards are used for authorized purposes in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Furthermore, the Organization's policy and/or CACFP regulations governing the Sponsoring Organization require an initial on-site review of each new center or Family Child Care (FCC) provider within the first 28 calendar days of program operation. This is a critical component of initial subrecipient monitoring to ensure program integrity and compliance with Federal requirements. Condition: The Sponsoring Organization did not consistently perform the required initial on-site review for new subrecipients (centers and FCC providers) within the mandatory 28-day timeframe. A sample of 40 new centers/FCC providers was selected for testing. Four (4) of the 40 subrecipients (10%) did not have their initial on-site review completed within the first 28 days of operation. The delays in conducting the initial reviews ranged from 6 to 23 days past the required 28-day deadline. Cause: The cause appears to be an inadequate internal control or process to ensure initial review scheduling and completion are prioritized and managed to meet the 28-day deadline, potentially due to competing demands or staffing limitations. Effect: Failure to conduct initial on-site reviews within the required timeframe weakens the Sponsoring Organization's internal controls over subrecipient monitoring and oversight. Timely initial reviews are essential for early identification and correction of compliance issues, proper training, and ensuring new centers/FDCH providers operate in accordance with Federal CACFP requirements from the outset. Questioned Costs: None noted. Context: This is the first time this issue has been noted as a finding. The Sponsoring Organization performed the required reviews; however, they were completed after the regulatory deadline. Repeat Finding: No. This is the first time this specific finding has been identified. Recommendation: The Sponsoring Organization should strengthen its internal controls and monitoring procedures to ensure that all new centers and FCC providers receive the required initial on-site review within the 28-day mandatory timeframe. This should include: 1. Establishing a formal process with documented timeframes for assigning and completing initial reviews immediately upon a new site's approval. 2. Implementing a system to track and alert monitoring staff of the 28-day deadline for each new subrecipient. 3. Providing targeted training to monitoring staff to emphasize the importance of timely initial reviews and the associated regulatory deadlines.

Finding: 2025-002 Subrecipient Monitoring (Significant Deficiency) Federal Agency(ies): United States Department of Agriculture Federal Program(s): Partnerships for Climate-Smart Commodities Assistance Listing Number(s): 10.937 Pass-through Entity (if applicable): N/A Award Identification Number and Year: NR233A750004G045 (2023) Criteria or Specific Requirement: Per 2 CFR 200.332 Requirements for pass-through entities:  Pass-through entities must clearly identify to subrecipients the award information, including the Assistance Listing number, subrecipient’s UEI, Federal award identification number, and Federal award project title (§200.332(a)(1)).  Pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate subrecipient monitoring (§200.332(b)).  Pass-through entities must monitor the activities of subrecipients as necessary to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward (§200.332(d)). Condition: During our testing of subrecipient monitoring, we noted several deficiencies: 1. Subaward agreements were structured more like subcontracts rather than subrecipient agreements and did not include all elements required under 2 CFR 200.332(a), such as the subrecipient’s UEI and Assistance Listing number. 2. Subrecipients were required to submit periodic invoices for reimbursement instead of financial reports detailing costs incurred by budget line item, cumulative expenditures, cash receipts, and cash balances. 3. Pre-award risk assessments were completed; however, the assessments were undated, preventing the audit team from verifying that they occurred prior to subaward execution. Additionally, the monitoring procedures described in policy were not clearly linked to assessed risk levels, and in certain instances, subrecipients with no prior Federal grant management experience were assigned a “low risk” classification. Cause: These conditions occurred due to a lack of formalized procedures to align subrecipient agreements, reporting requirements, and monitoring activities with the specific requirements of 2 CFR 200.332. Management relied on existing subcontract templates and internal policies that were not fully updated to reflect Uniform Guidance requirements. Effect or Potential Effect: Failure to properly structure subaward agreements, and obtain adequate financial reporting, increases the risk that subrecipients may not comply with Federal statutes and regulations. Questioned Costs: N/A Context: We tested a statistically valid sample of subawards charged to Federal awards. The deficiencies noted were consistent across the sample population, indicating a systemic issue rather than isolated exceptions. Identification as a Repeat Finding, if Applicable: Yes, repeat of Finding 2024-002Recommendation: We recommend that management:  Update subaward agreement templates to include all elements required under 2 CFR 200.332(a).  Require subrecipients to submit periodic financial reports by budget line item, cumulative expenditures, cash receipts, and cash balances, rather than invoices alone.  Revise pre-award risk assessment procedures to include dating and ensure that results are documented prior to subaward execution.  Strengthen policies to ensure monitoring procedures are explicitly linked to risk assessment results, with higher levels of oversight required for subrecipients new to Federal grant management.

Findings and Questioned Costs Relating to Federal Awards: 2025-001 Compliance Finding: Subrecipient Monitoring-Audit Verification. Federal Agengy: Department of the Treasury. Pass-through Entity: SC Rural Infrastructure Authority. Federal Program: Coronavirus State and Local Fiscal Recovery Funds(CSLFRF)-Water Capacity Improvments. Assistance Listing Number: 21.027. Criteria. In accordance with 2 CFR 200.332(g) a pass-through entity must verify that a subrecipient is audited as required by subpart F. Subpart F: 200.501 Audit Requirements. (a) Audit required. A non-Federal entity that expends $1,000,000 ($750,000 prior to the 2024 uniform Guidance (UG) revisions) or more during the non-Federal enity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. Condition. Cherokee County did not adequately verify that the subrecipient obtained the required single audit or program specific audit in accordance with 2 CFR 200.332. Although Cherokee County was aware that the subrecipient would be subject to audit requirements based on federal expenditures, Cherokee County did not obtain or otherwise confirm receipt of the required audit report by the applicable submission deadline of September 30, 2025. Upon further inquiry it was determined that the subrecipient did not have a single audit or program-specific audit by September 30, 2025. Cause. The County did not perform sufficient follow-up procedures to confirm subrecipient compliance with single audit requirements after being notified that the subrecipient would be subject to audit for the year ended December 31, 2024. Effect. Failure to verify receipt of the required audit prevented Cherokee County from complying with their policies and procedures and with federal regulation in a timely manner. Recommendation. We recommend that Cherokee County enhance its subrecipient monitoring procedures to include documented follow-up and verification that subrecipients subject to single audit requirements submit the required audit reports within the applicable timeframes, in accordance with 2 CFR 200.332.

Federal Program: Temporary Assistance for Needy Families (TANF) (93.558). Criteria: 2 CFR 200.332(d) requires pass-through entities to monitor the activities of subrecipients to ensure compliance with federal statutes, regulations, and the terms and conditions of the subaward. Required monitoring activities include reviewing financial and performance reports, following up on deficiencies, and ensuring timely corrective action. Condition: The Council did not perform required monitoring procedures for subrecipients as required by Uniform Guidance: Cause: The Council lacked formal procedures and controls for tracking and reviewing subrecipient audit reports and for documenting follow-up on identified deficiencies. Effect: There is an increased risk that subrecipients may not comply with federal requirements, which could result in unallowable costs, questioned costs, or other noncompliance with federal statutes and regulations. Questioned Costs: None. Context: This finding was noted in 3 out of 4 subrecipients for the fiscal year ended June 30, 2025 with a total of $124,302 paid to subrecipients. Repeat Finding: No. Recommendation: We recommend the client implement and document formal procedures to ensure all required subrecipient monitoring activities are performed in accordance with Uniform Guidance, including obtaining and reviewing subrecipient audit reports and following up on any identified deficiencies. Views of Responsible Officials: Management concurs with the finding and will implement corrective action.

Finding Reference Number: 2025-001 Federal Program: CFDA 93.959– Block Grants for Prevention and Treatment of Substance Abuse Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: Lutheran Service Florida, Inc. Award Year: FY 2025 Criteria: Per 2 CFR §200.332(d), pass-through entities must monitor the activities of subrecipients to ensure that federal awards are used for authorized purposes and in compliance with laws, regulations, and the provisions of the subaward. Monitoring includes reviewing performance and financial reports required by the subaward agreement. Condition: The pass-through entity conducted appropriate monitoring activities for the subrecipient Bradford Community Coalition, Inc., including communication and oversight consistent with federal requirements. However, the subrecipient did not submit the required monitoring report by the established deadline. As of the audit report date, the report remained outstanding. Cause: While the pass-through entity fulfilled its monitoring responsibilities, the subrecipient failed to comply with reporting requirements in a timely manner. Effect: The absence of the monitoring report limits the pass-through entity’s ability to fully verify that the $39,406 in federal funds was used in accordance with applicable regulations. This may result in questioned costs due to insufficient documentation. Questioned Costs: $39,406 Recommendation: We recommend the pass-through entity continue its monitoring efforts and implement additional follow up procedures to ensure timely receipt of required reports. The entity should also consider revising subaward agreements to include stronger enforcement mechanisms for noncompliance. Views of Responsible Officials: The organization monitored the subrecipient in accordance with federal guidelines and has documented its oversight activities. We are working with the subrecipient to obtain the overdue report and have updated our procedures to escalate follow-up actions when reports are delayed.

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-014 Condition: For 2 out of 2 selections, the unique identifier number and federal award identification number were not included in the grant agreement. For 2 out 2 selections, evidence that the prior year Single Audit Report was reviewed was not provided. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (b) Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; and (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (f) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance for subrecipient monitoring. Effect: The subrecipient could not be in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls to ensure grant agreements include the unique identifier number and federal award identification number. We also recommend a process to ensure that the single audit of subrecipients are reviewed timely. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Labor (DOL) AL No. 17.258, 17.259, 17.278 Workforce Innovation and Opportunity Act (WIOA) Cluster Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Condition: For 2 out of 2 selections, the unique identifier number on the notice of award did not agree with the subrecipient's active registration UEI on SAM.gov. For 2 out of 2 selections, management was unable to provide evidence that subrecipient monitoring was performed to ensure compliance with accounting requirements. For 2 out of 2 selections, evidence that the prior year Single Audit Report was reviewed was not provided. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (b) Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. According to AM 413-60, Grant Documentation, Grant Manager/Program Manager/Director Conducts ongoing monitoring and control of all reimbursement receipts and deposits until grant ends; as well as all program and sub-recipient (when applicable) documentation, to include: (1) program documentation; (2) timesheets; (3) deliverables; (4) activities; (5) vendor payments; (6) program data/charts/numbers; and (7) financial and compliance report. According to AM 413-61, Grant Management Financial Reporting, Grant Manager/Program Manager/Director maintains all documentation, either electronic or hard copy, for all federally funded grants for the term of the grant for a minimum of seven years for review and audit by the granting agency or its designee. Cause: The Mayor’s Office of Employment Development (MOED) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: MOED may not be in compliance with the subrecipient monitoring requirements of its grants. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-022 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 1 out of 1 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR 200.303: Internal Control, the non-Federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: The Baltimore County Department of Health (BCHD) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-025 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 5 out of 6 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR 200.303: Internal Control, the non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: The Baltimore County Department of Health (BCHD) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-028 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 2 out of 5 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR §200.303: the non-federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: BCHD did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

U.S. Department of Treasury AL No. 21.027 American Rescue Plan Act Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-015 Condition: There was no evidence that the City verified whether the subrecipient was suspended and/or debarred from receiving federal funds for 3 out of 40 subrecipients selected for testing. The City did not have current subrecipient grant agreements for 3 out of 40 subrecipients selected for testing. The unique entity identifier (UEI) was not included in the grant agreements for 3 out of 40 subrecipient grant agreements selected for testing. The Federal Award Identification Number (FAIN) was not included in the grant agreements for 8 out of 40 subrecipient grant agreements selected for testing. The UEI was incorrect in the grant agreement for 1 out of 40 subrecipient grant agreements selected for testing. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. According to AM 413-61, Grant Management Financial Reporting, Grant Manager/Program Manager/Director maintains all documentation, either electronic or hard copy, for all federally funded grants for the term of the grant for a minimum of seven years for review and audit by the granting agency or its designee. Cause: The City did not maintain adequate documentation of the requirements included in Uniform Guidance for subrecipient monitoring. Effect: The subrecipient could not be in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.

Finding 2025.003 - Subrecipient Monitoring - Material Weakness Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name and Assistance Listing Number: Head Start Cluster, 93.600 Federal Award Identification Number and Year: 01CH011268-05-01 (2024), 01CH012890-01-01 (2024), 01CH011268-05-03 (2024) Name of Pass-through Entity (if applicable): N/A Criteria Per 2 CFR 200.332 (Requirements for pass-through entities) a pass through entity must, among other things, evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition CLC did not properly monitor its subrecipient in accordance with Uniform Guidance requirements. The agreement with the subrecipient referred to outdated polices that were replaced by the Uniform Guidance (Circulars A-87, A-110, A-133) and did not include all required elements which included, but is not limited, to the Assistance Listing Number, Unique Identifying Number. A review was not performed of the use of program funds or the subrecipient's audited financial statements and Uniform Guidance report. Cause The Financial Policies and Procedures Manual was not followed. The manual also needs to be updated to include the updated requirements of the Uniform Guidance and require documentation of review of compliance with requirements. Effect or Potential Effect Failure to perform required risk assessments and to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Questioned Costs None Context During our testing, we noted CLC did not perform subrecipient monitoring procedures over subrecipients with respect to the Head Start Cluster Program during the year ended June 30, 2025. Amounts passed through to subrecipients totaled $284,791 for the year ended June 30, 2025. Identification as a Repeat Finding This is not a repeat finding. Recommendation Management should review the Uniform Guidance requirements for subrecipient monitoring and update their policy manual as appropriate. We recommend CLC develop and implement a standardized checklist that outlines all subrecipient monitoring compliance requirements. The checklist should clearly identify the individual responsible for implementing each requirement and the individual responsible for reviewing compliance, along with documentation of that review. Views of Responsible Officials Children’s Learning Centers of Fairfield County, Inc. concurs with this finding. Management will update its Financial Policies and Procedures Manual and subaward templates to align with current Uniform Guidance requirements, including all required subaward elements (such as Assistance Listing Number, UEI, award identification, and applicable compliance requirements). CLC will implement a standardized subrecipient monitoring checklist covering risk assessment, review of invoices and programmatic reports, verification of allowable costs, confirmation and review of subrecipient audit requirements and Uniform Guidance reports (as applicable), and documentation of management review. Monitoring will be documented and reviewed by senior management on at least an annual basis and more frequently based on risk.

FINDING 2025-003 Subject: Teacher and School Leader Incentive Grants – Subrecipient Monitoring Federal Agency: Department of Education Federal Program: Teacher and School Leader Incentive Grants Assistance Listings Number: 84.374 Federal Award Numbers and Years (or Other Identifying Numbers): Year 2-3, Year 3-4 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Modified Opinion Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, material noncompliance related to the Teacher and School Leader Incentive Grants (TSL) funds passed through to subrecipients. The School Corporation received and passed through to subrecipients $6,143,393 of TSL funds. The School Corporation is to clearly identify the award and applicable requirements to the subrecipients, evaluate the risk of noncompliance related to the subrecipients to determine appropriate monitoring of the subaward, and monitor the activities of the subrecipients to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. The School Corporation did not enter into an agreement with the subrecipients. As such, there is no agreement between the School Corporation and the subrecipients that clearly identifies the award as a subaward or includes all the required data elements. In addition, the School Corporation did not have any policies or procedures in place to evaluate the subrecipients' risk of noncompliance or to monitor the activity of the subrecipients. Per inquiry of the School Corporation, it was determined an evaluation of the risk of noncompliance for the subrecipients was not completed, nor did the subrecipients' files support any such evaluation. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 19 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states: "All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the passthrough entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; INDIANA STATE BOARD OF ACCOUNTS 20 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; (4) (i) An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the pass-through entity must determine the appropriate rate in collaboration with the subrecipient, which is either: (A) The negotiated indirect cost rate between the pass-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass-through entity is not required to collect information justifying this rate, but may elect to do so; (B) The de minimis indirect cost rate. (ii) The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). (5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and (6) Appropriate terms and conditions concerning closeout of the subaward. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; INDIANA STATE BOARD OF ACCOUNTS 21 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. INDIANA STATE BOARD OF ACCOUNTS 22 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 of this part and in program regulations." Cause The School Corporation's management was not aware of the requirements for subrecipient and subaward monitoring compliance. Thus, the School Corporation had not implemented its system of internal controls, which would include appropriate segregation of duties that would likely be effective in preventing, or detecting and correcting, noncompliance related to the Subrecipient Monitoring compliance requirement. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the School Corporation establish a proper system of internal controls, including segregation of duties, to evaluate the subrecipients' risk of noncompliance and adequately monitor the subrecipients. Additionally, policies and procedures should be implemented to ensure appropriate reviews, approvals, and oversight are taking place, as needed, to evaluate and monitor its subrecipients. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Condition: The City entered into a written agreement with a subrecipient; however, the agreement did not include language requiring the subrecipient to compliance with the Uniform Guidance. As a result, the subrecipient was not formally notified of its responsibility to adhere to federal administrative, cost, and audit requirements. Criteria: 2 CFR §200.332(a) requires pass-through entities to ensure that subaward agreements include all required federal award information and clearly identify applicable federal statutes, regulations, and terms and conditions, including compliance with Uniform Guidance (2 CFR Part 200). Cause: The City had a preexisting agreement with an entity who later became a subrecipient of federal grant pass-through funds. The City did not amend their agreement to include the required components after receiving the grant nor report the funds as federal revenues or expenditures in the City’s financial statements. Effect or Potential Effect: Without a formal subaward agreement, the pass-through entity lacks assurance that the subrecipient understands and complies with applicable federal requirements, increasing the risk of noncompliance, improper use of federal funds, and questioned costs. The subrecipient may also not be aware of their responsibility to report the related federal expenditures on the subrecipient’s schedule of expenditures of federal awards. Questioned Costs: None. Recommendation: We recommend that the City identify all federal expenditures and passthrough awards and notify all subrecipients of their receipt of federal awards by identifying the award granted, specific compliance requirements passed-through and other requirements of 2 CFR 200.332. Management’s Comments Regarding Corrective Actions Planned: Management agrees with the finding. The City had a preexisting agreement with the subrecipient for a project that was already in progress when the federal grant was awarded. The subrecipient had in-depth involvement during the federal grant application process and is aware of specific compliance requirements under the Uniform Guidance (2 CFR Part 200). We will make sure that all future subrecipients of pass-through federal grants are notified in writing of the responsibility to adhere to federal administrative, cost, and audit requirements.

Federal Program - Research and Development Cluster Assistance Listing Numbers - Various Federal Agency - All Research and Development Sponsor Award Number - Various Award Period - Various Criteria or Specific Requirement – Subrecipient Monitoring - Management is responsible for verifying that subrecipients expected to be audited as required by CFR part 200, subpart F, met this requirement. (2 CFR 200.332(g)) Condition - Management reported that subrecipient monitoring procedures as it relates to confirming subrecipients met audit requirements had not been completed during the year. Cause - Turnover of University personnel responsible for subrecipient monitoring. Questioned Costs - There were no questioned costs as a result of this finding. Effect - While management did follow established controls to determine whether subrecipients used the Federal awards for authorized purposes and complied with Federal statutes, regulations and the terms and conditions of the sub award, by not confirming whether subrecipients had received required audits, management may not become aware of subrecipients with audit findings. Context - Management reported that subrecipient monitoring procedures as it relates to confirming subrecipients met audit requirements had not been completed for all ten subrecipients during the year. Identification as a Repeat Finding - No. Recommendation - We recommend management bring subrecipient audit documentation current and complete training with responsible individuals to ensure future compliance.

2025-001 Internal Controls Systems and Compliance Over Subrecipient Monitoring – U.S. Department of Treasury, COVID-19 Coronavirus State and Local Fiscal Recovery Funds, Passed Through the State of Nevada Department of Education Criteria: In accordance with 2 CFR 200.332(a)(1), the auditee must maintain a system of internal control to ensure information related to federal awards is clearly identified to the subrecipient at the time of the subaward and if any data elements change, include the changes in a subsequent subaward modification. Condition: The Organization receives funding for the Nevada Ready! program through the State of Nevada Department of Education. The amount of funding provided by Federal and state sources changes annually as does the Federal program from which the funds are derived. The Organization did not receive clear documentation from their grantor on the source of grant funding and did not clarify with the grantor on these requirements. The Organization then did not identify the correct Federal agency and assistance listing number for the grant awards provided to subrecipients. Context: Sixteen preschool centers received notification of subawards with an incorrect Federal agency and assistance listing number for the Federal funds received. Cause: The design and implementation of internal controls over subrecipient monitoring was not operating effectively. Effect: Not communicating the correct Federal agency and assistance listing number in a subaward to subrecipients could result in the subrecipients not complying with Federal regulations. Repeat Finding: Yes. Prior finding 2024-001. Recommendation: We recommend management design and implement a system of internal controls whereby every subaward that includes Federal funding be clearly identified to the subrecipient as a Federal subaward and include all data elements required to be provided to the subrecipient at the time of the subaward. For any information where the Organization’s grantor has provided unclear or incomplete information, appropriate follow-up with the grantor should be performed. Additionally, if any of the data elements change, those changes should be included in a subsequent subaward modification. Views of Responsible Officials and Planned Corrective Action: We appreciate the identification of this compliance issue and are committed to addressing the finding with a robust corrective action plan. The following steps outline the measures we will take to ensure compliance with federal requirements for subrecipients. 1. Each subaward will be clearly identified as a federal subaward and include all required data elements at the time of issuance. Any subsequent changes will be communicated through a formal subaward modification process. 2. Each required data element will be reviewed and compared to the source data by the preparer and the final signer. If elements are unclear or incomplete, follow-up with the grantor will be performed before the execution of the agreement. If clarity cannot be obtained, the agreements will be executed, noting the area of unclear or incomplete data and that the information will be obtained and updated promptly through a formal subaward modification agreement. 3. In the event subsequent changes occur, these changes will be communicated through a formal subaward modification agreement.

Coronavirus State and Local Fiscal Recovery Funds: Noncompliance over Subrecipient Monitoring Condition: During our testing of subrecipient monitoring requirements, we noted that for all of the subrecipients tested, the Organization did not verify whether or not the subrecipient required and, if so, completed an audit. Criteria: 2 CFR 200.332(g) of the Uniform Guidance requires pass-through entities to verify that subrecipients are audited as required by subpart F of 2 CFR 200. Cause: The exception was due to a breakdown in the Organization’s procedures to ensure that all subrecipient monitoring procedures are in accordance with Uniform Guidance. Effect: There is an increased risk that noncompliance at the subrecipient level could occur and remain undetected by the Organization. Improper subrecipient monitoring procedures can also result in actions taken by oversight agencies which could impact future funding. Context: The population subject to subrecipient monitoring requirements included 69 subrecipients. The sample size of seven subrecipients was determined. Recommendation: We recommend that the Organization implement procedures that include monitoring that subrecipients needing an audit meet the requirement. Views of Responsible Officials: Management agrees with the finding.

Finding No. 2025-001 – Subrecipient Monitoring Deficiencies Repeat Finding: No ALN and Program: 84.002 – Adult Education State Grant Program Award Amount: $1,384,339 Award Number: 09-401-146-125 Award Year: 7/1/2024-6/30/2025 Criteria: 2 CFR 200.332 specifies requirements for monitoring subaward agreements. Section (b) of the guidance lists required elements to be included in subaward agreements, including subrecipient identifying information, information about the original federal award dates and amounts, contact information, and compliance requirements of the award. Section (c) specifies that grantees evaluate each subrecipient's fraud risk and risk of noncompliance with the subaward. Section (e) requires grantees to assess risk and monitor the activities of a subrecipient as necessary to ensure the subrecipient complies with Federal statutes, regulations, and terms and conditions of the subaward. MATC's system of control is required to be designed and implemented in order to ensure compliance of subawards with the applicable compliance requirements. Condition/Context: In testing compliance with the requirements of 2 CFR 200.332, we noted that MATC's internal controls over subrecipient monitoring requirements were not effectively operating during the year ended June 30, 2025. MATC's subaward agreement with Literacy Services of Wisconsin did not contain all the required information included in Section (b). In particular, the agreement was missing the subrecipient's Unique Entity Identification Number (UEI), the Federal and / or State Award Identification Number (FAIN), Federal and / or State Award Date, and the indirect cost rate for the Federal and / or State Award. Additionally, MATC was not able to produce evidence of the required risk assessment process, and resulting monitoring activities deemed necessary to ensure the subgrantee's compliance with Federal Requirements. MATC's review and approval process for this subaward did not prevent, detect, or identify the missing contract information or the lack of documented risk assessments. Monitoring activities were performed; however, without the documented risk assessment, it is unclear whether the activities were sufficient. Cause: MATC has made subawards under the AEFL program for many years, and the same subaward document has been used without amendment. While the agreement was subjected to the required review and approval process internally, the review did not identify the updated requirements for elements of the agreements. Additionally, MATC has historically performed site monitoring and review of financial reports for all of its sub-awardees; however, in 2025 the individual responsible for performing this process retired and a replacement was not found for several months, resulting in a vacancy in the position and lack of available staffing to complete the monitoring documentation and process. Questioned Costs: None Effect: The subaward agreement is not in compliance with Federal sub-award requirements, and an appropriate risk assessment was not documented, which could result in incorrect reporting of the award by the sub-grantee, or potential non-compliance of the sub-awardee. Recommendation: We recommend MATC evaluate its award approval process and implement clear and robust procedures designed to ensure agreements are compared to the most current set of requirements for compliance.

Type of Finding: Subrecipient Monitoring – Noncompliance and Internal Control (Significant Deficiency) Supplemental Nutrition Assistance Program Cluster: State Administration Matching Grants for the Supplemental Nutrition Assistance Program (Assistance Listing #10.561) Federal Agency: U.S. Department of Agriculture Pass-Through Entity: New York State Office of Temporary and Disability Assistance Contract Number: TDA01-C00986GG-3410000 Funding Years: 10/1/2023 - 9/30/2025 Criteria: Per 2 CFR 200.332(g), a pass-through entity must verify that subrecipients expected to be audited by 2 CFR Part 200, Subpart F, met this requirement. Condition/Context: For a non-statistical sample of three subrecipients, during the fiscal year ended June 30, 2025, UWNYC did not verify that subrecipients expected to be audited as required by 2 CFR Part 200, Subpart F, met this requirement. Cause: UWNYC’s internal controls over subrecipient monitoring lacked the requirement to ensure that UWNYC complied with 2 CFR 200.332(g). However, UWNYC requested and obtained the most recent audit report required by 2 CFR Part 200, Subpart F for each of the sampled subrecipients as part of CBIZ CPAs’ Single Audit requests. Effect: UWNYC was noncompliant with the subrecipient monitoring requirement described in 2 CFR 200.332(g). Questioned Costs: None. Identified as a Repeat Finding: No. Recommendation: UWNYC should implement a procedure within its subrecipient monitoring process and internal control to ensure that, each year, program staff verify whether subrecipients are expected to be audited by 2 CFR Part 200, Subpart F. For those subrecipients that expect to be audited by 2 CFR Part 200, Subpart F, program staff should also obtain and review the final audit report. If the final audit report includes any audit findings, including those specifically related to the subaward, UWNYC should consider such audit findings as part of UWNYC’s assessment of the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Views of Responsible Officials: We acknowledge and accept this finding. To address this gap and prevent recurrence, we will implement a formal annual verification and documentation process requiring program staff to determine audit applicability, obtain and review final Single Audit reports, and incorporate any audit findings into subrecipient risk assessments to inform ongoing monitoring. These procedures will be documented and integrated into UWNYC’s internal controls to ensure future compliance.

Finding 2025-003: Subrecipient Monitoring (Significant Deficiency) Federal Agency: United States Department of Health and Human Services. Federal Program: Unaccompanied Children Program. Assistance Listing Number: 93.676 Pass-through Entity, if applicable: Not applicable. Award Identification Number and Year: All awards and all of 2025 fiscal year. Criteria or Specific Requirement (including Statutory, Regulatory, or Other Citation): Criteria or specific requirement (including statutory, regulatory, or other citation): Per 2 CFR 200.332 Requirements for pass-through entities:  Verify that the subrecipient is not excluded or disqualified in accordance with § 180.300.  Pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate subrecipient monitoring (§200.332(b)).  Verify that a subrecipient is audited as required. Condition: During our testing of subrecipient monitoring, we noted several exceptions as follows:  No process was in place to verify that subrecipients are suspended or debarred from receiving Federal funds.  Pre-award risk assessments were not completed. The monitoring procedures were not linked to assessed risk levels.  The audited financial statements of the subrecipients were not received in order to assist in the risk assessment process. Cause: These conditions occurred due to a lack of formalized procedures to align subrecipient agreements, reporting requirements, and monitoring activities with the specific requirements of 2 CFR 200.332. Management relied on existing subcontract templates and internal policies that were not fully updated to reflect Uniform Guidance requirements. Effect or Potential Effect: Failure to properly structure subaward agreements, and obtain adequate financial reporting, increases the risk that subrecipients may not comply with Federal statutes and regulations. Questioned Costs: Costs associated with qualitative monitoring procedures are not identifiable. Context: We tested a statistically valid sample of subawards charged to Federal awards. The deficiencies noted were consistent across the sample population, indicating a systemic issue rather than isolated exceptions. Identification as a Repeat Finding, if applicable: Not a repeat finding. Recommendation: We recommend that management implement processes and procedures as follows:  Establish formalized policies and procedures on subrecipient monitoring;  Include a screening of subrecipients against the Federal suspended and debarred list as part of the contracting process;  Implement pre-award risk assessments that clearly links monitoring procedures to the level of assessed risk;  Document the monitoring procedures that occurred throughout the year in accordance with the established policies and procedures and identified risk assessment for each subrecipient.