Findings Citing § 200.332

FINDING 2024-215 The Department did not document subrecipient risk assessments or ensure subrecipient audits were received for the Coronavirus State and Local Fiscal Recovery Fund. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of the Treasury Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The requirements for pass-through entities are in 2 CFR 200.332, which states that all pass-through entities must: • Evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. • Consider imposing specific subaward conditions upon a subrecipient, if appropriate. • Verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, and follow up on the results of those audits. A non-Federal entity that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year. Condition: The Department received funds for the Coronavirus State and Local Fiscal Recovery Fund (Assistance Listing Number 21.027) from the U.S. Department of Treasury through the Idaho Department of Financial Management. The funds were for two specific program areas within the Department: planning and construction grants for the clean and drinking water infrastructure projects and waste management projects. During fiscal year 2024, there were 128 subrecipients for these funds. The Department established oversight for these funds under the Grant Loan Bureau (planning and infrastructure grants) and the Waste Management Group (various waste management projects). The Department complied with some, but not all, of the pass-through entity requirements. Noncompliance was identified in the following areas: 1) The Department did not adequately document their evaluation of each subrecipient’s risk of noncompliance with federal statutes, regulations, and terms and conditions of the subaward for 13 out of 13 (100 percent) of the sample tested. The Department completes thorough reviews throughout the project timeline to ensure that subrecipients are complying, but those reviews do not adequately assess the subrecipients risk of noncompliance with a subaward, prior to award, as required by 2 CFR 200.332(c). While the Department’s review does ensure each subrecipient has financial review controls in place, the Department does not document a formal risk assessment that evaluates each subrecipient’s risk of noncompliance based on the subrecipient’s prior experience with the same or similar awards, the results of previous awards including whether the subrecipient receives a Single Audit, whether the subrecipient has new personnel, or the extent and results of any Federal agency monitoring. 2) The Department does not have a process in place to ensure that subrecipients are audited, as required by 2 CFR 200, Subpart F for 1 out of 13 (7.69 percent) of the contracts tested. In the prior-year audit, it was stated that the planning/construction group in the Grants Loans Bureau were aware of this issue and have procedures in place within their Loan Grant Tracking Software (LGTS) and that the Waste Program was aware that the subrecipients also required procedures; however, no procedures are in place. During this year’s audit, however, no documentation was submitted in support of the Grants Loan Bureau or the Waste Program. Cause: The Department did not have a formal documented risk assessment process in place as they believed the application process and monitoring during the actual grant award period met the requirements. The Department has procedures in place to check the Federal Audit Clearinghouse for Single Audit Act (SAA) grant audits to see if a subrecipient has a recent audit, however, this procedure alone does not satisfy the requirement. The Department did not deem it necessary to implement additional procedures to ensure an audit was completed for subrecipients meeting the threshold because the grant makes up more than 50 percent of the total project cost and are reimbursement grants. The fact that these are reimbursement grants does not exempt the Department from ensuring that the subrecipient is audited as required by 2 CFR 200, Subpart F. Effect: Subrecipient monitoring is a critical requirement when accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other guidelines provided by the grantor. Assessing the risk of subrecipient noncompliance enables a pass-through entity to determine the proper level of monitoring procedures. Without completing the risk assessment process, a pass-thought entity may increase the risk that appropriate monitoring procedures will not be performed, and noncompliance may occur and go undetected. Subrecipient audit reports may identify internal control issues and noncompliance with federal award requirements. Reviewing these reports and ensuring that potential issues are addressed decreases the overall risk of noncompliance with the federal award requirements. Recommendation: We recommend that the Department design and implement appropriate procedures to ensure that subrecipient risk assessments are properly completed and documented and subrecipient audits are completed and reviewed in accordance with federal grant regulations. Management’s View: We agree with and acknowledge the three findings presented and are committed to addressing them with the following corrective actions being taken by DEQ. Corrective Action: The Department created a Subrecipient Monitoring Policy that will be implemented by the end of this calendar year, December 31, 2025. This policy includes a risk assessment checklist that will be used prior to issuing a subaward. The results of the risk assessment, the overall risk level, and the level of monitoring will be included in the subaward agreement. The risk assessment and the process will be documented with each subaward request. DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures. Along with these changes, the grants and contracts teams have been combined to help with oversight and consistency. This is particularly valuable when contracting or procuring goods or services with grant or federal funds. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-231 Supporting documentation for subrecipient risk assessments for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program was not available for review. Type of Finding: Significant Deficiency, Noncompliance Related to Prior Finding: 2023-222 AL Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises AL Number: 93.391 Federal Award Number: 1 NH75OT000105-01-00, 6 NH75OT000105-01-00 Program Year: June 1, 2021 – May 31, 2024 Federal Agency: Department of Health and Human Services Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.332(b) states that all pass-through entities must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Additionally, 2 CFR 200.332(c)(2) states that all pass-through entities must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the results of previous audits. This includes considering whether the subrecipient receives a Single Audit in accordance with 2 CFR 200 subpart F and the extent to which the same or similar subawards have been audited as a major program. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program had a total of 6 subrecipients during fiscal year 2024. During testing, the Department was unable to provide a subrecipient risk assessment for 2 out of 6 subrecipients tested (or 33 percent). In the risk assessment, the Department documents the need for a subrecipient to have a Single Audit, if necessary, and the Department’s review of required subrecipient Single Audits. The Department was compliant with all other aspects of the subrecipient monitoring compliance requirements for the subrecipients. Cause: Staff turnover led to the documentation creation and retention shortcomings as new staff were being trained and onboarded when risk assessments should have been completed and documented, including Single Audit requirements. Effect: The Department is exposed to increased risk of noncompliance related to subrecipients and improper payments in the STLT Health Department Response to Public Health or Healthcare Crises program. Recommendation: We recommend that the Department strengthen internal controls to ensure required risk assessments are completed and supporting documentation is retained. Management’s View: The Department Agrees with this Finding. Corrective Action: The Division of Public Health updates its standard operating procedures annually and communicates updates to staff. The DPH Federal Compliance Officer is conducting monthly trainings to cover all required steps in the process and will begin conducting mini audits in calendar year 2026 to ensure all steps are being followed consistently. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Criteria or specific requirement: Per 2 CFR 200.303(a), California Department of Transportation (Caltrans) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes identification of the (ii) Subrecipient's unique entity identifier. (iii) Federal Award Identification Number (FAIN) (xiii) Identification of whether the Federal award is for research and development. Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted. For 60 of 60 samples, the contract did not include neither Subrecipients unique entity identifier, Federal Award Identification Number (FAIN), nor the identification of whether the Federal award is for research and development. Questioned costs: None Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not being done correctly. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by Caltrans. Repeat Finding: This was reported in the previous year as finding 2023-006. Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Per 2 CFR section 200.303(a), the Department must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. §200.332 Requirements for pass-through entities (2 CFR 200.332): All pass-through entities must: (a) Verify that the subrecipient is not excluded or disqualified in accordance with §180.300. Verification methods are provided in §180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 1) Federal award identification. a) Subrecipient name (which must match the name associated with its unique entity identifier); b) Subrecipient’s unique entity identifier; c) Federal Award Identification Number (FAIN); d) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; e) Subaward Period of Performance Start and End Date; f) Subaward Budget Period Start and End Date; g) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; h) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; i) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; j) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); k) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; l) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; m) Identification of whether the award is R&D; and n) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414. (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraphs (f) of this section. When evaluating a subrecipient’s risk, a passthrough entity should consider the following: 1) The subrecipient’s prior experience with the same or similar subawards: 2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with Subpart F and the extent to which the same or similar subawards have been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; and 4) The extent and results of Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Condition: Public Health established a formal risk assessment process over its subrecipients of federal awards by which to determine the frequency and extent of subrecipient monitoring to be performed, however the process was established after the period under audit and applied prospectively. In addition, Public Health used a Department Allocation Letter (DAL) for the COVID-19 program instead of an agreement or contract for the subaward to subrecipients. Certain required information for the subaward federal award information such as Assistance Listings number and Title and Federal Award Identification Number (FAIN) were not clearly identified in the DAL. Questioned costs: None Context: See “Condition.” Cause: Procedures to ensure that all relevant information is included in the grant agreements and risk assessments are performed were not in place at the time of the agreements which resulted in the oversight. Effect: By not properly evaluating the risk of noncompliance, Public Health may inadvertently award grant funds to subrecipients who lack the necessary mechanisms or understanding to comply with federal statutes. This increases the likelihood of noncompliance arising during the performance of the grant-funded activities. Furthermore, failure to provide the necessary documentation to subrecipients may result in misuse or misreporting of funding. Repeat Finding: This was reported in the previous year as finding 2023-009. Recommendation: Public Health should ensure every subaward includes all requirements imposed on the subrecipient so that the federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the federal award. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management. §200.332 Requirements for pass-through entities (2 CFR 200.332): A pass-through entity must: (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a passthrough entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to crosscutting audit findings in accordance with section §200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. California Code of Regulations. Title 5 Education. § 18023. Compliance Reviews of Contractors. (b) At least once every three (3) years and as resources permit, the California Department of Education shall conduct reviews at the contractor's office(s) and operating facility(ies) to determine the contractor's compliance with applicable laws, regulations or contractual provisions. Child Care and Development Fund (CCDF) Plan for State/Territory California FFY 2022-24, Amendment 4. Chapter 8 Ensure Grantee Program Integrity and Accountability. 8.1 Internal Controls and Accountability Measures to Help Ensure Program Integrity. 8.1.1 Process to train about CCDF requirements and program integrity. States and territories are required to describe effective internal controls that are in place to ensure program integrity and accountability (98.68(a)), including processes to train child care providers and staff of the Lead Agency and other agencies engaged in the administration of CCDF about program requirements and integrity. v. Monitor and assess policy implementation on an ongoing basis. The Lead Agency conducts announced Categorical Program Monitoring (CPM)/Contract Monitoring Reviews (CMRs) for each contractor on a three- or four-year cycle for non-LEAs and LEAs respectively. The Lead Agency’s Governance and Administration Unit (GAU) conducts ongoing review of individual contractors by sampling the eligibility and need documentation in family files to estimate and reduce error rates. Additionally, the Lead Agency provides ongoing training and technical assistance to contractors in regional sessions, in one-on-one sessions, and/or in cluster with webinars or during face to-face presentations. These sessions address CCDF program administration, requirements, and integrity Condition: We selected 60 subrecipient contracts (21 local educational agency (LEA) contracts and 39 non-LEA contracts) from 60 subrecipient entities and tested compliance with subrecipient monitoring requirements. We noted the following: LEA • 2 LEA contracts/contractors had no record of on-site monitoring over five years. Non-LEA • 3 non-LEA contracts/contractors had no records available to demonstrate risk assessment of the contractor. • 11 non-LEA contracts/contractors had no record of on-site monitoring over five years. Questioned costs: None Context: See “Condition.” Cause: In fiscal year 2021, the administration of the CCDF Cluster program was transitioned from the California Department of Education (CDE) to CDSS. CDSS has been in the process of revising certain policies and procedures, including contractor monitoring. In addition, certain records related to CDE monitoring activities for the contracts selected were unavailable for review. Effect: CDSS is at risk for contractor noncompliance if monitoring procedures are not properly designed or executed, and/or documents demonstrating monitoring are not maintained. Repeat Finding: This was reported in the previous year as finding 2023-012. Recommendation: To enhance the effectiveness of the annual risk assessment process, we recommend a thorough evaluation that focuses on the identification and inclusion of all subrecipients and defined risk criteria as mandated in 2 CFR 200.332. Furthermore, it is crucial to establish and document a transparent basis for risk profiling that directly correlates such profiles with compliance monitoring activities across fiscal, program, and single audit requirements. Furthermore, we recommend CDSS perform a comprehensive post-transition review to ensure all monitoring responsibilities transferred from CDE have been fully identified and assigned. This review should validate robust mechanisms are in place for the accurate documentation and proper retention of records. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Per 2 CFR 200.303(a), California Department of Fish and Wildlife (CDFW) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes identification of the (xii) Assistance Listing Number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings number at time of disbursement. (xiii) Identification of whether the award is R&D. Per 2 CFR §200.332(f), pass-through entities must verify that subrecipients expected to be audited as required by Subpart F have met this requirement. This verification may be performed as part of the monitoring required under §200.332(d)(2), which includes ensuring subrecipients take timely and appropriate action on deficiencies detected through audits. Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted. For 10 of 10 samples, the contract did not include neither the Assistance Listing Number nor the identification of whether the award is R&D. Furthermore, the agency did not perform required monitoring to verify that subrecipients subject to the Single Audit requirement (2 CFR Part 200, Subpart F) completed their audits and addressed any findings. Specifically, the agency did not obtain or review subrecipient audit reports for the fiscal year under audit. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not being done correctly. The agency lacked formal procedures and internal controls to ensure timely collection and review of subrecipient audit reports. CDFW was not performing requirements to document verification of audit completion and corrective actions. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by CDFW. Without proper monitoring, the agency cannot ensure that subrecipients comply with federal audit requirements or that corrective actions are taken on identified deficiencies. This increases the risk of noncompliance and potential misuse of federal funds. Repeat Finding: This is not a repeat finding. Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. We recommend that management establish and implement comprehensive procedures to ensure compliance with subrecipient monitoring requirements. These procedures should include identifying which subrecipients are subject to Single Audit requirements, obtaining and reviewing their audit reports on an annual basis, documenting verification of compliance, and ensuring timely follow-up on any corrective actions related to audit findings. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Assistance Listing 93.136 Injury Prevention and Control Research and State/Community Based Programs Condition: The City’s Department of Public Health (DPH) did not perform risk assessments or monitor the performance of the eight subrecipients tested for this program. Specifically, DPH did not evaluate the risk of fraud and non-compliance or review the financial and performance reports for these eight entities, Funding for this program is received from the U.S. Department of Health and Human Services. Criteria: OMB’s Uniform Guidance 2 CFR Part 200.332(c) states that the pass-through entity is responsible for evaluating each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring.2 CFR Part 200.332(f)further states that depending on the pass-through entity’s assessment of the risk posed by the subrecipient, the pass-through entity may need to provide training and technical assistance on program matters, perform site visits to review program operations, or arrange for other agreed-upon procedures, to ensure compliance with program requirements and achievement of performance goals. Finally, 2 CFR Part 200.332(e) requires the pass-through entity to monitor the activities of subrecipients by reviewing the financial and performance reports of subrecipients to ensure that the entities comply with federal statutes, regulations, and the terms and conditions of their subawards. Effect: Failure to perform risk assessments and review the financial and performance reports of subrecipients resulted in noncompliance with subrecipient monitoring requirements set forth in the Uniform Guidance. Without these reviews, DPH may not adequately determine the appropriate level of monitoring needed to ensure that subrecipients comply with program requirements, federal regulations, and other requirements of their subawards. This noncompliance could also lead to the city having to pay back federal awards. Cause: DPH incurred significant staff turnover. Recommendation: DPH should strengthen its policies and procedures to ensure that risk assessments and required monitoring procedures are performed for all subrecipients. Additionally, for subrecipients determined to be high-risk, DPH should provide training and technical assistance, perform site visits, and/or apply other agreed-upon procedures to help ensure that subrecipients are properly accountable for subawards and comply with program requirements. Views of the Responsible Officials and Corrective Action Plan: The Philadelphia Department of Public Health (PDPH) acknowledges the findings of the Office of the City Controllers. PDPH confirms that risk assessments and related monitoring documentation for all subrecipients were not consistently completed or retained during the audit period, primarily due to staff turnover and limited administrative capacity within the grants management function. To address this, the Division of Substance Use Prevention and Harm Reduction (SUPHR) has initiated corrective measures to strengthen compliance with the requirements of 2 CFR 200.332. These measures include implementation of standardized tools and procedures to ensure that subrecipient risk assessments, monitoring activities, and the review of financial and performance reports are conducted in a consistent, timely, and well-documented manner. Implementation of these improvements will enhance internal controls, ensure appropriate oversight of subrecipients, and promote full compliance with federal regulations. The Department anticipates that tools and standard operating procedures will be finalized by December 19, 2025, with full implementation of corrective actions by March 3, 2026. Contact Person: Daniel Teixeira da Silva, Director, Division of Substance Use Prevention and Harm Reduction (SUPHR), 267-760-0307

Assistance Listing 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases Program Condition: The city’s Department of Public Health (DPH) did not perform risk assessments or monitor the performance of three subrecipient entities tested for this program. Specifically, DPH did not evaluate the risk of fraud and non-compliance or review the financial and performance reports for these three entities. Funding for this program is received from the U.S. Department of Health and Human Services. Criteria: OMB’s Uniform Guidance 2 CFR Part 200.331(a) states that a subaward recipient may be considered a subrecipient of the pass-through agency if the recipient 1) determines who is eligible to receive federal assistance, 2) has its performance measured in relation to whether the objectives of a federal program were met, and 3) has responsibility for programmatic decision-making. OMB’s Uniform Guidance 2 CFR Part 200.332(c) states that the pass-through entity is responsible for evaluating each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. 2 CFR Part 200.332(f) further states that depending on the pass-through entity’s assessment of the risk posed by the subrecipient, the pass-through entity may need to provide training and technical assistance on program matters, perform site visits to review program operations, or arrange for other agreed-upon procedures, to ensure compliance with program requirements and achievement of performance goals. Finally, 2 CFR Part 200.332(e) requires the pass-through entity to monitor the activities of subrecipients by reviewing the financial and performance reports of subrecipients to ensure that the entities comply with federal statutes, regulations, and the terms and conditions of their subawards. Effect: Failure to perform risk assessments and review financial and performance reports for subrecipients resulted in noncompliance with subrecipient monitoring requirements set forth in the Uniform Guidance. Without these reviews, DPH may not adequately determine the appropriate level of monitoring needed to ensure that subrecipients comply with program requirements, federal regulations, and other requirements of their subawards. This noncompliance could also lead to the city having to pay back federal awards. Cause: DPH management misclassified these three entities as contractors, rather than subrecipients. For purposes of the Epidemiology and Laboratory Capacity Program, contracts between DPH and the three entities in question specifically state that each of the entities would serve as subrecipients for grant funding awarded through the contracts. Subawards were used to hire additional staff for DPH’s COVID-19 Containment Program, for duties that included determining who is eligible to receive federal assistance, achieving the objectives established by the program, making programmatic decisions, and adhering to all applicable federal program compliance requirements. Recommendation: DPH management should reevaluate the criteria used to determine whether subaward recipients are classified as subrecipients or contractors. Additionally, management should ensure that risk assessments and required monitoring procedures are performed for all entities classified as subrecipients. Views of the Responsible Officials and Corrective Action Plan: The Philadelphia Department of Public Health (PDPH) acknowledges the Office of the City Controller’s finding. PDPH maintains a process to identify subrecipients during the contracting process. Contracts with subrecipients include federal compliance language. The three entities identified in this finding, including Concilio, Urban Affairs Coalition (UAC), and Public Health Management Corporation (PHMC), should have been classified as vendors and not subrecipients. These entities were not responsible for programmatic decision-making. This error has been corrected in subsequent contracts. Despite the misclassification, appropriate vendor monitoring was conducted, including supervision of staff hiring and monitoring and reconciliation of monthly invoice packages. Contact Person: Jessica Caum, Director, Department of Public Health, 215-685-6731 Naomi Mirowitz, Performance and Compliance Officer, Department of Public Health, 215-964-5050

Assistance Listing 93.914 HIV Emergency Relief Project Grants Condition: The Office of Health and Human Services' (HHS) Audit Unit failed to issue a management decision for audit findings related to two subrecipients of the city, who each had audit findings reported in their respective single audits. The fiscal year 2023 single audit of Bebashi and the fiscal year 2024 single audit of The Children's Hospital of Pennsylvania had a significant deficiency reported under the HIV Emergency Relief Program (ALN 93.914) in the Internal Controls over Major Programs section of the Schedule of Findings and Questioned Costs. Funding for HIV Emergency Relief program is received directly from the U.S. Department of Health and Human Services. Criteria: 2 CFR section 200.332(e) states that the pass-through entity must issue a management decision for audit findings pertaining only to the federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Effect: The management decision serves to confirm the audit findings and outline a corrective action plan for the subrecipient. Failure to issue a management decision could lead to unresolved findings at the subrecipient level. Cause: HHS incorrectly relies on the auditing firms that perform subrecipient single audits to issue a management decision per 2 CFR section 200.312(e). Recommendation: We recommend that HHS management modifies and/or strengthens its current policies and procedures to ensure that a management decision letter will be issued for audit findings relating to any federal awards that were provided to subrecipients. Views of the Responsible Officials and Corrective Action Plan: HHS acknowledges the Controller’s finding that management decision letters were not issued for specific subrecipient audit findings under ALN 93.914, as required under 2 CFR 200.332(e) and 200.521. While the formal letters were not issued, HHS did review the audit findings, obtained and evaluated the subrecipients’ corrective action plans and confirmed that no questioned costs or additional risks remained. These steps ensured that the underlying corrective actions were completed. To strengthen documentation and ensure consistency across all federal programs, HHS will adopt the following corrective measures: 1. Standard management Decision Template • HHS will adopt a simple, uniform management decision template and clear steps for documenting decisions within the required federal timelines. 2. Central Location for Documentation • HHS will store all management decision letters and related materials in one designated shared location to ensure accessibility and consistent record-keeping. 3. Brief Staff Guidance • HHS will provide concise written guidance to staff outlining: o When a management decision is required, o How to complete it using the template, and o What documentation must be retained? These corrective actions will ensure consistent compliance with federal requirements while supporting the City’s long-term goal of standardizing financial processes across departments. Contact Person: Landuleni Shipanga, Controller, City of Philadelphia Office of Children and Families, 215-683-6366

Finding: 2024-002 Subrecipient Monitoring (Significant Deficiency) Information on the Federal Programs: ALN #10.937 Partnerships for Climate-Smart Commodities Criteria or Specific Requirement (including Statutory, Regulatory, or Other Citation): Per 2 CFR 200.332 Requirements for pass-through entities:  Pass-through entities must clearly identify to subrecipients the award information, including the Assistance Listing number, subrecipient’s UEI, Federal award identification number, and Federal award project title (§200.332(a)(1)).  Pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate subrecipient monitoring (§200.332(b)).  Pass-through entities must monitor the activities of subrecipients as necessary to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward (§200.332(d)).  Pass-through entities must verify that every subrecipient required to have an audit under 2 CFR 200 Subpart F has one completed, and issue management decisions on findings (§200.332(g)). Condition: During our testing of subrecipient monitoring, we noted several deficiencies: 1. Subaward agreements were structured more like subcontracts rather than subrecipient agreements and did not include all elements required under 2 CFR 200.332(a), such as the subrecipient’s UEI and Assistance Listing number. 2. Subrecipients were required to submit periodic invoices for reimbursement instead of financial reports detailing costs incurred by budget line item, cumulative expenditures, cash receipts, and cash balances. 3. CIF did not verify the subrecipient’s audit requirements in a timely manner as required under 2 CFR 200.332(g). 4. Pre-award risk assessments were completed; however, the assessments were undated, preventing the audit team from verifying that they occurred prior to subaward execution. Additionally, the monitoring procedures described in policy were not clearly linked to assessed risk levels, and in certain instances, subrecipients with no prior Federal grant management experience were assigned a “low risk” classification. Cause: These conditions occurred due to a lack of formalized procedures to align subrecipient agreements, reporting requirements, and monitoring activities with the specific requirements of 2 CFR 200.332. Management relied on existing subcontract templates and internal policies that were not fully updated to reflect Uniform Guidance requirements. Effect or Potential Effect: Failure to properly structure subaward agreements, obtain adequate financial reporting, and timely verify audit requirements, increases the risk that subrecipients may not comply with Federal statutes and regulations. Questioned Costs: N/A Context: We tested a statistically valid sample of subawards charged to Federal awards. The deficiencies noted were consistent across the sample population, indicating a systemic issue rather than isolated exceptions. Identification as a Repeat Finding, if Applicable: N/ARecommendation: We recommend that management:  Update subaward agreement templates to include all elements required under 2 CFR 200.332(a).  Require subrecipients to submit periodic financial reports by budget line item, cumulative expenditures, cash receipts, and cash balances, rather than invoices alone.  Establish procedures to ensure subrecipient audit requirements are verified and documented in a timely manner in accordance with 2 CFR 200.332(g). CIF should document the impact of any subrecipient audit findings on the program and the planned corrective action.  Revise pre-award risk assessment procedures to include dating and ensure that results are documented prior to subaward execution.  Strengthen policies to ensure monitoring procedures are explicitly linked to risk assessment results, with higher levels of oversight required for subrecipients new to Federal grant management.

Criteria: 2 CFR 200.303 Internal Controls (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control- Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.329 Monitoring and reporting program performance (a) Monitoring by the recipient and subrecipient. The recipient and subrecipient are responsible for the oversight of the Federal award. The recipient and subrecipient must monitor their activities under Federal awards to ensure they are compliant with all requirements and meeting performance expectations. Monitoring by the recipient and subrecipient must cover each program, function, or activity. See also § 200.332. Condition: • Supporting documentation was not available for 4 out of 8 monitoring reports selected for testing. • None of the monitoring reports selected were approved by a second individual as required by the WIB’s policy. Cause: • Documentation was not retained as required. • Internal controls are not in place over eligibility and monitoring as required by the WIB’s policy. Effect: • Funding may be provided to individuals or entities who are not eligible to receive funding under the federal award programs. • Possible reduction of future funding due to noncompliance with federal award program requirements. Questioned Costs: N/A Repeat Finding: No Recommendation: We recommend that the WIB implement controls and document procedures over eligibility monitoring to ensure compliance with federal award requirements.

Condition: During our test of (2) expenditures totaling $332,735, for the Coronavirus State and Local Fiscal Recovery Funds, it was noted the County did not have a subrecipient monitoring policy and did not obtain subrecipient agreements from its two (2) subrecipients comparing the following information: • Subrecipient name. • Subrecipient Authorized Representative and program contact information. • Subrecipient Employee Identification Number (EIN) and Data Universal Numbering System (DUNS) number. • Federal Award Identification Number (FAIN). • Name of Federal Awarding Agency. • Contact information for the official at the Federal Awarding Agency. • Catalog of Assistance Listing (AL) number and name. • Federal award date. • Total amount of the federal award and indirect cost rate. • Federal award project description. • Start and end date of the agreement. • Amount of federal funds budgeted for the agreement and indirect cost rate allowed. • A statement that all activities must be in accordance with federal statutes, regulations, and terms and conditions of the federal award. The subrecipient should receive a copy of the award documents. • A detailed description of any additional requirements you want the subrecipient to be responsible for such as performance and/or financial reports, attending meetings and/or trainings, etc. • A statement about the monitoring activities, such as where/when they will take place; also include a statement indicating the subrecipient will collaborate on monitoring activities including providing requested financial documents. • A statement indicating if any of the items in the agreement change during the period of performance, the agreement will be amended. • Provide close out terms and conditions. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal expenditures are made in accordance with compliance requirements. Effect of Condition: This condition resulted in noncompliance with grant requirements. Recommendation: OSAI recommends the County gain an understanding of the requirements for this program and implement internal controls to ensure compliance with these requirements. Management Response: Chairman of the Board of County Commissioners: This issue originated under the prior County Clerk’s administration where key reporting processes were not followed. The Board of County Commissioners and the other elected officials have made correcting this a top priority. Together, we are: • developing a comprehensive SOP to ensure accurate and timely tracking and reporting of Federal funds, • improving communication and oversight between all county offices to ensure consistent reporting standards, • and ensuring annual compliance with federal reporting requirements. Our collective goal is to implement the policies and structures that will keep Osage County operating with the highest standard of accountability and excellence County Clerk: I was not the County Clerk in office at this time. To correct this issue, the County plans to develop a SOP to timely and accurately track and report on Grants and Awards. The SOP will be reviewed, adopted, and monitored by the Board of County Commissioners. Criteria: 2 CFR 200, §200.332 Requirements for Pass-Through Entities states in part: All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award. (5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part. (6) Appropriate terms and conditions concerning closeout of the subaward.

2024-007 Federal Agencies: U.S. Department of Agriculture Federal Program Names: The Child Nutrition Cluster: National School Lunch Program Summer Food Service Program Child and Adult Care Food Program Assistance Listing Numbers: 10.555 10.559 10.558 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2023 through June 30, 2024 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria: Under 2 CFR 200.332(d), pass-through entities must monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes and in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Additionally, Child and Adult Care Program (CACFP), National School Lunch Program (NSLP) and Summer Food Service Program (SFSP) monitoring requirements established by the Pennsylvania Department of Education (PDE) require CBS Food Program to conduct meal observation reviews at each contracted center every six months, including at least two unannounced visits, and maintain documentation of such reviews. Condition: During our testing of subrecipient monitoring activities for PDE programs CACFP, NLSP, and SFSP, we selected 31 contracted centers at random. Management provided documentation for each site, including contracts, meal pattern usage records, licensure and training documentation, and both announced and unannounced meal observation reviews. However, we found that CBS Food Program did not always maintain sufficient evidence to prove required monitoring was performed under the CACFP program. For one center, management could not produce proof that meal observation reviews or the mandated two unannounced visits occurred. At another center, neither a contract nor any meal observation review records, including the two required unannounced visits, could be provided. For the NLSP and SFSP, management was unable to provide contracts for any of the seven sampled centers. Additionally, there was no evidence of training for one center, and a second center had a noncompliant monitoring visit; although corrective action was prepared, follow-up occurred only after 66 days instead of within the required 45-day window. Questioned Costs: None Cause: Management did not maintain sufficient internal controls to ensure required monitoring documentation was consistently obtained, retained, and reviewed for each contracted center. In some cases, monitoring activities may not have been performed, or they were completed but not properly documented. Effect: Failure to perform and/or document required monitoring procedures increases the risk that contracted centers may not comply with PDE CACFP, NLSP and SFSP requirements, potentially resulting in: • Noncompliance with federal monitoring requirements • Inaccurate or unsupported program reimbursements • Risk of disallowed costs or questioned costs under the PDE CACFP, NLSP, and SFSP grants • Inability to demonstrate program oversight during audits Recommendation: We recommend that management strengthen internal controls to ensure all required PDE CACFP, NLSP and SFSP subrecipient monitoring activities, including scheduled meal observations and the mandated unannounced visits—are consistently performed, documented, and retained. Management should implement a centralized tracking system to monitor review deadlines, required follow up actions, and receipt of supporting documentation from each contracted center. In addition, staff responsible for monitoring should receive periodic refresher training on PDE CACFP, NLSP and SFSP specific expectations. Finally, management should conduct periodic internal reviews to verify that monitoring documentation is complete, compliant, and appropriately maintained. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan.

Reference Number: 2024-016 Prior Year Finding: 2023-011 Federal Agency: U.S Department of the Treasury U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) COVID-19 – Education Stabilization Fund (ESF) Assistance Listing Number: 21.027 84.425 C, D, R, U, V, W Award Number and Year: CSLFRF: 2021 ESF: S425C210002, 2021-2023 S425D210005, 2021-2023 S425R210006, 2021-2023 S425U210005, 2021-2024 S425V210006, 2022-2024 S425W210021, 2021-2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR 200 section 200.332 (a)1 (ii) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required federal award information at the time of the subaward. If any of the data elements change, include the changes in subsequent subaward modifications. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: Subrecipient's unique entity identifier. Per 2 CFR 200 section 200.332 (a)1(d) a non-Federal entity should monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) was unable to provide documentation that it had subrecipient monitoring procedures in place, nor that monitoring activities were performed. The Department also did not include all required information in subawards it issued to subrecipients. The Department’s 2023 corrective action plan noted that resolution of the finding would not be until FY 2025. The auditor obtained the Department’s project monitoring plan and monitoring survey implemented during fiscal year 2025. Context: ESF: Twenty-nine subrecipients were selected for testing and the following exceptions were noted: • For 29 of 29 subrecipients selected for testing, the Department was unable to provide documentation that subrecipient monitoring procedures were in place nor that subrecipient monitoring was performed. • For 2 of 29 subrecipients selected for testing, the subrecipient’s unique identifier was not obtained. The subaward did not contain the required information nor did the Department provide documentation of obtaining the information for the subrecipient. CSLFRF: For seven of seven subrecipients selected for testing, the Department was unable to provide documentation that subrecipient monitoring procedures were in place nor that subrecipient monitoring was performed. Cause: The subawards for non-public schools did not contain the required information, which was not identified during the review process. The Department’s 2023 corrective action plan noted that resolution of the finding would not be until FY 2025. The auditor obtained the Department’s project monitoring plan and monitoring survey implemented during fiscal year 2025. Effect: The Department is not in compliance with the grantor’s reporting requirements during the audit period. Questioned costs: None noted. Recommendation: We recommend that the Department continue to implement the sub recipient monitoring procedures and develop internal controls to ensure that the monitoring requirements are performed in a consistent and timely manner. Furthermore, the procedures should ensure that the documentation supporting compliance is maintained and readily available for review. We also recommend that the subawards contain all required federal award information. Views of responsible officials: Management agrees with the finding.

Finding 2024-007 U.S. Department of Health and Human Services Assistance Listing Number 93.137 – Community Programs to Improve Minority Health Grant Program Material Weakness and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes, 2023-007, 2023-008, 2023-009 Criteria: A pass-through entity (PTE) must clearly identify to the subrecipient the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.331(a)(1); all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); and any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.331(a)(3)). A PTE must also evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)),and monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). Condition and Context: For 1 out of 1 selection, the City was not able to provide support showing evidence of the risk assessment performed prior to granting funds to the subrecipient and of the monitoring of the subrecipient during the year. Additionally, various information related to the funding source and the grant were missing on the memorandum of understanding (assistance listing number, federal department grantor, single audit requirements, etc.) Cause: The program has had significant employee turnover and there was a lack of documentation of these policies and procedures. Program management does not have knowledge of the process used to select subrecipients. Monitoring procedures performed were not documented and reports submitted by the subrecipients were not reviewed. Effect or Potential Effect: Failure to explicitly state federally-imposed requirements and regulations may result in noncompliance by the subrecipient. Selecting subrecipients without a formal evaluation process and performing minimal monitoring procedures increases the risk of noncompliance for the City and could lead to a loss of funding if the subrecipients are deemed noncompliant. Questioned Costs: Unknown. Recommendation: Program management should revise subaward agreements to specifically note the requirements and regulations of the Uniform Guidance, as noted in Section 200.331(a). Additionally, program management should develop standardized procedures for selecting and granting subawards. These procedures should be formalized and maintained for future reference. Brief minutes of progress meetings should be taken to show that monitoring is taking place. All reporting by the subrecipient should be reviewed by management of the program. Views of Responsible Officials: Management agrees with the finding. Refer to the Corrective Action Plan Section of this report.

State Agency: Illinois Governor’s Office of Management and Budget (GOMB) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Justice (DOJ), U.S. Department of Labor (DOL), U.S. Department of Transportation (DOT), U.S. Department of the Treasury (TREAS), U.S. Department of Education (USDE), U.S. Department of Health and Human Services (USDHHS), U.S. Department of Homeland Security (USDHS) Program Name: WIC Special Supplemental Nutrition Program for Women, Infants and Children, Cild and Adult Care Food Program (CACFP), Crime Victims Assistance Program (CVA), WIOA Cluster (WIOA), Highway Planning and Construction (Highway Planning), Coronavirus State and Local Fiscal Recovery Funds (SLFRF),Title I Grants to Local Educational Agencies (Title I), Special Education Cluster (IDEA), Twenty-First Century Community Learning Centers (Twenty-First Century), Supporting Effective Instruction State Grants (SEISG) Education Stabilization Fund (ESF), Aging Cluster, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families (TANF), Child Support Services, Low-Income Home Energy Assistance (LIHEAP), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), Homeland Security Grant Program (Homeland Security) ALN and Program Expenditures: 10.557 ($181,526,312), 10.558 ($170,354,298), 16.575 ($53,095,634), 17.258/17.259/17.278 ($142,310,788), 20.205 ($2,192,857,212), 21.027 ($230,448,761), 84.010A ($696,900,040), 84.027/84.173 ($639,950,722), 84.287C ($61,131,992), 84.367A ($79,837,486), 84.425 ($2,176,294,000), 93.044/93.045/93.053 ($68,210,944), 93.323 ($94,269,102), 93.558 ($583,126,272), 93.563 ($135,029,923), 93.568 ($205,171,791), 93.575/93.596 ($747,612,292), 93.667 ($55,634,435), 93.959 ($114,897,412), 97.067 ($78,892,342) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-002: Inadequate Monitoring of Subrecipient Single Audit Reviews Condition Found: The State of Illinois did not establish adequate controls to monitor the completion and documentation of the review of single audit reports for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Child and Adult Care Food Program (CACFP), Crime Victims Assistance Program (CVA), WIOA Cluster (WIOA), Highway and Planning Construction (Highway), Coronavirus State and Local Fiscal Recovery Funds (SLFRF), Title I Grants to Local Education Agencies (Title I), Special Education Cluster (IDEA), Twenty-First Century Community Learning Centers (Twenty-First Century), Supporting Effective Instruction State Grants (SEISG), Education Stabilization Funds (ESF), Aging Cluster (Aging), Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families (TANF), Child Support Services (CSS), Low-Income Home Energy Assistance (LIHEAP), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), and Homeland Security Grant (Homeland Security) programs in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of GATA on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State and working with program personnel to issue management decisions on findings. The State utilizes a contractor to perform the centralized functions of obtaining the single audit report, verifying the report meets the requirements, and assigning findings to the applicable State agency. During our testing of subrecipient single audit desk review files for our 2024 major programs, we noted instances where single audit desk reviews were still in process and had not been finalized within GATA ARRMS as of the date of our testing (July 10, 2025). Upon further review of data contained within GATA ARRMS, we identified 637 single audit reviews were identified as incomplete in GATA ARRMS for grantees who: (1) reported expenditures under fiscal year 2024 major programs, (2) had an audit report with a Federal Audit Clearinghouse acceptance date between January 2, 2023 and January 2, 2024 (requiring the report to be reviewed during fiscal year 2024) and (3) were not sanctioned (placed on the Illinois Stop Payment List) by the State for noncompliance with reporting requirements. These 637 reviews were in varying stages of completion with the majority (587 audits) pending documentation supporting the issuance of a final completion letter by the cognizant agency. The remaining 50 audits (7.8%) were pending receipt of documentation, pending a review, or had another error requiring follow-up. These 637 audits included 295 audits (46.3%) with one or more findings potentially requiring a management decision to be issued. We noted the cognizant agencies for the 637 incomplete single audit reviews in GATA ARRMS were as follows: "See Table in the Audit Report" The 637 incomplete single audit reviews in GATA ARRMS pertained to subrecipients of the following major programs: "See Table in the Audit Report" While in many instances there was evidence the State agencies had completed the necessary procedures outside of GATA ARRMS, the purpose of GATA ARRMS is to reduce the duplication of effort across State agencies and to provide a single submission point for the State’s subrecipients. The lack of monitoring controls around this centralized process may result in noncompliance with subrecipient single audit desk review requirements. The State’s subrecipient expenditures under the federal programs for the year ended June 30, 2024 were as follows: "See Table in the Audit Report" Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure the federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. Further, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on audit findings within six months of acceptance of the audit report by the FAC and ensure that the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include implementing procedures to monitor whether single audit reports are reviewed, management decision letters are issued, and single audit desk review files are closed out in GATA ARRMS in a timely manner. Cause: In discussing these conditions with GOMB officials, management stated that the incompleteness of the State’s audit reviews in GATA ARRMS was due to oversight. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in GATA ARRMS in a timely manner may result in noncompliance with the State’s obligation as a pass-through entity to appropriately monitor its subrecipients. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-002. (Finding Code 2024-002, 2023-002) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend GOMB establish procedures to monitor the completion and documentation of single audit report reviews in GATA ARRMS to ensure the State complies with its obligation as a pass-through entity. Views of GOMB Officials: GOMB agrees with the finding.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of the Treasury (TREAS) Program Name: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN and Program Expenditures: 21.027 ($230,448,761) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-004: Inadequate Monitoring of Subrecipients of the CSLFRF Program Condition Found: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program during the year ended June 30, 2024. Multiple State agencies are involved in awarding, expending, and administering funding under the CSLFRF program in Illinois. As a result, each State agency is responsible for monitoring the subrecipients they award CSLFRF funding. As a pass-through entity of the CLSFRF program, IDHS was responsible for: • Identifying the awards and applicable requirements, • Evaluating each subrecipient’s risks of noncompliance for purposes of determining the appropriate monitoring procedures related to the subaward, • Monitoring the activities of each subrecipient as necessary to ensure the subaward is used for authorized purposes, the subrecipients comply with the terms and conditions of the subawards, and the subrecipients achieve performance goals, and • Issuing a management decision for audit findings pertaining to the federal award provided to each subrecipient, if applicable. IDHS requires CSLFRF subrecipients to provide periodic performance reports which contain performance measures and program accomplishments to permit IDHS to monitor CSLFRF program results. During our testing of documentation provided by IDHS for 28 CSLFRF grantees (with expenditures of $23,703,366), IDHS could not provide evidence periodic performance reports were obtained or reviewed during the audit period by IDHS for 26 of the subrecipients tested. Because the CSLFRF program funds a variety of State programs operated by various program areas and bureaus within IDHS, we noted a variety of report templates were received and methods were used to document reviews. Accordingly, we noted the date certain periodic performance reports were received and reviewed by IDHS could not be validated as they were documented electronically in a spreadsheet which can be modified. Amounts passed through by IDHS to CSLFRF subrecipients totaled $28,591,405 during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(c), a pass-through entity must evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. 2 CFR 200.332(e)(3) requires pass-through entities to issue management decisions for applicable audit findings pertaining to the federal awards provided to the subrecipient and 2 CFR 200.332(e)(4) requires pass through entities to resolve audit findings through corrective action plans (CAP). In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include performing monitoring procedures in accordance with Uniform Guidance and program requirements. Cause: In discussing these conditions with IDHS officials, management stated IDHS was unable to produce all requested Periodic Performance Reports (PPR) and evidence of review due to inconsistency in applied procedures, staffing changes, and the lack of a central repository. Possible Asserted Effect: Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Repeat Finding: 2024-004, 2023-018) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS implement subrecipient monitoring procedures in accordance with federal regulations. Views of IDHS Officials: The Department accepts the recommendation. IDHS recognizes the importance of performance monitoring and will implement additional controls to ensure evidence is maintained to support that PPRs are obtained from subrecipients and are appropriately reviewed by IDHS.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.558 ($583,126,272), 93.575/93.596 ($747,612,292), 93.667 ($55,634,435), 93.959 ($114,897,412) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Subrecipient Monitoring Finding 2024-007: Failure to Follow Established Program Subrecipient Monitoring Procedures Condition Found: IDHS did not follow its established program monitoring policies and procedures for subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care Development Fund Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. IDHS has implemented procedures whereby program staff perform periodic program on-site and desk reviews of IDHS subrecipient compliance with regulations applicable to the federal programs administered by IDHS. IDHS also has implemented procedures whereby staff perform periodic on-site and desk reviews of IDHS subrecipient compliance with fiscal and administrative requirements applicable to multiple State and federal programs. Generally, these reviews are formally documented and include the issuance of a report of the review results to the subrecipient summarizing the procedures performed, results of the procedures, and any findings or observations for improvement noted. IDHS’s policies require the subrecipient to respond to each finding by providing a written corrective action plan. Additionally, IDHS program staff perform reviews of expenditure reports submitted by subrecipients. IDHS subrecipient monitoring procedures are subject to the review and approval of a supervisor. During our test work over program on-site review procedures performed for 82 subrecipients of the TANF, CCDF, SSBG, and SAPT programs, we noted IDHS did not follow its established program monitoring procedures as follows: We tested the program on-site review procedures and fiscal administrative review procedures performed by IDHS during the year ended June 30, 2024 for a sample of subrecipients of the TANF, CCDF, SSBG, and SAPT programs comprised of the following: "See Table in the Audit Report" We noted the following exceptions in our testing of program on-site reviews performed during the year ended June 30, 2024: ● IDHS did not perform on-site monitoring reviews of subrecipients in fiscal year 2024 in accordance with IDHS’ planned monitoring schedule and/or could not provide support for the review. Specifically, we noted the following exceptions: "See Table in the Audit Report" ● IDHS did not provide timely notification (within 60 days) of the results of the programmatic on-site reviews. We noted the following exceptions: "See Table in the Audit Report" ● IDHS did not complete their quality review on a timely basis (within 60 days). We noted the following exceptions: "See Table in the Audit Report" ● IDHS did not receive a corrective action plan from the subrecipient after findings were identified during the review. We noted the following exceptions: "See Table in the Audit Report" During our testing of 31 fiscal and administrative reviews performed for subrecipients of all IDHS’ federal and State programs, we noted IDHS did not provide timely notification (within 180 days) of the results of the fiscal and administrative reviews. Specifically, we noted the delays in the reporting of results to two subrecipients tested ranged from 32 days to 50 days. IDHS could not provide documentation evidencing communication or follow up being performed for these subrecipients during the extended review period. In addition, we noted the SAPT program requires subrecipients to submit periodic reports to allow IDHS to monitor certain programmatic performance metrics. These reports are reviewed quarterly by IDHS program personnel. Any subrecipients who meet less than 80% of the performance metrics reported are also required to submit a corrective action plan to IDHS. During our testing, we noted IDHS was unable to provide documentation evidencing monitoring of the quarterly program reports for our sample of 25 subrecipients (with expenditures of $52,116,654 during the year ended June 30, 2024). Further, IDHS did not have adequate policies or procedures to ensure fiscal and administrative reviews were completed timely to detect potential non-compliance. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. According to 2 CFR 200.332(b), a pass-through entity must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring on-site program procedures and expenditure reviews are performed in a timely manner and adequate documentation is maintained. Cause: In discussing these conditions with IDHS officials, management stated that the deficiencies noted are due to a combination of factors including operational constraints due to staffing, oversight, system transitions, and a need to strengthen governance over timeliness, monitoring and documentation controls. Possible Asserted Effect: Failure to adequately perform and document program on-site monitoring reviews of subrecipients and notify subrecipients of findings in a timely manner may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Failure to properly review subrecipient expenditures may result in inaccurate payments or unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-010. (Finding Code 2024-007, 2023-010, 2022-008, 2021-017, 2020-015, 2019-013, 2018-012, 2017-013, 2016-012, 2015-011, 2014-008, 2013-009, 12-07, 11-09) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS ensure programmatic on-site and expenditure report reviews are performed and documented for subrecipients in accordance with established policies and procedures. In addition, we recommend IDHS review its process for reporting and following up on program findings relative to subrecipient on-site reviews to ensure timely corrective action is taken. Views of IDHS Officials: The Department accepts the recommendation. IDHS will work to ensure programmatic on-site and expenditure report reviews are completed and documented in accordance with policies and procedures and review its process for reporting and follow up on program findings resulting from on-site reviews. IDHS will continue to work to fill vacancies, administer training programs, increase oversight, develop automated processes, and revise procedures to improve internal controls over these functions.

State Agency: Illinois State Board of Education (ISBE) Federal Agency: U.S. Department of Education (USDE) Program Name: Twenty-First Century Community Learning Centers (21st Century) ALN and Program Expenditures: 84.287 ($61,131,992) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-025: Inadequate Monitoring of 21st Century Subrecipients Condition Found: ISBE did not adequately monitor and document program monitoring procedures performed over subrecipients of the 21st Century Community Learning Centers (21st Century) program. The 21st Century program operates to provide State educational agencies and local educational agencies (LEAs) with funding specific to rural and inner-city public schools. To monitor the 21st Century program activities performed by Illinois elementary and secondary schools, ISBE has established Tier I, Tier II, and Tier III monitoring activities which are applied to each subrecipient (LEA or school district) depending upon the annual risk score determined by ISBE. ISBE’s 21st Century program subrecipient monitoring manual outlines the risk assessment procedures to determine the tier of monitoring required, the methods used for tier determination, and documentation required for each tier of monitoring. Because the size and scope of each subrecipient can vary greatly, ISBE has further subdivided subrecipients into cohorts and sites (individual schools) for purposes of applying certain monitoring procedures. Tier I subrecipient monitoring procedures apply to all subrecipients, with no consideration of the risk assessment score they have received and consist of a twice-a-year call in which ISBE personnel discuss enrollment and registration statistics, progression towards goals specific to the district, and budgetary changes. A notification email is sent twice a year, alerting the subrecipient that a call is required to be scheduled. Once the call is scheduled, a call form detailing the responses to the discussion points is completed by ISBE personnel during the call to evidence the call was conducted and any matters for follow up. documentation provided by the subrecipient to address each portion of review. ISBE documents the completion of its desk review procedures with a letter to the subrecipient communicating any noncompliance and requesting corrective action, if applicable. Any required corrective action plans are reviewed and formally accepted by ISBE in a letter to the subrecipient. Tier III applies to specific subrecipient sites who receive a high-risk assessment score and consists of an on-site review including interviews with the project director and site coordinators, and observations of the academics and academic enrichment taking place at each site. ISBE personnel complete monitoring checklists to evidence the completion of its on-site procedures and a summary checklist is completed after the on-site visit to summarize all areas of noncompliance. A letter is sent to the subrecipient communicating the completion of the on-site review, any noncompliance, and requesting corrective action, if applicable. Any required corrective action plans are reviewed and formally accepted by ISBE in a letter to the subrecipient. During the year ended June 30, 2024, ISBE identified 33 Tier III high-risk subrecipients (with expenditures totaling $36,676,176) which included 47 total subrecipient sites required to have on-site reviews performed. During our testing of seven high risk subrecipient sites selected for testing (related to seven subrecipients with expenditures totaling $15,207,297), we noted ISBE was unable to provide documentation evidencing on-site reviews were performed for five of the subrecipient sites samples. We also noted documentation was not available to evidence the reviews of the other two subrecipient sites sampled were completed as ISBE could not locate documentation of the procedures performed, conclusions reached, or communication of the review results to the subrecipient sites. In addition, we noted ISBE’s internal controls over subrecipient on-site monitoring are not designed at an appropriate level of precision to ensure monitoring of subrecipients is completed, documented, and retained as required by ISBE policies and procedures. ISBE passed through approximately $59,630,722 to 78 subrecipients of the 21st Century program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. According to 2 CFR200.332(b), a pass-through entity must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing supervisory procedures at an appropriate level of precision to ensure adequate monitoring is performed and documentation is maintained. Cause: In discussing these conditions with ISBE officials, they stated the inability to provide required documentation is attributable to staff turnover as those responsible for these monitoring activities have since left ISBE. Possible Asserted Effect: Failure to perform required monitoring procedures and maintain documentation may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and grant agreements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-045. (Finding Code 2024-025, 2023-045) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation:We recommend ISBE establish policies and procedures to ensure programmatic monitoring is performed and appropriately documented. Views of ISBE Officials: Management agrees with the finding and has developed processes and structures to correct it.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: Highway Planning and Construction (HPC) Program ALN and Program Expenditures: 20.205 ($2,192,857,212) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-041: Failure to Communicate Award Information to Subrecipients Condition Found: IDOT did not follow its established policies and procedures for monitoring subrecipients of the Highway Planning and Construction program. During our testwork of the award communications for our sample of subrecipients, we selected the contracts under which funds were disbursed during fiscal year 2024 to review for compliance with federal award communication requirements. During our review of the award communication files for a sample of 30 awards (related to subrecipient expenditures of $46,016,588), we noted the following information was not communicated in the subrecipient award agreement for three subrecipients sampled (with payments totaling $742,559): • Federal Award Identification Number (FAIN) • Assistance Listing Number (ALN) • Subaward Period of Performance Start and End Date • Subrecipient’s Unique Entity Identifier Amounts passed through to subrecipients under the Highway Planning and Construction program totaled $94,970,638 during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(a), a pass-through entity is required to identify Federal awards made to the subrecipient by informing each subrecipient of required information. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include controls to ensure required information is properly communicated. Cause: In discussing these conditions with IDOT officials, they stated there are two separate causes for this finding. For two of the agreements, the FAIN and ALN were overlooked when drafting the agreement. In these instances, it was employee oversight. For the final agreement noted, elements were missing from the template at that time, and IDOT was unaware of any requirements to have the CFDA# (ALN), DUNS number (UEI), or single audit included in the agreement as it was executed in 2002. Possible Asserted Effect: Failure to communicate required award information may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-041) Recommendation: We recommend IDOT implement additional procedures to ensure award information communicated to subrecipients is reviewed for completeness and accuracy. Views of IDOT Officials: IDOT agrees with the finding.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-042: Failure to Adequately Monitor Subrecipients Condition Found: ICJIA did not follow its established program monitoring policies and procedures for subrecipients of the Crime Victim Assistance (CVA) program during fiscal year 2024. ICJIA selects subrecipients of the CVA program to perform programmatic monitoring procedures using a risk-based approach. Among other things, ICJIA has identified subrecipients receiving CVA funding under shorter term programs (12 months or less in duration) as higher risk and requires an on-site review to be performed once during the period of performance. Additionally, longer term programs (12 to 36 months in duration) require an on-site review in the first twelve months of the period of performance and a second on-site review during the remaining period of performance. In scheduling the timing of its on-site reviews, ICJIA considers whether there are any additional subrecipient specific risk factors that warrant an earlier review time. Based upon ICJIA’s monitoring criteria, we noted ICJIA should have conducted site visits for 51 subrecipients (with expenditures totaling $26,561,276) from longer term programs during the year ended June 30, 2024. During our review of the subrecipient site visits conducted during State fiscal year 2024, we noted 14 of the 51 subrecipients from longer term programs (with expenditures of $4,215,392 during the year ended June 30, 2024) were not subjected to site visits. Additionally, we noted three of the 51 reviews required to be performed during the year ended June 30, 2024 were not performed within the required time period. Specifically, we noted reviews for three subrecipients (with expenditures of $659,442) were performed 19 to 21 days late. ICJIA passed through $50,412,108 to subrecipients of the CVA program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. ICJIA’s Site Visits policy requires Grant Specialists to conduct two site visits within thirty-six months of the start of a grant with the first site visit taking place within the first twelve months, unless the grantee’s Program Risk Assessment requires that a site visit be completed within a shorter time period. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring on-site program monitoring procedures are performed in a timely manner. Cause: In discussing these conditions with ICJIA officials, they stated due to staffing shortages within the federal and state grants unit, all of the required visits were not completed. Possible Asserted Effect: Failure to adequately perform on-site monitoring reviews of subrecipients may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-033. (Finding Code 2024-042, 2023-033) Recommendation: We recommend ICJIA ensure programmatic on-site reviews are performed and documented for subrecipients in accordance with established policies and procedures. Views of ICJIA Officials: ICJIA acknowledges that these gaps in documentation and consistency contributed to the finding and has taken corrective actions to strengthen monitoring procedures, enhance documentation standards, and ensure timely follow-up with subrecipients.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-043: Inadequate Review of Subrecipient Single Audit Reports Condition Found: ICJIA did not adequately review single audit reports received from its subrecipients for the Crime Victim Assistance Program (CVA) program on a timely basis. The State of Illinois established the Grant Accountability and Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal and State programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State. As a State agency, ICJIA is responsible for reviewing the reports assigned to them by GATU and determining whether Federal funds reported in the consolidated year-end financial report (CYEFR) reconcile to ICJIA records. Additionally, as the cognizant State agency, ICJIA is responsible for issuing management decisions on findings reported and applying sanctions to subrecipients who do not comply with reporting requirements (i.e. stop pay process). During our testing of a sample of single audit desk review files for 14 subrecipients (with expenditures of $37,884,972 in the fiscal year), we noted the following: • For five subrecipients (with expenditures totaling $19,501,158), ICJIA did not issue a management decision letter in a timely manner. The delays in issuing management decision letters ranged from 61 to 128 days beyond the required timeframe. • For 11 subrecipients (with expenditures totaling $24,680,412), ICJIA did not reconcile the CYEFR to ICJIA’s records as required. As of the date we communicated our findings to ICJIA (January 27, 2026), ICJIA had still not reconciled the CYEFR to ICJIA’s records for 10 subrecipients (with expenditures totaling $24,097,663). • For one subrecipient (with expenditures of $295,572), the subrecipient single audit reporting package was not submitted within the required timeframe, and ICJIA did not follow up with the subrecipient or invoke the stop pay process. ICJIA has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure single audit reporting requirements, including obtaining and reviewing single audit reporting packages, issuing management decision letters, reconciling CYEFRs to agency records, and invoking stop payment actions, are performed within required timeframes. ICJIA passed through $50,412,108 to subrecipients of the CVA program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statues, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(e)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure Single Audit reports are reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with ICJIA officials, they stated this GATA responsibility has not been performed as consistently as other responsibilities due to competing priorities and staff shortages. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-034. (Finding Code 2024-043, 2023-034) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Additionally, ICJIA should implement procedures to ensure timely reconciliation of funds, issuance of management decision letters, and initiation of the stop pay process. Views of ICJIA Officials: ICJIA agrees with the finding and the cause. Staffing continues to be a priority for resolving the single audit review process.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-044: Inadequate Fiscal Monitoring of Subrecipients Condition Found: ICJIA did not follow its established policies and procedures for monitoring subrecipients of the Crime Victim Assistance (CVA) program. ICJIA selects subrecipients of the CVA program over which to perform fiscal monitoring procedures using a risk-based approach. Specifically, a risk assessment is performed annually over the subrecipient, which includes calculating a risk score based upon criteria established by ICJIA. ICJIA’s risk assessment criteria include the total award amount, the subgrantee’s experience with ICJIA grant awards, results of financial monitoring, the percentage of grant expended to date, the quality of financial submissions, the timeliness of financial submissions, and the payment type. Based upon the risk score, each subrecipient is designated as needing high, moderate, or low oversight. The oversight category assigned determines the frequency and type of financial monitoring (i.e. desk review or fiscal audit). During our audit procedures, we noted three CVA subrecipients (with expenditures of $582,277) were designated for high oversight and did not have a fiscal audit performed over their CVA program grants. Agency personnel indicated additional risk assessment criteria were considered to reduce the number of high oversight subrecipients; however, these additional criteria are not documented in the fiscal monitoring policy or risk score documentation. ICJIA passed through approximately $50,412,108 to subrecipients of the CVA program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity must evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. 2 CFR 200.332(e)(3) requires pass-through entities to issue management decisions for applicable audit findings pertaining to the federal awards provided to the subrecipient and 2 CFR 200.332(e)(4) requires pass through entities to resolve audit findings through corrective action plans (CAP). In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing and performing monitoring procedures in accordance with Uniform Guidance and program requirements. Cause: In discussing these conditions with ICJIA officials, they stated ICJIA utilizes both a formal, documented policy to determine a risk score for over 600 active grantees and a more subjective, unwritten assessment to determine which higher and medium risk grantees actually will be scheduled to receive active fiscal monitoring procedures. The subjective analysis is used by ICJIA to adjust the potential volume of monitoring effort to the anticipated number of resources available in a given period. Due to the scarcity of resources, the agency prioritized reviews for subrecipients of other ICJIA programs. Possible Asserted Effect: Failure to fully document required risk assessments and to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-035. (Finding Code 2024-044, 2023-035) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review their fiscal subrecipient monitoring procedures and implement additional procedures as necessary to ensure proper monitoring procedures are performed and documentation of monitoring activities are adequately maintained. Views of ICJIA Officials: ICJIA agrees with the findings as we have additional risk assessment criteria that are established but not documented.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($68,210,944) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-049: Inadequate Review of Subrecipient Single Audit Reports Condition Found: IDOA did not adequately document review of single audit reports received from its subrecipients for the Aging Cluster program on a timely basis. The State of Illinois established the Grant Accountability and Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal and State programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning to the applicable state agency any findings attributable to amounts passed through to the subrecipient(s) by the State. IDOA staff are responsible for reviewing the reports assigned to them by GATU and determining whether: (1) federal funds reported in the schedule of expenditures of federal awards reconcile to IDOA records; (2) issuing management decisions on findings reported within required timeframes; and (3) applying sanctions to subrecipients who do not comply with reporting requirements (i.e. stop pay process). During our testing of a sample of single audit desk review files for seven subrecipients (with expenditures of $40,522,841 in the fiscal year), we noted the following: • For five subrecipients (with expenditures totaling $23,626,549), IDOA did not issue a management decision letter. • For one subrecipient (with expenditures totaling $2,117,589), IDOA did not issue a management decision letter over the subrecipient’s single audit that was received during state fiscal year 2024. In addition, the subrecipient did not file a single audit for the prior year with the Federal Audit Clearinghouse. While IDOA received a copy of the unfiled single audit report, a review was not performed and funding was not suspended in accordance with the State’s established policies. IDOA has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure single audit reporting requirements, including obtaining and reviewing single audit reporting packages, issuing management decision letters, and invoking stop payment actions are performed within required timeframes. IDOA passed through $66,724,826 to subrecipients of the Aging Cluster program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statues, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal award audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure Single Audit reports are reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with IDOA officials, they stated competing priorities and limited resources have impacted the Department’s ability to comply with this requirement. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Additionally, failure to issue management decision letters within six months of acceptance of the single audit report by the FAC results in noncompliance with federal regulations. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-049) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOA establish procedures to ensure (1) subrecipient single audit report reviewed within established deadlines, (2) management decision letters are issued for all findings affecting its federal programs in accordance with the Uniform Guidance, and (3) follow up procedures are performed to ensure subrecipients have taken timely and appropriate corrective action. Views of IDOA Officials: The Department agrees with this finding. Although the Department shows that all the Area Agency on Aging single audits were received in the audit report review management system (ARRMS), there is one pending approval by the Audit Clearinghouse. The Department did not get the audits reconciled during state fiscal year 2024. The Department did not issue any management decision letters for those audits.

Criteria Under 2 CFR 200.332(b), pass-through entities must provide specific information to subrecipients at the time of subaward, including at minimum the Assistance Listing number and title, Federal Award Identification, Subaward Period of Performance, Total amount of Federal funds, name of Federal agency, indirect cost rate, and all applicable Federal statutes, regulations, and the terms and conditions of the Federal award, among other elements. Condition The auditee, acting as a pass-through entity, did not inform subrecipients of the required information at the time of subaward. Cause The entity did not have sufficient controls in place to ensure that all required information under Uniform Guidance were communicated to subrecipients at the time of the award. Effect Subrecipients may be unaware of key Federal requirements, which can increase the risk of noncompliance with allowable costs, reporting, and audit requirements. Questioned Costs No questioned costs. Recommendation We recommend the entity implement a process to perform subrecipient vs. contractor determinations for organizations it engages with using federal funding, and ensure the appropriate language required by Uniform Guidance is included in the agreement. Context/Sampling During the audit, we examined agreements with two other entities that the auditee contracted with to perform program activities.

The Arizona Department of Education’s Health and Nutrition Services Division (Division) did not perform all required monitoring procedures, resulting in an increased risk that $63.9 million of program monies the Division awarded to subrecipients during fiscal year 2024 may not be spent in accordance with the award terms, program requirements, and federal regulations Assistance Listings number(s) and name(s): 10.558 Child and Adult Care Food Program Award number(s) and year(s): 237237AZ300AZ3 October 1, 2022 through September 30, 2023 247AZ300AZ3 October 1, 2023 through September 30, 2024 Federal agency: U.S. Department of Agriculture Compliance requirement(s): Subrecipient Monitoring Questioned costs: None Condition The Division awarded $63.9 million to 322 subrecipients during fiscal year 2024, or 99.3% of the Division’s total program expenditures, but did not perform all the required monitoring of its subrecipients’ activities. While the Division did conduct on-site monitoring visits of subrecipients in accordance with its risk-assessment plan, it did not always obtain and review the responses to its written questionnaires from its subrecipients. For example, for 30 of the 40 subrecipients we tested, the Division did not review the submitted monitoring questionnaires to verify the accuracy of responses. Additionally, 10 of the 40 subrecipients we tested did not respond to the Division’s monitoring questionnaire at all, and the Division never followed up with these subrecipients. These questionnaires are designed to capture essential information from each subrecipient, including confirmation of total federal expenditures from all sources in addition to the program and whether the subrecipient is required to have a single audit performed. As a result, the Division did not determine whether required single audits were performed or, if applicable, whether the subrecipients took timely and appropriate action on all deficiencies noted. Effect The Division’s not verifying subrecipient single audits were conducted may result in the Division’s not following up on and ensuring corrective action is taken on audit findings that could potentially affect the program and/or issue management decisions for audit findings pertaining to the federal award. Further, there is an increased risk that $63.9 million of program monies the Division awarded to subrecipients may not be spent in accordance with the award terms, program requirements, and federal regulations. If monies are spent inconsistent with program requirements, those who intended to benefit from the program may not receive all the services or other benefits they otherwise would have received. Finally, the Arizona Department of Education is at risk that this finding applies to other federal programs it administers. Cause The Division’s written policies and procedures lacked requirements to obtain, review, verify, and analyze the subrecipient-monitoring questionnaires to confirm that those subrecipients required to obtain a single audit had a single audit completed, or to review those single audit reports for findings related to the program and issue management decisions when applicable. Criteria Federal regulation requires the Division to monitor subrecipients, which includes (2 CFR §200.332[e-f]): X Verifying single audits were conducted timely. X Following up on and ensuring corrective action is taken on audit findings that could potentially affect the program. X Issuing a management decision for audit findings pertaining to the federal award. Further, federal regulation requires establishing and maintaining effective internal control over federal awards that provides reasonable assurance that the federal program is being managed in compliance with applicable laws, regulations, and terms of the award (2 CFR §200.303). Recommendations to the Division 1. Perform all required monitoring of its subrecipients, including reviewing completed questionnaires submitted by its subrecipients to ensure they are complying with single audit requirements. If a single audit was completed for a subrecipient, ensure corrective action is taken on audit findings that could affect the program, and issue management decisions, as applicable. 2. Update and implement written policies and procedures that require the Division to obtain all subrecipient-monitoring questionnaires, document its review of each subrecipient’s submitted questionnaire, follow up on and ensure corrective action is taken on audit findings that could potentially affect the program, and issue management decisions pertaining to the federal award. 3. Train personnel responsible for reviewing monitoring questionnaires on the updated policies and procedures. Views of responsible officials State management concurs with this finding. The State’s corrective action plan at the end of this report includes the views and planned corrective action of its responsible officials regarding these recommendations. We are not required to audit and have not audited these responses and planned corrective actions and therefore provide no assurances as to their accuracy.

The Arizona Office of Economic Opportunity did not ensure conference meals, graphic design services, and promotional item costs were appropriate, necessary, and managed to minimize charges and may be required to return $90,015 of WIOA Cluster funds Cluster name(s): WIOA Cluster Assistance Listings number(s) and name(s): 17.258 WIOA Adult Program 17.259 WIOA Youth Activities 17.278 WIOA Dislocated Worker Formula Grants Award number(s) and year(s): AA-34755-20-55-A-4 April 1, 2020 to June 30, 2023 AA-36307-21-55-A-4 April 1, 2021 to June 30, 2024 AA-38516-22-55-A-4 April 1, 2022 to June 30, 2025 23A55AW000049-01-00 July 1, 2023 to June 30, 2026 Federal agency: U.S. Department of Labor Compliance requirement(s): Not applicable Questioned costs: $90,015 Condition Contrary to federal regulations and the Department of Economic Security’s (DES) policy, the Arizona Office of Economic Opportunity (Office) paid for meals and promotional items provided to conference participants using WIOA Dislocated Worker Formula Grants federal program (WIOA federal program) funds without ensuring that the costs were appropriate, necessary, and managed to minimize charges to the federal award. Specifically, the Office hosted a 2-day Workforce Summit (Summit) conference in June 2024 and spent: X $61,038 on meals for 300 attendees over 2 days for lunch buffets, snacks, and beverages with an average attendee cost of $102 per person per day. X $25,302 for graphic design services without documenting how the services benefited the Summit. Office management reported the services were used to develop Summit communications and materials. X $3,675 on other promotional items, including pens, notebooks, lanyards, clips, vinyl pouches, and flyers, without maintaining evidence, such as photos, that the items displayed the required branding or funding tagline required by DES policies. The Office spent $5,066,045—including the questioned costs of $90,015—or nearly 5% of the State’s total $104,973,072 WIOA Cluster expenditures for the year ended June 30, 2024. We did not audit the WIOA Cluster for fiscal year 2024 because the Cluster did not meet the major federal program criteria. However, during fieldwork for the performance audit and sunset review of the Office, our contract auditors identified the above $90,015 unallowable costs charged to the WIOA federal program. Effect The Office’s paying for Summit costs without ensuring that they were appropriate, necessary, and managed to minimize charges to the federal award increased the risk that those who were intended to benefit from the program may not receive all the benefits they otherwise would have received. Consequently, the Office and/or DES may be required to return monies to the federal agency in accordance with federal requirements.1 Cause Office staff responsible for reviewing and approving Summit expenditures lacked sufficient guidance to identify unallowable costs because the Office lacked documented procedures, including a standardized review process, to ensure that costs charged to the WIOA federal program were allowable. DES passed WIOA federal program funds to the Office through an interagency service agreement (ISA) subaward but did not include conference-specific requirements imposed by federal regulations or additional requirements that DES imposed regarding promotional materials. Further, DES monitors the Office’s WIOA federal program expenditures during an annual desk review that takes place in May or June following the end of the prior fiscal year. DES management reported DES did not review any 2024 Summit costs since they will be subject to review during the May 2026 desk review. The review was scheduled almost 2 years after the unallowable costs were incurred because they were included in the Office’s July 2024 reimbursement request, which fell at the beginning of fiscal year 2025. Criteria Federal regulations and the Department’s Notice of Award for the WIOA federal program require the Office to sponsor conferences primarily to disseminate technical information. Further, the Office must exercise discretion and judgment in ensuring that conference costs are appropriate, necessary, and managed to minimize charges to the federal award. Allowable costs may include facility rental, speakers’ fees, registration fees, meals and refreshments, and other incidental expenses, unless further restricted by the terms and conditions of the federal award (2 CFR §200.432). 1 Federal Uniform Guidance requires federal awarding agencies to follow up on audit findings and issue a management decision to ensure the recipient takes appropriate and timely corrective action (2 CFR §200.513[c]). Further, it requires that federal awarding agencies’ management decisions clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action, as directed by the federal awarding agencies (2 CFR §200.521). In addition, DES’ policy requires that all promotional material must include a specific funding source tagline and the State brand.2 Further, federal regulations require DES to: X Evaluate the Office’s fraud risk and risk of noncompliance with its ISA subaward to determine the appropriate subrecipient monitoring procedures (2 CFR §200.332[c]). X Ensure its subaward with the Office includes all requirements imposed by federal statutes, regulations, and the terms and conditions of the federal award and any additional requirements that DES imposes on the Office to meet its responsibilities under the federal award (2 CFR §200.332[b][2] and [3]). Finally, federal regulations require establishing and maintaining effective internal control over federal awards that provides reasonable assurance that federal programs are being managed in compliance with all applicable laws, regulations, and award terms (2 CFR §200.303). Recommendations to the Office 1. Ensure Summit costs charged to the WIOA federal program are appropriate, necessary, and managed to minimize charges to the federal award. 2. Develop and implement written procedures, including a standardized review process, to ensure that costs charged to the WIOA federal program are allowable prior to requesting reimbursement from DES. 3. Work with federal grantor and/or DES to resolve the $90,015 of questioned costs associated with the 2024 Summit and any subsequently held Summits. Recommendations to DES 4. Amend its ISA subaward with the Office to include conference-specific requirements imposed by federal regulations and additional requirements that DES imposed regarding promotional materials. 5. Adjust its monitoring procedures over the Office’s activities, which may include more frequent desk reviews of reimbursed costs, based on DES’ evaluation of the Office’s risk of noncompliance with federal regulations and DES’ notice of award for the WIOA federal program. 6. Provide Office staff responsible for reviewing and approving Summit expenditures with training and technical assistance on conference-related requirements. 2 Arizona Department of Economic Security. (2023). Workforce Innovation and Opportunity Act Policy Manual Title I-B, Chapter 3, Section 102.01 (C). Retrieved 4/8/2026 from https://des.az.gov/sites/default/files/media/Allowable-Costs-Fiscal-Policy-Section-100.pdf?time=1775665811357 Views of responsible officials State management concurs with this finding. The State’s corrective action plan at the end of this report includes the views and planned corrective action of its responsible officials regarding these recommendations. We are not required to audit and have not audited these responses and planned corrective actions and therefore provide no assurances as to their accuracy.

The Department of Economic Security failed to perform required subrecipient monitoring, increasing the risk that $9.3 million may have been spent inconsistent with program requirements Assistance Listings number(s) and name(s): 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Award number(s) and year(s): None Federal agency: U.S. Department of the Treasury Compliance requirement(s): Subrecipient monitoring Questioned costs: Unknown Condition The Department of Economic Security (DES) awarded $9.3 million to 13 subrecipients during fiscal year 2024, or 16.3% of DES’ $56.9 million of total federal expenditures for this federal program, but failed to include required information in its subawards to subrecipients and perform required monitoring. Specifically, DES: X Did not include information required by federal regulations in its subawards to subrecipients for 4 of 4 subrecipients tested. This included missing federal award identification information and any additional requirements DES imposed on the subrecipients to meet its responsibilities under the federal award. X Did not perform the required monitoring of the subrecipients’ activities or compliance with the award terms and program requirements for all 13 subrecipients. Effect DES’ failure to include required information in its subawards to subrecipients and perform required monitoring increased the risk that the $9.3 million of program monies DES awarded to subrecipients may not have been spent in accordance with the award terms and program or contract requirements. If monies were spent inconsistent with program and contract requirements, those intended to benefit from the program may not receive all the services or other benefits they otherwise would have received. Cause DES lacked entity-wide subrecipient-monitoring policies and procedures for its divisions to follow and instead relied on each division to design and implement its own subrecipient-monitoring procedures. However, the Child and Community Services Division (CCSD) personnel responsible for notifying and monitoring subrecipients reported they were either not aware of the subrecipient-monitoring requirements or did not follow its subrecipient-monitoring policies and procedures, as follows: X The CCSD personnel responsible for monitoring 6 subrecipients reported that they were not aware of the program’s subrecipient-monitoring requirements because of the program manager being on extended leave, turnover in staff knowledgeable of these requirements, and lack of established policies and procedures over monitoring the program’s subrecipients’ activities. Further, neither DES nor the CCSD personnel responsible for identifying subrecipients provided guidance to CCSD personnel responsible for subrecipient monitoring. X The CCSD personnel responsible for monitoring 7 subrecipients reported that they did not follow CCSD’s procedures for monitoring the program’s subrecipients’ activities because they were short staffed and prioritized monitoring other federal and State grants’ subrecipients’ activities. Criteria Federal regulation requires DES to ensure that every subaward is clearly identified to the subrecipient as a subaward by including in its award terms with subrecipients information necessary for the subrecipient to administer the program in accordance with federal requirements. Required information includes federal award identification, all requirements of the subaward, any additional requirements DES imposes on the subrecipient for DES to meet its responsibilities under the federal award, indirect cost rate, and audit and closeout requirements. Further, federal regulation requires DES to monitor subrecipients, which includes required monitoring procedures for (2 CFR §200.332): X Assessing the risk of each subrecipient’s noncompliance and performing monitoring activities based on those risk assessments, such as providing training or technical assistance on program-related matters and performing on-site reviews, selective audits, and/or other monitoring procedures. X Reviewing financial and performance reports. X Verifying single audits were conducted timely. X Following up on and ensuring corrective action is taken on audit findings that could potentially affect the program. X Issuing a management decision for audit findings pertaining to the federal award. Finally, federal regulation requires establishing and maintaining effective internal control over federal awards that provides reasonable assurance that the federal program is being managed in compliance with all applicable laws, regulations, and award terms (2 CFR §200.303). Recommendations to DES 1. Include information required by federal regulations in its subawards to subrecipients, including federal award identification information and any additional requirements DES imposed on the subrecipients to meet its responsibilities under the federal award. 2. Perform required monitoring of its subrecipients and their compliance with the award terms and program requirements. Develop, implement, and train all divisions on entity-wide written subrecipient-monitoring policies and procedures requiring all divisions to: 3. Ensure that every subaward is clearly identified to the subrecipient as a subaward by including in its award terms with subrecipients information necessary for the subrecipient to administer the program in accordance with federal requirements. Required information includes federal award identification, all requirements of the subaward, any additional requirements the DES imposes on the subrecipient for the DES to meet its responsibilities under the federal award, indirect cost rate, and audit and closeout requirements. 4. Assess the risk of each subrecipient’s noncompliance and carry out monitoring activities based on those risk assessments such as providing training or technical assistance on program-related matters, and performing on-site reviews, selective audits, and/or other monitoring procedures. 5. Review financial and performance reports. 6. Verify subrecipients receive timely single audits, if required; follow up on and ensure that corrective action is taken on any audit findings that could potentially affect the program; and issue management decisions for any audit findings pertaining to the federal award. 7. Maintain documentation of monitoring procedures demonstrating they were performed, including the monitoring procedures’ results and any DES actions taken, if appropriate. 8. Allocate sufficient resources, such as staffing, to comply with the award terms and program requirements, and designate individuals within each division to perform necessary subrecipient-monitoring procedures. This finding is similar to prior-year finding 2023-106 and was initially reported in fiscal year 2023. Views of responsible officials State management concurs with this finding. The State’s corrective action plan at the end of this report includes the views and planned corrective action of its responsible officials regarding these recommendations. We are not required to audit and have not audited these responses and planned corrective actions and therefore provide no assurances as to their accuracy.

Four State agencies did not perform required subrecipient monitoring procedures, increasing the risk that program monies may have been misused and not spent in accordance with the award terms Assistance Listings number(s) and name(s): 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery (SLFRF) Funds Award number(s) and year(s): None Federal agency: U.S. Department of the Treasury Compliance requirement(s): Subrecipient monitoring Questioned costs: $1,623,846 Condition Contrary to federal regulation, the Arizona Department of Housing (ADOH), Arizona Department of Water Resources (ADWR), Arizona Office of Tourism (AOT), and Industrial Commission of Arizona (ICA) did not perform the required monitoring of their subrecipients’ activities or compliance with the award terms and program requirements. Specifically, we found that 4 of 10 State agencies we tested did not perform the various and required monitoring procedures identified in Table 1 below and Tables 2 through 4, page 129. In addition, as of the report date, April 23, 2026, the Governor’s Office of Strategic Planning and Budgeting (OSPB) took appropriate action by identifying and self-reporting to us $1,623,846 of expenditures for 8 SLFRF program subrecipients, who were awarded monies prior to fiscal year 2024, and may not have spent the monies in accordance with program requirements.1 Specifically, based on our fiscal year 2023 audit recommendations in finding 2023-102, OSPB performed missing risk assessments for subrecipients awarded monies during fiscal years 2022 and 2023. As a result of these assessments, OSPB conducted additional onsite monitoring or desk reviews based on those results and identified $1,623,846 in questionable costs by its subrecipients. Additionally, OSPB identified several of these questioned costs as potentially fraudulent or inappropriate and forwarded this information to the Attorney General’s Office for further review. We selected OSPB as part of the 10 State agencies tested during fiscal year 2024. Of 24 OSPB subrecipients we tested, we did not identify any deficiencies with OSPB performing the required monitoring of their subrecipients’ activities or compliance with the award terms and program requirement during fiscal year 2024. In total during fiscal year 2024, there were 14 State agencies that paid $270.2 million to subrecipients, as shown in Table 5 below, or 56.2% of the State’s $480.4 million total federal expenditures for this program. Effect The 4 State agencies’ lack of required monitoring increased the risk that the $41.4 million of program monies they paid to 131 subrecipients may have been misused and not spent in accordance with the award terms and program requirements as shown in Table 5, page 130. If monies are spent inconsistent with program requirements, those who were intended to benefit from the program may not receive all the services or other benefits they otherwise would have received. ADOH, ADWR, AOT, and ICA are at risk that this finding applies to other federal programs they administer. Further, OSPB’s previously identified expenses that may not have been spent in accordance with program requirements may result in OSPB being required to return up to $1,623,846 of program monies to the federal agency in accordance with Uniform Guidance requirements.2 Cause Despite subrecipient monitoring requirements being included in the federal regulations, 4 State agencies did not develop and/or implement sufficient subrecipient monitoring policies and procedures to comply with federal regulations. Specifically, X ADOH’s management reported that its policies and procedures did not contain clear criteria for when single audits should be obtained and the process for conducting risk assessments. X ADWR’s management reported that it lacked policies and procedures for obtaining single audits and conducting risk assessments. X AOT’s management reported that it performed only limited monitoring procedures for subrecipients who expended more than $750,000 of AOT awards during the year. Additionally, AOT’s management reported that it misunderstood the detailed transactions required to substantiate the $50,214 in payroll expenditures. X ICA’s management reported that there was a misunderstanding on which State agency was responsible for performing the subrecipient monitoring of the monies it passed through to subrecipients and consequently did not develop all the necessary subrecipient monitoring policies and procedures. Further, OSPB previously reported that it hired additional staff in fiscal year 2023 to begin addressing audit finding issues noted in prior years and began performing required risk assessments in fiscal year 2024. 2 Federal Uniform Guidance requires federal awarding agencies to follow up on audit findings and issue a management decision to ensure the recipient, OSPB, takes appropriate and timely corrective action (2 CFR §200.513[c]). Further, it requires that federal awarding agencies’ management decisions clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take action, as directed by the federal awarding agencies (2 CFR §200.521). Criteria Federal regulation requires State agencies to monitor subrecipients, which includes required monitoring procedures, as follows (2 CFR §200.332): X Assess the risk of each subrecipient’s noncompliance and perform monitoring activities based on those risk assessments. Based on risk, additional monitoring procedures could include providing training or technical assistance on program-related matters, performing site visits, and/or other monitoring procedures. X Review financial and performance reports. X Verify single audits were conducted timely; following up on and ensuring corrective action is taken on audit findings that could potentially affect the program; and issuing a management decision for audit findings pertaining to the federal award. X Include required information in subrecipient subaward agreements, including required federal award information; requirements imposed by federal statutes, regulations, and the terms and conditions of the federal award; any additional requirements that the pass-through entity imposes, and a requirement that the subrecipient permit the pass-through entity to access the subrecipient’s records and financial statements to fulfill its monitoring requirements. In addition, the State’s subrecipient monitoring policies and procedures require State agencies to consider and assess risk of each subrecipient and carry out required and various other monitoring procedures based on those risk assessments.3 Finally, federal regulation requires establishing and maintaining effective internal control over federal awards that provides reasonable assurance that federal programs are being managed in compliance with all applicable laws, regulations, and award terms (2 CFR §200.303). Recommendations to ADOH, ADWR, AOT, and ICA Work with the State’s Office of Strategic Planning and Budgeting to either update or develop and implement policies and procedures and train responsible staff to perform required monitoring of their subrecipients to ensure compliance with award terms and program requirements, including procedures to: 1. Assess the risk of each subrecipient’s noncompliance and perform additional monitoring procedures based on those risk assessments such as reviewing financial and performance reports, providing training or technical assistance on program-related matters, performing site visits, and/or other monitoring procedures. (ADOH, ADWR, and ICA) 2. Verify subrecipients receive timely single audits, follow up on and ensure that corrective action is taken on audit findings that could potentially affect the program, and issue management decisions for audit findings pertaining to the federal award. (ADOH, ADWR, AOT, and ICA) 3 Arizona Department of Administration Office of Grants and Federal Resources. (2018). Grants Management Manual – Grantor, Chapter 8: Award Monitoring. Retrieved 10/29/2025 from https://ospb.az.gov/sites/default/files/2026-01/Arizona%20Grants%20Management%20 Grantor%20Manual%20Edition%202022.pdf 3. Request and view supporting transaction details prior to paying subrecipients for payroll costs to verify they meet the requirements of the award terms and program requirements. (AOT) 4. Establish subaward agreements with subrecipients communicating allowable uses of program monies and other information required by federal regulations prior to distributing program monies. (ICA) Recommendations to OSPB 5. Work with the federal agency and the subrecipients to resolve the $1,623,846 of program monies that may have been spent in violation of its federal award terms and that may need to be returned to the federal agency. 6. Continue to assess the risk of each subrecipient’s noncompliance and perform additional monitoring procedures based on those risk assessments such as reviewing financial and performance reports, providing training or technical assistance on program-related matters, performing site visits, and/or other monitoring procedures to ensure questioned costs are timely identified and remedied. This finding is similar to prior-year finding 2023-102 and was initially reported in fiscal year 2022. Views of responsible officials State management concurs with this finding. The State’s corrective action plan at the end of this report includes the views and planned corrective action of its responsible officials regarding these recommendations. We are not required to audit and have not audited these responses and planned corrective actions and therefore provide no assurances as to their accuracy.

The Arizona Department of Education did not monitor procedures of charter schools with relationships with charter management organizations, risking funds not being spent in accordance with the award terms and program requirements, and reduced future awards Assistance Listings number(s) and name(s): 84.010 Title I Grants to Local Educational Agencies 84.367 Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants)* *referred to as Title II Award number(s) and year(s): S010A200003 July 1, 2020 through September 30, 2023 S010A210003 July 1, 2021 through September 30, 2023 S010A220003 July 1, 2022 through September 30, 2023 S010A230003 July 1, 2023 through September 30, 2024 S367A210049 July 1, 2021 through September 30, 2023 S367A220049 July 1, 2022 through September 30, 2023 S367A230049 July 1, 2023 through September 30, 2024 Federal agency: U.S. Department of Education Compliance requirement(s): Special tests and provisions Questioned costs: Unknown Condition The Arizona Department of Education’s Grants Management Department (Department) disbursed over $59 million and over $6.8 million in Title I and Title II funds, respectively, to 242 Title I and 233 Title II charter school local educational agencies (LEAs) during fiscal year 2024 but did not perform certain monitoring procedures required by the U.S. Department of Education. Specifically, the Department did not identify which of the 242 Title I and 233 Title II charter school LEAs receiving federal grant monies had relationships with charter management organizations (CMOs) in order to perform additional required monitoring to assess the additional risk posed by conflicts of interest, related-party transactions, or insufficient segregation of duties at these charter schools.1 1 The term “charter management organization” means a nonprofit organization that operates or manages a network of charter schools linked by centralized support, operations, and oversight (20 USC 7221i[3]). Retrieved 11/11/2025 from https://www.law.cornell.edu/uscode/ text/20/7221i#2 Effect The Department’s not identifying or performing additional monitoring of charter schools with relationships with CMOs increases the risk that funds allocated to these charter school LEAs may not have been spent in accordance with the award terms and program requirements and could result in the U.S. Department of Education reducing future awards.2 Further, if monies were spent inconsistently with program requirements, those who were intended to benefit from the program may not have received all the services or other benefits they otherwise would have received. Additionally, the Department is at risk that this finding applies to other federal programs it administers. Cause The Department’s documented program policies and procedures for monitoring LEAs did not differentiate between regular LEAs, charter schools without CMOs, or charter schools with relationships with CMOs and did not include specific procedures to assess the additional risk posed by conflicts of interest, related-party transactions, or insufficient segregation of duties. The Department reported that it began incorporating policy changes into grant administration and monitoring policies in early 2024; however, these policies were not completed until May 2024 and did not become effective until fiscal year 2025. Criteria Federal regulations require the Department to monitor subrecipients, including charter schools, which includes required monitoring procedures for assessing the risk of each subrecipient’s noncompliance and monitoring activities based on those risk assessments. Those federal regulations also provide that monitoring procedures may include reviewing financial and performance reports, providing training or technical assistance on program-related matters, and performing on-site reviews, selective audits, and/or other monitoring procedures (2 CFR §200.332[b and d]) As part of these monitoring responsibilities, the U.S. Department of Education requires the Department to monitor charter schools with relationships with CMOs and assess the additional risk posed by conflicts of interest, related-party transactions, or insufficient segregation of duties.3,4 Also, federal regulation requires establishing and maintaining effective internal control over federal awards that provides reasonable assurance that federal programs are being managed in compliance with all applicable laws, regulations, and award terms (2 CFR §200.303). 2 Federal Uniform Guidance requires federal awarding agencies to follow up on audit findings and issue a management decision to ensure the recipient, the Department, takes appropriate and timely corrective action (2 CFR §200.513[c]). Further, it requires that federal awarding agencies’ management decisions clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action, as directed by the federal awarding agencies (2 CFR §200.521). 3 On September 28, 2015, the U.S. Department of Education issued a letter to State Educational Agencies (SEAs) reminding them of their role in helping to ensure that federal funds accessed by public charter schools are used for intended, appropriate purposes, and provided additional resources for states, and specifically SEAs, to consult as they consider improvements to their monitoring and oversight procedures for charter schools (U.S. Department of Education. [2015, September]. Letter to SEAs. Retrieved 11/18/2025 from https://oese.ed.gov/files/2020/07/ finalsignedcsp.pdf 4 On September 29, 2016, the U.S. Department of Education’s Office of Inspector General issued an audit report on charter schools with CMOs and identified risks such as conflicts of interest, related-party transactions, or insufficient segregation of duties (U.S. Department of Education. [2016, September]. Nationwide Assessment of Charter and Education Management Organizations. Retrieved 11/18/2025 from https://oig.ed. gov/sites/default/files/reports/2023-11/a02m0012.pdf Recommendations to the Department 1. Perform annual monitoring over charter schools with relationships with CMOs, including performing risk-assessment procedures over the additional risk posed by conflicts of interest, related-party transactions, or insufficient segregation of duties, and carry out monitoring activities based on those risk assessments such as reviewing financial and performance reports, providing training or technical assistance on program-related matters, and performing on-site reviews, selective audits, and/or other monitoring procedures. 2. Implement revisions to existing LEA-monitoring policies and procedures and train employees to identify charter schools that have relationships with CMOs and to then assess and design monitoring procedures over conflicts of interest, related-party transactions, or insufficient segregation of duties. This finding is similar to prior-year finding 2023-125 and was initially reported in fiscal year 2023. Views of responsible officials State management concurs with this finding. The State’s corrective action plan at the end of this report includes the views and planned corrective action of its responsible officials regarding these recommendations. We are not required to audit and have not audited these responses and planned corrective actions and therefore provide no assurances as to their accuracy.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Significant Deficiency Immaterial Noncompliance 2024-039 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance Program (LIHEAP) Federal Award No. All Current Active Grants Questioned Costs N/A Criteria Code of Federal Regulations (2 CFR 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Code of Federal Regulations (2 CFR 200.332(d)(2)) states all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. Code of Federal Regulations (2 CFR 200.332(f)) states all pass-through entities must verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 200.501. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2024, the auditor noted the following: • Four instances (or 33.33 percent) in which there was no documentation of communication between the agency and the subrecipient regarding audit reports that had not been received within nine months of the subrecipients fiscal year-end. • One instance (or 8 percent) in which there was no documentation that a corrective action plan was provided. Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Division of Program Integrity - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes, 2023-018, 2022-018, and 2021-014. Statistically Valid Yes.

Finding 2024-012 – Noncompliance with Subrecipient Monitoring Over Major Federal Program – Coronavirus State and Local Fiscal Recovery Funds (Repeat Finding – 2023-012) PASS-THROUGH GRANTOR: Direct Grant FEDERAL AGENCY: U.S. Department of Treasury ASSISTANE LISTING: 21.027 FEDERAL PROGRAM NAME: Coronavirus State and Local Fiscal Recovery Funds FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Subrecipient Monitoring QUESTIONED COSTS: $-0- Condition: During the test of 100% of expenditures of the Coronavirus State and Local Fiscal Recovery Funds, totaling $1,152,068, it was noted that the County had two (2) subrecipients with expenditures totaling $46,935. The County does not have a subrecipient monitoring policy, and the County did not obtain agreements containing all the required elements of 2 CFR 200.332. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal expenditures are made in accordance with compliance requirements. Effect of Condition: This condition resulted in noncompliance with grant requirements and could lead to a loss of federal funds to the County. Recommendation: OSAI recommends the County gain an understanding of the requirements for this program and implement internal controls to ensure compliance with these requirements. Management Response: Chairman of the Board of County Commissioners: The Board of County Commissioners will take measures to ensure future compliance with all requirements of federal grants. Criteria: 2 CFR 200 §200.332 Requirement for Pass-Through Entities states in part: All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award. (5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part. (6) Appropriate terms and conditions concerning closeout of the subaward.

Federal agency: U.S. Treasury Department Federal program title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.019 Pass-Through Agency: Prince William County Pass-Through Number(s): 117203461 Award Period: 3/11/2022 – 12/31/2024 Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Uniform Guidance §200.331 and §200.332 requires pass-through entities to ensure that subrecipients comply with Federal statutes, regulations, and the terms and conditions of their subawards. This includes performing subrecipient monitoring procedures such as reviewing financial and programmatic reports, following up on identified deficiencies, and issuing management decisions for audit findings. Condition: The auditee did not have documented policies or procedures in place to monitor subrecipients for compliance with federal award requirements. Specifically, the auditee did not perform or document required subrecipient monitoring activities, such as review of financial or programmatic reports, verification of compliance with applicable federal requirements, or follow-up on subrecipient audit results, for the fiscal year under audit. Questioned costs: $2,246,007; Questioned costs reflect only funds passed through to subrecipients and exclude amounts expended directly by the auditee. Context: Due to the absence of subrecipient monitoring controls and procedures, unable to determine whether subrecipients complied with applicable federal requirements. As a result, the entire amount of subrecipient expenditures was considered noncompliant and was reported as questioned costs. This finding affected all subawards under the program. Cause and Effect: Management did not establish or maintain formal subrecipient monitoring policies and procedures and did not assign sufficient resources or oversight responsibility to ensure compliance with Uniform Guidance requirements governing subrecipient monitoring. As a result of the lack of subrecipient monitoring, the auditee was unable to ensure subrecipient compliance with federal award requirements. This resulted in material noncompliance, a material weakness in internal control over compliance, and material questioned costs totaling approximately $2.2 million, representing the full amount of federal funds passed through to subrecipients under the program. This finding resulted in an adverse opinion on compliance for the major program. Repeat Finding: Yes; 2023-002 Recommendation: We recommend that the Alliance establishes a formal policy for sub-recipient monitoring in accordance with requirements outlined in 2 CFR §200.331 and 2 CFR §200.332 to ensure its sub-recipients are properly monitored. Views of responsible officials and planned corrective action: There is no disagreement with the audit finding. The Alliance performed certain monitoring activities; however, documentation was not retained in a manner sufficient to demonstrate compliance with Uniform Guidance requirements. This policy has since been revised to save the monitoring documentation to the grant management software. Contact person responsible for corrective action: Lisa Wolf, Board Chair. Anticipated Completion Date: June 30, 2026

Material Weakness Finding No. 2024-002: Subrecipient Monitoring U.S. Department of Health and Human Services Substance Abuse and Mental Health Services Federal Assistance Listing Number 93.243. U.S. Department of Health and Human Services Health Care for Native Hawaiians Federal Assistance Listing Number 93.932. Criteria Pursuant to Title 2, Subtitle A Chapter II, Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (the Uniform Guidance), “a non-Federal entity may concurrently receive Federal awards as a recipient, subrecipient, and a contractor, depending on the substance of its agreements with the Federal awarding agencies and pass-through entities. Therefore, a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor.” Condition We noted that the Organization did not make case-by-case determinations of each agreement with parties to which the Organization passed through Federal program funds to determine whether they were deemed to be either subrecipients or contractors. Cause Management had not updated its policies and procedures to incorporate the relevant Uniform Guidance subrecipient monitoring and management policies. Effect The lack of subrecipient monitoring and management policies of the Uniform Guidance could result in noncompliance by the Organization with the stipulated requirements for pass-through entities, as well as noncompliance of subrecipient requirements by the entities receiving the pass-through funds from the Organization. Identification of Repeat Finding This finding was reported as a federal award finding in the immediate previous audit as Finding No. 2023-002. Recommendation We recommend that the Organization incorporate and adhere to the subrecipient monitoring and management provisions of 2 CFR §200.331 and 2 CFR §200.332 of the Uniform Guidance to their policies and procedures manual to ensure compliance with Federal standards.

FINDING REFERENCE NUMBER 2024-052 FEDERAL PROGRAMS (ALN – 93.558) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES (TANF) U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES AWARD NUMBERS 2022G996117 (Federal Award Year: 10/1/2021 – 9/30/2022) 2023G996117 (Federal Award Year: 10/1/20212 – 9/30/2023) 2401PRTANF1 (Federal Award Years: 10/1/2023 through 9/30/2026) ADMINISTRATION ADMINISTRATION FOR SOCIOECONOMIC DEVELOPMENT OF THE FAMILY (ADSEF, BY ITS SPANISH ACRONYM) COMPLIANCE REQUIREMENT SUBRECIPIENT MONITORING TYPE OF FINDING INTERNAL CONTROL AND COMPLIANCE – MATERIAL WEAKNESS AND MATERIAL NONCOMPLIANCE CRITERIA In accordance with 2 CFR 200.332, a Pass-Through Entity must: (a) Verify that the subrecipient is not excluded or disqualified in accordance with § 180.300. Verification methods are provided in § 180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: (1) Federal award identification. (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated in the subaward; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; (xiii) Identification of whether the Federal award is for research and development. (2) All requirements of the subaward, including requirements imposed by Federal statutes, regulations, and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient for the pass-through entity to meet its responsibilities under the Federal award. This includes information and certifications (see § 200.415) required for submitting financial and performance reports that the pass-through entity must provide to the Federal agency; … (5) A requirement that the subrecipient permit the pass-through entity and auditors to access the subrecipient's records and financial statements for the pass-through entity to fulfill its monitoring requirements; and (6) Appropriate terms and conditions concerning the closeout of the subaward. (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (d) If appropriate, consider implementing specific conditions in a subaward as described in § 200.208 and notify the Federal agency of the specific conditions. (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. (g) Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. STATEMENT OF CONDITION The SEFA provided identified transactions as pass-through to subrecipients. As part of our audit procedures we interviewed the personnel in charge of the program, and we noted that ADSEF does not formally recognize as subrecipients the entities that receive TANF funds to carry out programmatic activities on behalf of the agency. As a result, ADSEF did not establish subaward agreements that included the elements required by 2 CFR §200.332(a), nor did it implement adequate subrecipient risk assessment and monitoring procedures. During the audit, it was observed that: (1) The signed agreements do not identify the entities as subrecipients; (2) The agreements do not contain the minimum elements required by 2 CFR §200.332(a) including, ▪ FAIN, Assistance Listing Number, Federal performance period, and total amount of Federal funds obligated; ▪ ADSEF did not conduct documented assessments of fraud risk or non-compliance risk; ▪ There was no evidence of ongoing monitoring of financial and programmatic performance; ▪ There was no documentation of a review of Single Audits or follow-up on related findings; ▪ Formal corrective action or enforcement mechanisms were not established for non-compliant entities. QUESTIONED COSTS None. PERSPECTIVE INFORMATION This deficiency is a systemic problem related to ADSEF's inability to adequately identify entities receiving TANF funds as subrecipients and to implement the required monitoring procedures. STATEMENT OF CAUSE The situation is attributed to ADSEF incorrectly classifying recipient entities as suppliers or contractors, rather than subrecipients, and failing to develop policies and procedures aligned with the requirements of 2 CFR §200.332 for administration and monitoring of Federal subawards. POSSIBLE ASSERTED EFFECT Failure to properly identify and monitor subrecipients increases the risk of: • Noncompliance with applicable Federal laws and regulations; • Failure to detect programmatic and financial deficiencies in a timely manner; • Inability to demonstrate compliance with Federal fund management requirements; • Potential cost challenges and Federal penalties. IDENTIFICATION OF REPEAT FINDING No reported as prior audit finding. RECOMMENDATIONS We recommend that ADSEF provide adequate training to program staff responsible for subrecipient monitoring to ensure compliance with Federal requirements, including the proper identification of subrecipients, performance of on-site monitoring visits, evaluation of audit reports, assessment of subrecipient risk, and documentation of monitoring activities.

Finding 2024-003 Internal Control and Compliance over Subrecipient Monitoring (Material Weakness) Information on the Federal Program: Assistance Listing Number(s): 17.258, 17.259, 17.278 Federal Program Name: Workforce Innovation and Opportunity Act (WIOA) Federal Agency: U.S. Department of Labor Pass-Through Entity: California Employment Development Department Federal Award Number and Award Year: AA211008/AA311008/AA411008/AA411009/AA411010 Criteria: Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2: Grants and Agreements, Subtitle A - Office of Management and Budget Guidance for Grants and Agreements, Chapter II - Office of Management and Budget Guidance, Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards Subpart D - Post Federal Award Requirements, Subrecipient Monitoring and Management, §200.331 Requirements for pass-through entities (2 CFR 200.331): All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414.; (1) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (2) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; Title 2: Grants and Agreements, Subtitle A - Office of Management and Budget Guidance for Grants and Agreements, Chapter II - Office of Management and Budget Guidance, Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards Subpart D - Post Federal Award Requirements, Subrecipient Monitoring and Management, §200.332 Requirements for pass-through entities (2 CFR 200.332): All pass-through entities must: (a) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). Condition: During our testing of the Imperial County Workforce Development Office’s (ICWDO) provisions for subrecipient monitoring under the WIOA Cluster, we noted two (2) of the two (2) subrecipient selected for testing, there was no review or approval over the monitoring procedures performed by ICWDO monitoring staff. The entire population consisted of two (2) subrecipients. Also, the County did not document their evaluation of the subrecipient’s risk of noncompliance. The following information was not provided at the time of the subaward for two (2) of the two (2) subawards selected for testing: o Federal award identification number o Federal award date of award to recipient by the Federal agency o Name of federal awarding agency o Federal Financial Assistance Listing/CFDA Number o Identification of whether the award is research and development Cause: The County’s ICWDO department does not have a formal procedure in place for the department’s review and approval over the monitoring procedures performed by the department over its subrecipients. The ICWDO department did not ensure that the required award information and applicable requirements were communicated to the subrecipients and did not maintain documentation of their evaluation of each subrecipient’s risk of noncompliance. Effect: The County’s ICWDO department did not review and approve monitoring procedures performed over its subrecipients. Additionally, the ICWDO department did not maintain policies and procedures to align with the Subrecipient Monitoring requirements in 2 CFR 200.332 (a) and 200.332(b). Identification as a Repeat Finding, If Applicable: Yes. See Finding 2023-004. Questioned Costs: No questioned costs were identified. Recommendation: We recommend ICWDO implement policies and procedures in accordance with 2 CFR 200.331(a) 200.332(b) to ensure compliance with subrecipient monitoring requirements and that require the review and approval of the monitoring procedures performed over its subrecipients by a separate individual. View of Responsible Officials and Planned Corrective Action: See separate Corrective Action Plan.

Material weakness in internal controls over compliance and instances of noncompliance related to subrecipient monitoring. Federal Agency: Department of Treasury Program Title: Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Award Numbers: HCS-23-AR-2110-048, SLFRP0194 Project Period: November 1, 2021 - March 31, 2025 Criteria 2 U.S. Code of Federal Regulations (CFR) 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) Subpart D requires a pass-through entity to adopt compliance policies to ensure sub-recipients comply with requirements under the award, and evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of such agreements for the purposes of determining appropriate subrecipient monitoring. Condition/Context for Evaluation During the audit for the year ending June 30, 2024, the Agency did not have a subrecipient monitoring policy and did not conduct monitoring over subrecipients awarded under the program. Questioned Costs Not applicable. Cause The Agency’s subrecipient monitoring policy did not include all the required provisions outlined in 2 CFR 200.332. Effect or Potential Effect The Organization did not fully comply with the requirements regarding subrecipient monitoring. Repeat Finding Yes, see finding 2023-002. Recommendation We recommend that the Agency develop a subrecipient monitoring policy that meets the required provisions outlined in 2 CFR 200.332 and ensure a risk assessment is performed over all subrecipients. Views of Responsible Officials of Auditee Management concurs with the finding and has provided the accompanying management corrective action.

FINDING NO: 2024-018 (Repeat 2023-013) Strengthen Internal Controls over Subrecipient Monitoring STATE AGENCY: Oklahoma Department of Transportation FEDERAL AGENCY: Federal Transit Authority ALN: 20.509 FEDERAL PROGRAM NAME: Formula Grants for Rural Areas FEDERAL AWARD NUMBER: OK-2017-023-05, OK-2018-023-03, OK-2019-025-03, OK-2020-021-02, OK- 2021-018-00, OK-2022-016-00, OK-2022-025-00, OK-2022-027-00, OK-2023-026-00, OK-2024-006-00, OK-2024- 013-00 FEDERAL AWARD YEAR: 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024 CONTROL CATEGORY: Subrecipient Monitoring QUESTIONED COSTS: $0 Condition and Context: The Office of Mobility and Public Transit (OMPT) at the Oklahoma Department of Transportation (Department) is responsible for is responsible for overseeing subrecipients associated with the Assistance Listing Number (ALN) 20.509 grant. OMPT provides the grant information, as required in 2 CFR 200.332, through the contract agreement between the Department and the subrecipient. A template of the contract agreement is used to ensure the correct information is provided. We reviewed the contracts agreements for eight (8) of 23 subrecipients receiving funding during the audit period to determine whether the correct information was communicated to the subrecipients. We identified three (3) or 37.5% (3/8) subrecipients who received a contract agreement with an incorrect Assistance Listing Number (ALN). As part of the monitoring process, the project managers obtain subrecipients’ audit reports and forward them to the Department’s Audit Office for review. OMPT relies on responses received from the Audit Office subsequent to review for identification of findings to monitor and assess the risk related to subrecipients’ compliance with Federal statutes, regulations, and the terms and conditions of the subaward. OMPT uses an Single Audit Tracking spreadsheet as a control mechanism to ensure the requirements described in 2 CFR 200.332 are met and OMPT’s program managers are required to update the audit tracking spreadsheet for their assigned subrecipients. We met with OMPT employees to discuss the control processes used to ensure monitoring requirements were met. During the discussion, it was discovered that risk assessments were not performed, and the Single Audit Tracking spreadsheet was used sporadically. Additionally, we noted the Single Audit Tracking sheet omitted two (2) or 9.09% (2/22) of the subrecipients expected to have and submit an audit during the period. We reviewed documentation for the 22 subrecipients that were expected to have and submit an audit during the audit period to determine whether the Department complied with the monitoring of the subrecipients audits. The following was observed: • Twelve (12) or 54.55% (12/22) of the subrecipients did not submit an audit report until after the audit period and no communication was provided to indicate attempts were made by OMPT to obtain the audit reports. • Two (2) or 9.09% (2/22) of the subrecipients did not submit an audit report at all and no communication was provided to indicate attempts were made by OMPT to obtain the audit reports. • One (1) or 4.55% (1/22) of the subrecipients submitted an Agreed Upon Procedure instead of a single audit or financial audit. • Six (6) or 27.27% (6/22) of the subrecipients submitted a single audit or a financial audit and it was not reviewed by the Audit Office. This is a repeat finding for the current audit period. According to the status reported in the SFY 2023 Summary Schedule of Prior Audit Findings, corrective action was implemented 6/30/2024. Because the SFY 2023 corrective action was implemented after the audit period, results of those corrections were not a part of the scope of the audit. Cause: The Department lacked a sufficient system of controls to properly monitor subrecipients. An unauthorized change to the contract template went unnoticed when the contract agreement was created and the review process by the Department did not detect the discrepancy between the Federal award and the contract agreement. - A process to evaluate the risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subawards was not established. - Program managers’ use of the Single Audit Tracking sheet is inconsistent and the Single Audit Tracking sheet lacks reliable oversight to ensure that program managers are effectively monitoring the subrecipients. Further, the Department does not have an adequate process in place to determine whether subrecipients are subject to a single audit or financial audit. Effect: Inadequate monitoring can lead to program non-compliance on the part of the Department and its subrecipients. - The Department prevented the subrecipients from properly recording or reporting the activity related to the contract agreements due to an incorrect ALN. - Monitoring of subrecipient activities is not directly related to the level of noncompliance risk each individual subrecipient poses. - Inadequate tracking of audits has prevented the Department from ensuring the subrecipients’ audits were received. This in turn prevented the Department from performing review and taking timely and appropriate action on deficiencies detected through audits. Recommendation: We recommend the Department review and update the contract template to ensure it contains the correct grant information and modify the contract agreement review process to ensure the review is robust enough to detect whether correct grant information is provided to the subrecipients. We further recommend the Department send corrected grant information in a letter or email to active grants to subrecipients who received incorrect Federal award information in their contract agreement. In addition, we recommend the Department continue with implementation of corrective action procedures and training necessary to ensure subrecipient risk assessments are performed, inquiries are made with sub-recipients to determine the audit type required based on the expected federal expenditures, and the Single Audit Tracking sheet is updated monthly for review and/or follow-up. Criteria: 2 CFR 1201.1 states, “Except as otherwise provided in this part, the Department of Transportation adopts the Office of Management and Budget Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR part 200). This part supersedes and repeals the requirements of the Department of Transportation Common Rules (49 CFR part 18 - Uniform Administrative Requirements for Grants and Cooperative Agreements to State and Local Governments and 49 CFR part 19 - Uniform Administrative Requirements - Uniform Administrative Requirements for Grants and Agreements with Institutions of Higher Education, Hospitals, and other Non-Profit Organizations), except that grants and cooperative agreements executed prior to December 26, 2014 shall continue to be subject to 49 CFR parts 18 and 19 as in effect on the date of such grants or agreements. New parts with terminology specific to the Department of Transportation follow.” 2 CFR 200.332 states in part, “All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. xii. Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward... (f) Verify that a subrecipient is audited as required by subpart F of this part... (h) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 of this part and in program regulations.” 2 CFR 200.521 states in part, “(a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments or take other action. If the auditee has not completed corrective action, a timetable for followup should be given.…While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements, which are required to be reported in accordance with GAGAS.” 2 CFR 200.521 states in part, “(d) Time requirements. The Federal agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report.” Views of Responsible Official(s) Contact Person: Eric Rose/Bobby Parkinson Anticipated Completion Date: 12/31/2026 Corrective Action Planned: The Oklahoma Department of Transportation agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-001 (Partial Repeat 2023-053) Strengthen Internal Controls Over LEA Risk Assessment Monitoring STATE AGENCY: Oklahoma State Department of Education (OSDE) FEDERAL AGENCY: United States Department of Education (USDE) ALN: 84.010; 84.425 – 84.425D, 84.425U FEDERAL PROGRAM NAME: Title I Grants to Local Educational Agencies; Education Stabilization Fund (ESF) - Elementary and Secondary Schools Emergency Relief Fund (ESSER II); American Rescue Plan – Elementary and Secondary Schools Emergency Relief Fund (ARP ESSER III) FEDERAL AWARD NUMBER: S010A230036; S425D210024; S425U210024 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Subrecipient Monitoring QUESTIONED COSTS: $0 Condition and Context: All Local Educational Authorities (LEAs) are monitored for Federal programs at least once on a three-year cycle; however, additional monitoring may be required for LEAs identified as high risk. OSDE utilizes a Risk Assessment Ranking Tool to track LEA risk scores and determine whether any additional LEAs should be monitored during the school year. We audited a sample of 60 of 537 LEAs listed in the Risk Assessment Ranking Tool and identified: • 22 of 60 (36.67%) LEA risk scores were not appropriately evaluated.  High risk category – eight LEAs would have remained at high risk.  Moderate risk category –three LEAs should have been increased to high risk and were not monitored appropriately, and five LEAs would have remained at moderate risk.  Low risk category –four LEAs should have been increased to moderate risk, and two LEAs would have remained at low risk. Cause: OSDE’s existing monitoring activities lacked the necessary strength and consistency to effectively support ongoing oversight of subrecipient LEA risk scores in the Risk Assessment Ranking Tool. Effect: Inaccurate distribution of an LEAs points in the Risk Assessment Monitoring Tool results in inconsistent monitoring of the total risk score for subrecipient LEAs. In addition, LEAs may not be identified appropriately as high risk, which affects the level of monitoring necessary to ensure the LEA complies with requirements. Recommendation: We recommend OSDE continue to strengthen its policies and procedures related to risk assessment scoring to ensure all subrecipients are appropriately evaluated and monitored. Criteria: 2 CFR § 200.332(b) states in part: “All pass-through entities must: … (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency).” 2 CFR § 200.303(a) states in part: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Management Response Contact Person: Tammy Smith | Senior Director of Federal Programs Anticipated Completion Date: August 2026 Corrective Action Planned: The Oklahoma State Department of Education agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-016 (Partial Repeat #2023-021) Strengthen Internal Controls Over Review and Approval of Claims STATE AGENCY: Oklahoma State Department of Education (OSDE) FEDERAL AGENCY: United States Department of Education (USDE) ALN: 84.425 – 84.425D; 84.425U FEDERAL PROGRAM NAME: Education Stabilization Fund (ESF): Elementary and Secondary School Emergency Relief Fund (ESSER); American Rescue Plan – Elementary and Secondary Schools Emergency Relief Fund (ARP ESSER) FEDERAL AWARD NUMBER: S425D210024; S425U210024 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed or Unallowed & Allowable Costs/Cost Principles; Subrecipient Monitoring QUESTIONED COSTS: 84.425U - $358 Condition and Context: OSDE has policies and procedures in place to review and approve claims. Additionally, the Grants Management System (GMS) has edits for the ESF allocation notices. Activities Allowed or Unallowed & Allowable Costs/Cost Principles We tested a sample of 65 of 4,382 (1.48%) ESSER II and ARP ESSER III claims totaling $47,049,093 and identified: • Four of 65 (6.15%) claims did not have an adequate review and approval of the electronic claim by an authorized claims auditor, which resulted in o unallowable items purchased totaling $303, o an overpayment totaling $55, o missing supporting invoices at the time of claim approval, and o costs coded to the wrong ARP ESSER III program. Subrecipient Monitoring We reviewed the allocation notices applicable to all LEAs that had claims in the claims sample noted above and identified: • For 25 of 59 (42.37%) LEAs, the allocation notices were not generated and provided to inform the LEA of the 2 CFR § 200.332(a)(1) requirements. Additionally, we noted during our documentation of procedures over allocation notices, one allocation notice did not contain the FAIN or the Federal award date as required. However, we determined the allocations per the allocation spreadsheet and budgets in the GMS were correct. Cause: OSDE’s claims review and approval process lacked the necessary strength and consistency to adequately review claims to ensure proper supporting documentation, including invoices, agrees with the expenditures submitted on the claim and agrees to the approved budgeted items to ensure the amounts claimed were accurate and for allowable costs. OSDE’s monitoring and oversight process lacked the necessary strength and consistency to ensure allocation notices populated correctly and generated notices from GMS. Effect: Inadequate review of claims, along with insufficient verification of required supporting documentation, increases the risk of reimbursing unallowable expenses, resulting in noncompliance. Furthermore, noncompliance increases the risk of Federal claw backs, which impacts state dollars. Noncompliance during the audit period resulted in $359 of actual questioned costs and $43,168 in projected questioned costs for ALN # 84.425U (projects 559 and 795). Additionally, not informing LEAs of the required information per the 2 CFR § 200.332 increases the risk of noncompliance occurring within the program. Recommendation: We recommend OSDE strengthen its claims review and approval process to ensure accurate supporting documentation for claims is included, only allowable uses and costs of ESF are reimbursed, and expenditures are correctly coded to the proper program. We also recommend that OSDE enhance the monitoring and oversight process to ensure allocation notices containing all 2 CFR § 200.332 requirements are populated correctly and generated from GMS. Criteria: 2 CFR § 200.332 states in part: “All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal Award Identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see § 200.39 Federal award date) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (vii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current obligation; (viii) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (ix) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (x) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xi) CFDA Number and Name; the pass-through entity must identify the dollar amount made available under each Federal award and the CFDA number at time of disbursement; (xii) Identification of whether the award is R&D; and (xiii) Indirect cost rate for the Federal award (including if the de minimis rate is charged per § 200.414 Indirect (F&A) costs).” 2 CFR § 200.303(a) states in part: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Management Response Contact Person: Tammy Smith, Senior Director of Federal Programs Anticipated Completion Date: September 1, 2026 Corrective Action Planned: The Oklahoma State Department of Education agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-025- Improve Subrecipient Monitoring (Repeat 2023-006) STATE AGENCY: Oklahoma Department of Human Services (DHS) FEDERAL AGENCY: Department of Health and Human Services (DHHS) ALN: 93.658 FEDERAL PROGRAM NAME: Foster Care – Titel IV-E FEDERAL AWARD NUMBER: 2301 OKFOST and 2401 OKFOST FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Subrecipient Monitoring QUESTIONED COSTS: $0 Condition and Context: We judgmentally selected 2 of the 11 subrecipients (18.18%) to determine whether controls were designed and implemented to ensure a risk assessment of the subrecipient was performed by the Pass-Through Entity (PTE) and noted the following: For 2 subrecipients (100%), we determined a risk assessment was performed based on previous year’s performance to determine the appropriate subrecipient monitoring of each subrecipient; however, the date the risk assessments were performed are not documented, the award amount on the risk assessment equals the amount of funds paid during SFY24, and the line items Results of Single Audit are dated in July 2024. We randomly selected 4 of the 11 subrecipients (36.36%) to determine if all requirements imposed by the PTE on the subrecipient so that the federal award was used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); and any additional requirements that the PTE imposed on the subrecipient in order for the PTE to meet its own responsibility for the federal award and we noted: • Two of four (50%) subawards, cost allocation plans were not received per the contract. • Four of four (100%) subawards, the statement of work had insufficient detail to determine if deliverables were met. For both of our samples, we reviewed the subrecipient contracts to determine whether they included information required in accordance with 2 CFR 200.332(b) and we noted: • Two of six (33.33%) subawards did not include the subrecipient name and unique entity identifier • Six of six (100%) subawards did not include the Federal Award Identification Number (FAIN) • Six of six (100%) subawards did not include the Federal Award Date • One of six (17%) subawards did not include the Federal Award project description • Two of six (33.33%) subawards did not include the name of Federal awarding agency, pass through entity (PTE), and PTE awarding official contact information in the award document • One of six (16.67%) subawards did not include the ALN (Assistance Listings number) and title as required on the contract • Six of six (100%) subawards did not include identification of whether the award was for Research & Development • Three of six (50%) subawards did not include an indirect cost rate negotiated between the subrecipient and the Federal Government and also did not include an appropriate rate determined by the PTE in collaboration with the subrecipient. Cause: Management does not properly understand the program requirements. This is a prior audit finding dating back to SFY2017; however, DHS Management has shown some corrective action has been implemented to address identifying the award and applicable requirements and monitoring as required in 2 CFR 200.332. DHS does not have adequate controls in place to properly monitor subrecipients to ensure the contractual obligations are met. Effect: DHS is not in compliance with the monitoring requirements for this program. Therefore, subrecipients may not administer federal funds in accordance with program requirements. Recommendation: We recommend DHS further modify its subrecipient agreements and related documentation to ensure all required award information is provided and that any additional requirements imposed by DHS in their subrecipient agreements are complied with. Further, the contract should explicitly state the program duties to be performed by the subrecipient. Additionally, we recommend DHS perform risk assessments on all subrecipients at the start of the fiscal year to determine the level of monitoring necessary. Criteria: 45 CFR §75.303(a) states in part: “The Non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Per 2 CFR §200.1 Definitions defines subaward as “Subaward means an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract [emphasis added].” 2 CFR §200.332 Requirements for pass-through entities states in part “All pass-through entities must: … (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient for the passthrough entity to meet its responsibilities under the Federal award. This includes information and certifications (see § 200.415) required for submitting financial and performance reports that the pass-through entity must provide to the Federal agency; (4) Indirect cost rate: (i) An approved indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, a pass-through entity must determine the appropriate rate in collaboration with the subrecipient. (c) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a federal awarding agency) … (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports.” Paragraph 7 of the agency’s subrecipient contract states in part “Sub-Recipient will provide a cost allocation plan to OKDHS within thirty (30) calendar days of this Agreement being signed. In the event there are any changes to the Cost Allocation Methodology, Sub-Recipient will notify OKDHS of those changes before submitting any affected quarterly claim invoice. Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: 9/30/2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-093 Strengthen Internal Controls Over Period of Performance and Monitoring STATE AGENCY: Oklahoma Department of Emergency Management FEDERAL AGENCY: Department of Homeland Security - Federal Emergency Management Agency (FEMA) ALN: 97.036 FEDERAL PROGRAM NAME: Disaster Grants – Public Assistance (Presidentially Declared Disasters) FEDERAL AWARD NUMBER: 4222-PA, 4299-PA, 4315-PA, 4438-PA, 4453-PA, 4530-PA, 4575-PA, 4587-PA, 4706-PA, 4721-PA FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Period of Performance; and Subrecipient Monitoring QUESTIONED COSTS: $0 Condition and Context: While testing 30 of 139 SFY24 Public Assistance Large Projects we noted the following: • For 30 of 30 (100%) projects tested, OEM was unable to provide documentation to support that risk assessments were conducted for subrecipients during SFY24. While testing 36 of 202 SFY24 Public Assistance Small Projects we noted the following: • For 6 of 36 (16.67%) projects tested, the work completion date was not prior to the period of performance and no extension was received. Per discussion with management, small projects cannot request close out until all projects on the grant have been completed and the dates submitted as the completion date are often after the work was actually completed. While this is common due to the nature of the projects, OEM recognizes that the official work completion date is after the required deadline. • For 36 of 36 (100%) projects tested, OEM was unable to provide documentation to support that risk assessments were conducted for subrecipients during SFY24. In addition, upon further inquiry of OEM, we confirmed that 100% of the subrecipient population had not received risk assessments during SFY24. Cause: Inadequate controls over project closeouts allowed for projects to remain open past the period of performance without receiving proper time extensions. Further, adequate controls were not designed and implemented to ensure each subrecipient’s risk of noncompliance are evaluated to determine that appropriate monitoring was performed. We were initially unable to determine if any risk assessments were performed for SFY 2024 due to turnover and the lack of proper controls over subrecipient monitoring record retention. Effect: OEM did not appropriately monitor and access risk for all subrecipients to ensure compliance with Federal regulations for the subaward, increasing the risk of undetected noncompliance. Recommendation: We recommend OEM strengthen their internal controls pertaining to payment approval and period of performance to ensure all costs occur within the period of performance. We also recommend OEM review the procedures/internal controls pertaining to subrecipient monitoring to ensure all forms are properly signed indicating the subrecipient has received required information, as well as ensuring risk assessments are appropriately performed and documented. Criteria: 2 CFR §3002.10 - Adoption of 2 CFR Part 200 states in part, “the Department of Homeland Security adopts the Office of Management and Budget (OMB) Guidance in 2 CFR part 200. Thus, this part gives regulatory effect to the OMB guidance and supplements the guidance as needed for the Department.” 2 CFR §200.303 - Internal controls states in part, “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.332(c) – Requirements for pass-through entities states in part, “Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring … .” 2 CFR § 200.332(e) – Requirements for pass-through entities states in part, “Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” 2 CFR § 200.344(a) – Closeout states in part, “The Federal agency or pass-through entity must close out the Federal award when it determines that all administrative actions and required work of the Federal award have been completed.” (b) “A subrecipient must submit all reports (financial, performance, and other reports required by a subaward) to the pass-through entity no later than 90 calendar days after the conclusion of the period of performance of the subaward (or an earlier date as agreed upon by the pass-through entity and subrecipient). When justified, the Federal agency or pass-through entity may approve extensions for the recipient or subrecipient.” Management Response: The agency concurs with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-014 (Repeat 2023-026) Strengthen Internal Controls Over Monitoring of Subrecipient Agreements and Expenditures STATE AGENCY: State of Oklahoma, Office of Management and Enterprise Services (OMES) FEDERAL AGENCY: US Department of Treasury ALN: 21.023 FEDERAL PROGRAM NAME: Emergency Rental Assistance (ERA 1 and ERA 2) FEDERAL AWARD NUMBER: ERA028 and ERAE0259 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Subrecipient Monitoring QUESTIONED COSTS: $0 Condition and Context: Oversight and management of the ERA program has been transferred at the beginning of SFY25 from the office of the Director of Budget, Policy and Gaming Compliance to the OMES Grant Management Office (OMES-GMO), which has staff with several years of grant experience. OMES-GMO recently hired additional staff, and the two staff members dedicated to the management of the ERA program have 20+ years of combined federal grant specific experience. The GMO implemented a multi-level system of internal controls for grant management and oversight that includes routine monitoring, desk review, and site visits for all projects and associated project/administrative expenditures to ensure allowability, accuracy, and assist in the detection of fraud. SAI began working on the SFY24 audit of the ERA program in the fall of 2025 and the OMES GMO actively facilitated all of our audit requests (to the extent the subrecipients would provide the requested information), worked to implement corrective action for all prior year audit findings and implemented oversight and monitoring activities over the remaining unexpended ERA grant funds. However, because these activities did not start until after the SFY24 audit period, most of the prior year audit findings remained uncorrected during the SFY24 audit period resulting in repeat findings. The following issues associated with monitoring occurred prior to the current OMES GMO assuming responsibility for the oversight of the State of Oklahoma ERA program. The State of Oklahoma entered into an agreement with a non-profit entity, Communities Foundation of Oklahoma (CFO), to administer the ERA program for the State of Oklahoma. SAI reviewed the agreement for this entity during our SFY 2021 audit and determined the agreement constituted a subrecipient relationship that would be subject to Part M Subrecipient Monitoring requirements, which was communicated to OMES in findings from the SFY 2021 audit sent to OMES 9/7/2022, The subrecipient expended $8,936,468 in Federal funds during State Fiscal Year (SFY) 2024; however, the Office of Management Enterprise Services (OMES) did not perform any subrecipient monitoring procedures; . OMES advanced program funds, totaling $343,173,664.69, to CFO during SFY 2021-SFY 2023 for which CFO did not submit any documentation to support program expenditures incurred. While OMES did obtain summary information related to rental and utility payments and housing stability payments made for reporting purposes, OMES did not request, obtain or review any support for administrative or program costs to ensure that the costs were attributable to providing financial assistance and housing stability services to eligible households. 1 See SEFA Footnote 10 explaining why the ERA program is not a major program for 2024. However, even though the program is not material based on State of Oklahoma expenditures, we noted Material Weaknesses and Significant Deficiencies in Internal Controls, Material Noncompliance, and Questioned Costs greater than $25,000 when auditing the subrecipient expenditures. Therefore, these deficiencies will be reported under non-major program classification. Until the end of FY2025, OMES did not have a process in place to review potential fraud identified by the subrecipients and ensure that the agency’s response was adequate. OMES also did not have a process to ensure subrecipients were adequately evaluated for the types of fraud that may occur or identifying fraud risk factors applicable to the ERA program. OMES was unable to provide documentation to support that a risk assessment was performed in which each subrecipient would have been verified to have maintained an active status in the SAM.gov system, and that subrecipients were not suspended or disbarred. Cause: OMES did not timely take corrective action to address prior year findings from the SFY 21 - SFY 23 audits. OMES did not timely take corrective action to require OMES personnel to obtain, review, approve, or maintain adequate supporting documentation for all subrecipient expenditures. The required corrective action would have included transferring administration of the ERA grant to the GMO office or other personnel with the experience and expertise to administer Federal grant funds before the majority of the ERA funds were expended by the subrecipient. Additionally, OMES subrecipient monitoring process lacked the strength and consistency to ensure subrecipients established and maintained effective internal control over the Federal award to provide reasonable assurance that the non-Federal entity was managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: Inadequate risk assessment procedures and the lack of appropriate monitoring resulted in non-compliance with award terms and mismanagement of award funds. Furthermore, noncompliance increases the risk of Federal claw backs, which impacts state dollars. OMES decisions to delay appropriate oversight of the ERA program and to delay implementation of adequate corrective action until after the majority of grant funds have been expended by a subrecipient increases the risk that funds may not be successfully recouped from the subrecipient and greatly increases the risk that the state taxpayers will be required to pay back accumulated questioned costs of over $23 million in unallowable costs. Subrecipient agreements were not maintained for the period of performance of the Federal award. As a result, Federal funds may not have been authorized, increasing the risk of improper use of Federal funds. Recommendation: We recommend that the OMES GMO continue implementing the corrective action plan established in FY 2025 to provide proper oversight and monitoring of ERA program expenditures. Criteria: 2 CFR § 200.303(a) states in part, “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.332 states in part, “All pass-through entities must: … b. evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). … d. Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: … 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. … f. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501.” 2 CFR § 200.334 states in part, “Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient.” 2 CFR § 200.337 states in part, “(a) Records of non-Federal entities. The Federal awarding agency, Inspectors General, the Comptroller General of the United States, and the pass-through entity, or any of their authorized representatives, must have the right of access to any documents, papers, or other records of the non-Federal entity which are pertinent to the Federal award, in order to make audits, examinations, excerpts, and transcripts. The right also includes timely and reasonable access to the non-Federal entity's personnel for the purpose of interview and discussion related to such documents.” U.S Department of the Treasury Emergency Rental Assistance Grantee Award Form (8) (a-b) Compliance with Applicable Law and Regulations, states in part, a. “Recipient agrees to comply with the requirements of Section 501 and Treasury interpretive guidance regarding such requirements. Recipient also agrees to comply with all other applicable federal statutes, regulations, and executive orders, and Recipient shall provide for such compliance in any agreements it enters into with other parties relating to this award. b. Federal regulations applicable to this award include, without limitation, the following: i. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 2 C.F.R. Part 200, other than such provisions as Treasury may determine are inapplicable to this Award and subject to such exceptions as may be otherwise provided by Treasury. Subpart F -Audit Requirements of the Uniform Guidance, implementing the Single Audit Act, shall apply to this award… iii. Reporting Subaward and Executive Compensation Information, 2 C.F.R. Part 170, pursuant to which the award term set forth in Appendix A to 2 C.F.R. Part 170 is hereby incorporated by reference.” The US Department of Treasury Emergency Rental Assistance (ERA) FAQ #31 states in part “Grantees should require recipients of funds under ERA programs, including tenants and landlords, to commit in writing to use ERA assistance only for the intended purpose before issuing a payment. Grantees are not required to obtain documentation evidencing the use of ERA program funds by tenants and landlords. Grantees are expected to apply reasonable fraud-prevention procedures and to investigate and address potential instances of fraud or the misuse of funds that they become aware of.” Management Response Contact Person: Brandy Manek, OMES Director of Budget, Policy & Gaming Compliance Anticipated Completion Date: Completed Corrective Action Planned: The Oklahoma Office of Management and Enterprise Services (OMES) partially concurs with the finding. See corrective action plan located in the corrective action plan section of this report. Auditor’s Response: With regard to the assertion that the State “could not take corrective action prior to the FY2024 audit began”, we respectfully disagree per the following reasons: As a recipient of the Federal ERA award, the State of Oklahoma is responsible for understanding the terms and conditions of the award and to ensure the ERA award is administered in accordance with federal regulations, which includes subrecipient monitoring activities. In May of 2021, the State first received Coronavirus Relief Fund (CRF) Audit Finding # 2020-083 related to the State’s lack of subrecipient monitoring activities and Audit Finding # 2020-081 related to the State’s failure to obtain adequate supporting documentation for subrecipient expenditures prior to paying for goods and services. The same individual served as the State’s audit contact for both the CRF award and the ERA award and, therefore, the State could have begun implementing required subrecipient monitoring activities and ensuring adequate supporting documentation was obtained from the subrecipient in May of 2021. Although the SFY 2021 Single Audit Report was not actually released until June 2023, the SFY 2021 Single Audit Report was originally scheduled for publication near the end of September of 2022, and, on September 6, 2022, SA & I provided OMES Audit Finding # 2021-081 which included the following subrecipient monitoring issues SA & I had identified as of that date: “OMES entered into agreements with two non-profit entities to administer the ERA program for the State of Oklahoma: Communities Foundation of Oklahoma (CFO) and Restore Hope Ministries (RHM). SAI reviewed the agreements for these two entities and determined that both agreements constituted a subrecipient relationship that would be subject to Part M Subrecipient Monitoring requirements. We noted that OMES failed to perform any required subrecipient monitoring activities, specifically: • OMES did not provide the subrecipients with appropriate documentation to identify the required Federal award identification information per 2 CFR section 200.331(a)(1). • OMES did not perform a risk assessment that met the compliance requirements. The risk assessment performed did not include any assessment of the risks related to the payments made by the subrecipient for rental, utility, and administrative payments, and it was not designed to identify transactions or types of payments at higher risk and then identify additional monitoring procedures to address those risks. • OMES did not perform any during the award monitoring activities with regard to the rental and utility applications, housing stability and payments approved and paid by the subrecipients, or the administrative expenditures actually incurred by the subrecipients. OMES provided subrecipients advance payments based off expected program rental and utility expenditures for the month and then paid administrative costs on a set percentage of program funds advanced. OMES did not review any supporting documentation related to actual program expenditures for rental and utility assistance, housing stability activities, or administrative expenditures actually incurred by the subrecipients. While OMES did obtain summary information related to rental and utility payments and housing stability payments made for reporting purposes, OMES did not review any actual administrative expenditures to ensure that the administrative costs were attributable to providing financial assistance and housing stability services to eligible households. • OMES provided in excess of $750,000 in Federal funds to both CFO and RHM during SFY 2021; however, OMES did not have a process for identifying and tracking the total amount of federal funds received by subrecipients and notifying the subrecipients of the Single Audit requirements and date the audit would be due. • OMES did not obtain any financial records and supporting documents from the subrecipients that would support the actual expenditures incurred by the subrecipients.” Given the State first received similar findings for the SFY 2020 CRF award in May of 2021 (12 months before the start of SFY 2023 and 24 months before the start of SFY 2024), the State did have sufficient and timely notice to make full corrective actions prior to this SFY 2024 audit and even prior to the SFY 2023 audit. It is the position of our office that the State could have greatly reduced the amount of ERA questioned costs incurred over the past few years if the State had not waited about three and a half years (May 2021 to January 2025) from when SA & I first provided applicable findings to start implementing corrective action.

Reference Number: 2024-004 Federal Program Titles: Temporary Assistance for Needy Families (TANF) Foster Care – Title IV-E Federal Assistance Listing Numbers: 93.558 93.658 Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: California Department of Social Services Federal Award Number and Year: N/A Name of County Department: Health and Human Services Category of Finding: Subrecipient Monitoring Material Noncompliance and Material Weakness Criteria In accordance with Title 2 of the Code of Federal Regulations (CFR) § 200.332, all pass-through entities (PTE) must: (a) Verify that the subrecipient is not excluded or disqualified in accordance with § 180.300. Verification methods are provided in § 180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: (1) Federal award identification. (i) Subrecipient’s name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated in the subaward; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; (xiii) Identification of whether the Federal award is for research and development; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with § 200.414). (2) All requirements of the subaward, including requirements imposed by Federal statutes, regulations, and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient for the pass-through entity to meet its responsibilities under the Federal award. This includes information and certifications (see § 200.415) required for submitting financial and performance reports that the pass-through entity must provide to the Federal agency; (4) Indirect cost rate: (i) An approved indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, a pass-through entity must determine the appropriate rate in collaboration with the subrecipient. The indirect cost rate may be either: (A) An indirect cost rate negotiated between the pass-through entity and the subrecipient. These rates may be based on a prior negotiated rate between a different pass-through entity and the subrecipient, in which case the pass-through entity is not required to collect information justifying the rate but may elect to do so; or (B) The de minimis indirect cost rate. (ii) The pass-through entity must not require the use of the de minimis indirect cost rate if the subrecipient has an approved indirect cost rate negotiated with the Federal Government. Subrecipients may elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). (5) A requirement that the subrecipient permit the pass-through entity and auditors to access the subrecipient’s records and financial statements for the pass-through entity to fulfill its monitoring requirements; and (6) Appropriate terms and conditions concerning the closeout of the subaward. (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a pass-through entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (d) If appropriate, consider implementing specific conditions in a subaward as described in § 200.208 and notify the Federal agency of the specific conditions. (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Depending upon the pass-through entity’s assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient’s program operations; and (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. (g) Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient’s audit, site visits, or other monitoring necessitate adjustments to the pass-through entity’s records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. Condition During our audit of the TANF and Foster Care programs, we noted that the draft schedule of expenditures of federal awards did not include expenditures passed through to subrecipients. Upon inquiry, program management did not have a clear understanding of the difference between a subrecipient and a contractor and, as a result, had not identified, reported on, or monitored subrecipients. Subsequently, using the criteria in 2 CFR § 200.331 Subrecipient and contractor determinations, program management performed an analysis of payments made to contractors and identified the following: • TANF: two entities that received a total of $293,289 in payments during FY2023-24. • Foster Care: two entities that received a total of $139,607 in payments during FY2023-24. Of these we sampled two subrecipients from TANF and one subrecipient from Foster Care. Because program management did not previously identify any entities as subrecipients, the County did not comply with the requirements of subrecipient monitoring as follows: Both TANF and Foster Care: • The County could not demonstrate that a verification was performed to determine that the entities were not excluded or disqualified from receiving federal funds for all three subrecipients. While one entity’s contract included reference to 2 CFR Part 376 Nonprocurement, Debarment and Suspension, it did not specifically include a self-certification clause. • TANF Contracts: ­ One contract was deficient and did not identify the contract as a federally funded subaward and did not include the required elements outlined in § 200.332 (b). The contract for the other entity was more prescriptive and included most of the elements in § 200.332 (b) but also did not have current language referencing the Uniform Guidance, which was effective in 2014 (Contract date was December 4, 2019), and instead referred to outdated requirements under OMB Circular A-133. ­ One contract did not address indirect costs. ­ One contract did not address provisions to permit the County as the grantor to access the entity’s records to audit or fulfill other monitoring responsibilities. ­ Both contracts did not address the terms and conditions concerning the closeout of subawards. Both TANF and Foster Care: • The County did not perform the required fraud risk and risk of noncompliance assessment to determine the appropriate level of monitoring. • The County has not developed and documented a formal subrecipient monitoring plan. Upon inquiry, program management provided a bulleted list of their monitoring activities; however, reviews, meetings, action items, and follow-up were not formally documented to demonstrate the activities were performed. • The County received single audit reports from the two subrecipients identified; however, the County did not reconcile the amounts reported to its records. Foster Care TANF #1 TANF #2 Total Subrecipient’s SEFA $ 0 $ 101,886 $ 232,499 $ 334,385 County SEFA 105,530 43,689 249,560 399,884 Variance (105,530) 58,197 (17,601) (65,499) Cause Program staff were not aware of the requirements to evaluate and classify entities as contractor or subrecipient and did not understand the need to formalize a subrecipient monitoring program in accordance with §200.332. The cause can be partially contributed to turnover in the County’s Health and Human Services Department. Effect Failure to evaluate and identify subrecipients will cause the County to be out of compliance with its oversight responsibilities resulting in the potential for federal funds to be used inappropriately. Failure to provide all the required subaward information may result in subrecipients incorrectly reporting on federal pass-through awards in their Single Audit reports. Failure to have a formal monitoring program that includes risk assessment will result in the County inadequately monitoring the activities of subrecipients and hold them accountable to complete corrective action plans for identified noncompliance. Questioned Costs None. Context Fiscal year 2024 payments to the subrecipients were as listed: • TANF - $293,289 or 9% of total program expenditures. • Foster Care - $139,607 or 6% of total program expenditures. The sample was not a statistically valid sample. Identification as a Repeat Finding Previously reported as Finding 2023-003. Recommendation We recommend the County consider the following: 1. Provide comprehensive training to program managers on how to assess if an entity meets the criteria of a subrecipient as defined in § 200.331. 2. Formalize a subrecipient monitoring program based on the criteria in § 200.332. 3. Design a subrecipient agreement template to include all the elements required by 2 CFR § 200.332(b). Incorporate the use of the template in the contracting requirements for all departments receiving federal funds. 4. For existing subrecipients that were not provided the required elements, provide a letter or amended agreement to include all the required elements of 2 CFR § 200.332(b).

FINDING 2024-002 – Subrecipient Monitoring (Partially Repeated from Prior Year Findings 23-002, 22-002, 21-003, 20-004, 19-005, 18-004, and 17-003) Federal Program: COVID-19 ARP – McKinney Education for Homeless Children Project No: 22-4998-HM and 24-4998-HM Federal Assistance Listing Number: 84.425W Passed Through: Illinois State Board of Education Federal Agency: U.S. Department of Education Criteria/Specific Requirement: A. The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) require the Regional Office to ensure the process to monitor subrecipients of federal funds be consistent with the standards set forth in the Uniform Guidance at 2 CFR 200.332. B. The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.303 Internal Controls states the following: “The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: The Regional Office of Education #47 did not perform subrecipient monitoring procedures including the preparation and retention of monitoring documentation. During audit testing procedures it was determined that: For one (1) of two (2) subrecipients tested, ROE #47: • Did not identify the subaward and applicable requirements in the agreements. • Did not conduct subrecipient monitoring procedures during the year ended June 30, 2024. For two (2) of two (2) subrecipients tested, ROE #47: • Did not evaluate the risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward. • Did not determine whether the subrecipient met the 2 CFR 200 Subpart F Audit requirements criteria for a single audit. Questioned Costs: None Context: The Regional Office of Education #47 expended a total of $917,485 of federal awards in fiscal year 2024. The Regional Office of Education #47 passed-through to subrecipients a total of $191,630 of federal awards in fiscal year 2024 of which $52,029 was funded by COVID-19 ARP – McKinney Education for Homeless Children grant. Effect: The Regional Office of Education #47 is not in compliance with Title 2 of the Code of Federal Regulations (CFR) Part 200.332 as it relates to subrecipient monitoring requirements. Additionally, the effect of noncompliance can result in questioned costs. Cause: Regional Office Management indicated the ROE is not adhering to established subrecipient monitoring policies and procedures to properly detect and prevent noncompliance with subrecipient monitoring requirements. Recommendation: We recommend that the Regional Office of Education #47 adhere to set subrecipient monitoring policies and procedures and maintain effective internal control over federal awards to ensure subrecipients are properly monitored as required by 2 CFR 200.332. This includes: a. Identifying the subaward and applicable requirements in the agreements; b. Evaluating the risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward; c. Utilizing risk assessment results to develop and implement necessary subrecipient monitoring procedures for the fiscal year; d. Conducting subrecipient monitoring procedures; e. Determining whether the subrecipient met the requirement criteria of 2 CFR 200 Subpart F Audit requirements for a single audit; and f. Retaining supporting monitoring documentation. Management’s Response: Effective with the FY25 School Year, the Regional Office will formally identify the subaward and the applicable requirements in our agreements. We will conduct and document subrecipient monitoring procedures. We will determine if the subrecipient met the requirement criteria of 2 CFR 22 Subpart F Audit requirements for a single audit.

U.S. Department of Treasury Federal Financial Assistance Listing 21.027 Coronavirus State and Local Fiscal Recovery Funds Subrecipient Monitoring Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria – Per 2 CFR 200.332, Johnson County is responsible for informing subrecipients of the Federal award identifiers including but not limited to award date, period of performance and Federal awarding agency and Assistance Listing Number and title. Johnson County is required to assess the subrecipient’s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward. In addition, the County should also verify that the subrecipient is audited as required by Subpart F - Audit Requirement under the Uniform Guidance. The monitoring policy should include an initial evaluation of the risk of noncompliance to determine the appropriate level of monitoring required related to the subaward as well as appropriate awarding documentation. Condition – During our testing, we evaluated the procedures for evaluating subrecipient’s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward. We noted the following:  For three (3) of three (3) subrecipients selected, the required evaluation of the subrecipient’s risk of noncompliance was not documented.  For one (1) of three (3) subrecipients selected, the County did not provide a formal subrecipient agreement including the required information noted in 2 CFR 200.332. Cause – The County did not adhere to their established policies and procedures relating to risk assessment when a subrecipient contract is awarded. Effect – The County’s policies were not consistently followed, resulting in noncompliance with subrecipient monitoring requirements in 2 CFR 200.332. Additionally, the County’s control policies were not consistently followed. Questioned Costs – None reported. Context/Sampling – The sample of three (3) subrecipients were selected for subrecipient monitoring testing for the direct award from the US Department of Treasury. The total population across the program was thirteen (13) subrecipients. Repeat Finding from Prior Years – No. Recommendation – We recommend that the County adhere to their policies and procedures in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements. View of Responsible Officials – The understanding of current staff is that the risk assessments were completed as appropriate, however, due to staff turnover the documents have been misplaced and no longer seem to be available. Applicable County teams are working to adopt standards for what documentation is necessary to establish the basis for a transaction, as well as standardizing the repository for such documentation.

Finding 2023-001: Subrecipient Monitoring Identification of federal program: Program Title: Community Economic Adjustment Assistance for Compatible Use and Joint Land Use Studies Assistance Listing Number: 12.610 Award Identification: W9124J2120002 Federal Agency: U.S. Department of Defense, Office of Local Defense Community Cooperation Criteria or Specific Requirement: Title 2 CFR § 200.303(a) requires pass-through entities to establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. All pass-through entities are required to have subrecipient monitoring policies and procedures in place, which conform to the requirements of Title 2 CFR § 200.332 to identify subawards, evaluate risk of noncompliance, and perform monitoring procedures based upon identified risks. Condition: In testing compliance over subrecipient monitoring, we noted the Fund does not have a subrecipient monitoring policy in place that fully conforms with requirements of Title 2 CFR § 200.332. Cause: Historically the Fund has had few subawards and therefore has not developed full written subrecipient monitoring policies and procedures. Effect: The Fund should implement policies and procedures for monitoring subrecipients in accordance with Title 2 CFR § 200.332. Questioned Costs: None Context: While management’s existing process includes certain elements of subrecipient monitoring, a formal adopted policy is not in place that that fully conforms with requirements of Title 2 CFR § 200.332. Repeat finding: No Recommendation: Implement policies and procedures for monitoring subrecipients, including adequate documentation that conforms to the requirements of Title 2 CFR § 200.332. Views of responsible individuals: Management concurs with and will implement the recommendation. See corrective action plan.

Finding 2023-001 – Reporting Identification of federal program: Assistance Listing No. 93.558 – Temporary Assistance for Needy Families. Criteria or specific requirement: Section 200.332 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) provides the requirements for pass-through entities. A pass-through entity (PTE) must clearly identify to the subrecipient the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.332(a)(2); all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.332(a)(3)). Condition: The Organization was not able to provide executed agreements with its subrecipients covering the period under audit that meet the requirements of Section 200.332 of the Uniform Guidance. Cause: Management indicated that the existing subaward agreements, which do not cover the year ended December 31, 2023, were not updated due to an oversight attributed to personnel vacancies. Effect or potential effect: Noncompliance with Section 200.332 of the Uniform Guidance could result in misunderstanding in program compliance requirements. Questioned cost: not applicable. Context: The Organization was not able to provide executed agreements that cover the audit period for the two subawards made under this program. Recommendation: We recommend that the Organization update and execute agreements with its subrecipients that contains all the required elements of Section 200.332 of the Uniform Guidance. Views of responsible officials: The Organization concurs with this finding. See page 40 for corrective action plan.

Finding 2023-001 – Reporting Identification of federal program: Assistance Listing No. 93.558 – Temporary Assistance for Needy Families. Criteria or specific requirement: Section 200.332 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) provides the requirements for pass-through entities. A pass-through entity (PTE) must clearly identify to the subrecipient the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.332(a)(2); all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.332(a)(3)). Condition: The Organization was not able to provide executed agreements with its subrecipients covering the period under audit that meet the requirements of Section 200.332 of the Uniform Guidance. Cause: Management indicated that the existing subaward agreements, which do not cover the year ended December 31, 2023, were not updated due to an oversight attributed to personnel vacancies. Effect or potential effect: Noncompliance with Section 200.332 of the Uniform Guidance could result in misunderstanding in program compliance requirements. Questioned cost: not applicable. Context: The Organization was not able to provide executed agreements that cover the audit period for the two subawards made under this program. Recommendation: We recommend that the Organization update and execute agreements with its subrecipients that contains all the required elements of Section 200.332 of the Uniform Guidance. Views of responsible officials: The Organization concurs with this finding. See page 40 for corrective action plan.

Finding 2023-001 – Reporting Identification of federal program: Assistance Listing No. 93.558 – Temporary Assistance for Needy Families. Criteria or specific requirement: Section 200.332 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) provides the requirements for pass-through entities. A pass-through entity (PTE) must clearly identify to the subrecipient the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.332(a)(2); all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.332(a)(3)). Condition: The Organization was not able to provide executed agreements with its subrecipients covering the period under audit that meet the requirements of Section 200.332 of the Uniform Guidance. Cause: Management indicated that the existing subaward agreements, which do not cover the year ended December 31, 2023, were not updated due to an oversight attributed to personnel vacancies. Effect or potential effect: Noncompliance with Section 200.332 of the Uniform Guidance could result in misunderstanding in program compliance requirements. Questioned cost: not applicable. Context: The Organization was not able to provide executed agreements that cover the audit period for the two subawards made under this program. Recommendation: We recommend that the Organization update and execute agreements with its subrecipients that contains all the required elements of Section 200.332 of the Uniform Guidance. Views of responsible officials: The Organization concurs with this finding. See page 40 for corrective action plan.