Findings Citing § 200.332

Finding Number: 2023-086 Prior Year Finding Number: 2022-082 Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of Homeland Security Government Department/Agency: Virgin Islands Territorial Emergency Management Agency (VITEMA) Disaster Grants - Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Award#: FEMA-4335-DR, FEMA-4340-DR-VI, FEMA-4513-DR Award Periods: 09/20/2017 – 09/07/2026 09/07/2017 – 09/16/2025 04/02/2020 – 05/11/2023 Criteria – A pass-through entity (PTE) must: Identify the Award and Applicable Requirements – Clearly identify to the subrecipient: 1. The award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.331(a)(1); 2. All requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); 3. Any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.331(a)(3)). Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We selected 8 of 27 subrecipients and found the following: - 4 instances where we were unable to obtain subrecipient agreements. - 8 instances with no supporting documentation that VITEMA verified that subrecipients expected to be audited as required by 2 CFR part 200, subpart F. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the subrecipient monitoring compliance requirements or proper identification of subrecipients. Questioned Costs – None. Context – This is a condition identified per review of VITEMA’s compliance with the specified requirements using a statistically valid sample. The total amount of expenditures passed through to subrecipients in fiscal year 2023 was $134,242,935. The total amount of our sample totaled $124,398,401. Effect – VITEMA is not in compliance with the stated provisions. Failure to properly identify and monitor subrecipients can result in noncompliance with laws and regulations and failure to meet the program's objectives. Cause – VITEMA does not have internal controls in place to properly identify and monitor subrecipients to ensure adherence to applicable federal regulations, including expending federal awards for allowable expenditures. Recommendation – We recommend that VITEMA implement policies, procedures, and controls to ensure subrecipients are identified and monitored in accordance with federal statutes. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The formal process for completing and retaining Subrecipient Agreements is now operational to ensure compliance with programmatic obligations. As the Recipient, the Territory is responsible for notifying the Subrecipient when federal funds are obligated and providing them with a subrecipient agreement outlining the program's terms and conditions. The Disaster Program Financial Specialist is responsible for ensuring that the subrecipient agreement is signed by both the Applicant and the Governor's Authorized Representative and provided to the Territorial Public Assistance Officer. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding No.: 2023-020 Federal Agency: U.S. Department of Health and Human Services AL Program: 93.243 Substance Abuse and Mental Health Services – Projects of Regional and National Significance Federal Award No.: 5U79SP020711-04 Questioned Costs: $134,802 Area: Subrecipient Monitoring/Overpayment on Return of Federal Funds Criteria: In accordance with applicable subrecipient monitoring requirements per 2 CFR 200.332, a pass- through entity (PTE) must: 1) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, is used in accordance with the terms and conditions of the subaward, and achieves performance goals. 2) Follow-up and ensure that the subrecipient takes timely and appropriate action on all deficiencies detected through audits, on-site reviews, and other means, pertaining to the subaward. 3) Issue a management decision as required by 2 CFR 200.521 for audit findings pertaining to the Federal award provided to the subrecipient from the PTE . Condition: RepMar did not perform the required monitoring activities for a subrecipient and did not issue a management decision with respect to the subrecipient’s FY2018 Single Audit report dated February 22, 2023. The Single Audit reported questioned costs of $43,335 for noncompliance with allowable costs/cost principles requirements and questioned costs of $91,467 for noncompliance with procurement and suspension and debarment requirements. Furthermore, in the grantor’s March 2023 management decision communication, RepMar was required to refund the grantor for Federal funds reported for noncompliance in the same subrecipient’s FY2016 and FY2017 Single Audit reports. RepMar has since determined that the July 2024 refund included a $267,244 overpayment due to calculation error. Cause: RepMar lacks effective internal control policies and procedures governing subrecipient monitoring. Effect: RepMar is in noncompliance with applicable subrecipient monitoring requirements and overpayment of Federal funds returned. Questioned cost of $134,802 results. Recommendation: RepMar should more closely monitor subrecipients in accordance with subrecipient monitoring requirements. Views of Responsible Officials: RepMar’s Corrective Action Plan does not indicate disagreement and provides planned corrective action.

Finding 2023-004 – Subrecipient Monitoring– Material Weakness and Noncompliance Federal Program: Aging Cluster Federal Agency: U.S. Department of Health and Human Services ALN: 93.044, 93.045, 93.053 (Aging Cluster) Federal Award Number: 2301ALOASS, 2101ALSSC6, 2301ALOACM/2301ALOAHD, 2101ALCMC6/2101ALHDC6 Compliance Requirement: Subrecipient Monitoring Criteria: 2 CFR 200.332 provides various requirements for subrecipient monitoring including the following: • 2 CFR 200.332(d) requires pass-through entities to “monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved”. • 2 CFR 200.332(f) requires pass-through entities to “verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501.” Condition: Warren Averett tested eight subrecipients in the Aging Cluster and noted that two were not monitored adequately during the award period and the Commission did not obtain single audit reports for any of the subrecipients tested. Cause: Although the Commission performed certain procedures required by 2 CFR 200.332, the policies and procedures do not contain adequate guidance to fully address the requirements. Effect: The lack of adequate policies and procedures can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements which could ultimately lead to disallowed costs for the major federal program. Repeat Finding: This is a repeat finding. Questioned Costs: None noted. Recommendation: Warren Averett recommends that the Commission strengthen its documented policies and procedures regarding subrecipient monitoring. View of Responsible Officials: See Corrective Action Plan at the end of the report.

Finding No. 2023-020 Federal Agency: U.S. Department of the Interior AL Program: 15.875 Economic, Social, and Political Development of the Territories Federal Award No.: D23AF00036, D23AP00068, D22AF00299, D21AP10043, D21AP10044, D19AP00081, D17AP00132 Area: Subrecipient Monitoring Questioned Costs: $2,399,988 Criteria: In accordance with 2 CFR 200.303(a), the recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. As stated in 2 CFR 200.332(a), pass-through entities are required to verify that potential subrecipients are not suspended and debarred prior to awarding the agreements. The verification can be done through methods indicated in 2 CFR § 180.300 as follows: (a) Checking SAM.gov Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Additionally, based on 2 CFR 200.332(b), pass-through entities should ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided in 2 CFR 200.322(b)(1) to (6). A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide unavailable information when it is obtained. Further, in accordance with 2 CFR 200.332(c), a pass-through entity should evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in 2 CFR 200.322(f). Lastly, in accordance with 2 CFR 200.332(d)(2), the pass-through entity’s monitoring of the subrecipient must include following-up to ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity. Condition: 1. Of three subrecipients tested, aggregating $970,384 of a total population of $970,384, the following were noted: Finding No. 2023-020, continued Federal Agency: U.S. Department of the Interior AL Program: 15.875 Economic, Social, and Political Development of the Territories Federal Award No.: D23AF00036, D23AP00068, D22AF00299, D21AP10043, D21AP10044, D19AP00081, D17AP00132 Area: Subrecipient Monitoring Questioned Costs: $2,399,988 Condition, continued: a. For three (or 100%), CNMI did not verify whether the subrecipient is excluded or disqualified pursuant to the requirements of 2 CFR 180.300 prior to entering into a subaward agreement. The subaward date for D22AF00299 is unknown as the subaward agreement was not provided, as noted at Condition 1b. No questioned cost is presented for D23AP00068 as there was no subaward disbursement made during FY2023. b. For one (or 33%), CNMI did not provide the signed and approved subaward agreement. No questioned cost is presented as the amount is questioned at Condition 1a. c. For three (or 100%), CNMI did not perform the risk assessment prior to issuing the subaward agreements to the subrecipients. The subaward date for D22AF00299 is unknown as the subaward agreement was not provided, as noted at Condition 1b. No questioned costs are presented as amounts are questioned at Condition 1a for D23AF00036 and D22AF00299 and there was no subaward disbursement made during FY2023 for D23AP00068. Finding No. 2023-020, continued Federal Agency: U.S. Department of the Interior AL Program: 15.875 Economic, Social, and Political Development of the Territories Federal Award No.: D23AF00036, D23AP00068, D22AF00299, D21AP10043, D21AP10044, D19AP00081, D17AP00132 Area: Subrecipient Monitoring Questioned Costs: $2,399,988 2. For two (or 100%) of two subrecipients that incurred expenditures above $750,000 during the year, CNMI did not perform proper monitoring to ensure that they are subjected to single audit requirements or if they have taken appropriate actions on all deficiencies detected from previous single audits. No questioned cost is presented for D23AF00036 as the amount is questioned at Condition 1a. Cause: 1. CNMI’s current policy and procedures for monitoring the suspension and debarment status of the subrecipient prior to entering a subaward agreement is not tailored to the provisions of 2 CFR 180.300. The currently established procedure of CNMI only identifies suspension or debarment upon occurrences of violation which is an after-the-fact approach rather than a preventive process. Finding No. 2023-020, continued Federal Agency: U.S. Department of the Interior AL Program: 15.875 Economic, Social, and Political Development of the Territories Federal Award No.: D23AF00036, D23AP00068, D22AF00299, D21AP10043, D21AP10044, D19AP00081, D17AP00132 Area: Subrecipient Monitoring Questioned Costs: $2,399,988 Cause, continued: 2. CNMI lacks proper monitoring procedures to ensure that an agreement is executed for every new subaward between the pass-through entity and a new or existing subrecipient. 3. CNMI does not have an established subrecipient risk assessment policy and procedures prior to entering into the subaward agreement and to identify the type of monitoring procedures required to be performed for the subrecipient. 4. CNMI does not have an established policy or procedure that monitors whether a subrecipient that incurs expenditures above $750,000 during the year, has hired the services of a reputable auditor to conduct a single audit engagement and to ensure that follow-up corrective actions have been performed as regards to the deficiencies identified during the previous audits. Effect or potential effect: CNMI is in noncompliance with the subrecipient monitoring compliance requirements and questioned costs of $2,399,988 result. Identification of Repeat Finding: Finding No. 2022-019 Recommendation: CNMI should strengthen and enforce compliance with subrecipient monitoring compliance requirements over the following: 1. Establish policies and procedures for monitoring suspension and debarment status of each subrecipient prior to granting any subaward. The guidance should be reflective of the provisions set by 2 CFR 180.300. Finding No. 2023-020, continued Federal Agency: U.S. Department of the Interior AL Program: 15.875 Economic, Social, and Political Development of the Territories Federal Award No.: D23AF00036, D23AP00068, D22AF00299, D21AP10043, D21AP10044, D19AP00081, D17AP00132 Area: Subrecipient Monitoring Questioned Costs: $2,399,988 Recommendation, continued: 2. Improve and strengthen their monitoring procedures to ensure that all subawards are enforced with a properly accomplished agreement that is in accordance with 2 CFR 200.332(a)(1). 3. Establish policies and procedures to ensure that a risk assessment is conducted prior to entering into a subaward agreement with a subrecipient and to identify the level of monitoring required for each type of subrecipient as a result of the risk assessment. 4. Establish policies and procedures to ensure that subrecipient incurring expenditures above $750,000 are properly monitored, that they follow the single audit requirements and that the corrective actions are implemented as a result of prior year audits. Views of Responsible Officials: Condition 1a - For Grant Award Nos. D23AF00036 and D22AF00299, Office of Management and Budget (OMB) agrees with the finding and the need for a formally written policy and procedures for subrecipient monitoring. OMB has adopted the Department of Finance’s Subrecipient Monitoring Policy and Procedures effective 08/04/25 establishing a formal monitoring suspension and debarment status of each subrecipient prior to granting any subaward. The guidance is reflective of the provisions set by 2 CFR 180.300. Conditions 1a and 1c - For Grant Award No. D23AP00068, Capital Improvement Program (CIP) disagrees with this finding because the required verification was performed. Although documentation was not retained, CIP verifies that all subrecipients comply with OPA requirements before federal funds are awarded. Condition 1b - OMB agrees with the finding. OMB fully executed a subrecipient agreement with the subrecipient on 01/27/23, prior to any grant administration taking place. The adoption of the Department of Finance’s Subrecipient Monitoring Policy and Procedures effective 08/04/25 also further formalizes the process. Finding No. 2023-020, continued Federal Agency: U.S. Department of the Interior AL Program: 15.875 Economic, Social, and Political Development of the Territories Federal Award No.: D23AF00036, D23AP00068, D22AF00299, D21AP10043, D21AP10044, D19AP00081, D17AP00132 Area: Subrecipient Monitoring Questioned Costs: $2,399,988 Views of Responsible Officials, continued: Condition 1c - For Grant Award Nos. D23AF00036 and D22AF00299, OMB agrees with the finding and agrees with the need for a formally written policy and procedures for subrecipient monitoring. OMB has adopted the Department of Finance’s Subrecipient Monitoring Policy and Procedures effective 08/04/25 establishing a formal subrecipient risk assessment prior to entering into the subaward agreement and identifying the type of monitoring procedures to be performed for the subrecipient. Condition 2 - For Grant Award No. D23AF00036, OMB agrees with the finding and agree with the need for a formally written policy and procedures for subrecipient monitoring. OMB has adopted the Department of Finance’s Subrecipient Monitoring Policy and Procedures effective 08/04/25 to perform proper monitoring to ensure that subrecipients are in compliance with single audits. For Grant Award No. D17AP00132, D21AP10043, D19AP00081, and D21AP10044, CIP agrees with the finding that a subrecipient with expenditures exceeding $750,000 during the year was not verified for compliance with single audit requirements, including whether corrective actions were taken to address prior audit findings. Refer to CNMI’s Corrective Action Plan for additional information. Auditor Response: Conditions 1a and 1c - CNMI states disagreement for grant award number D23AP00068; however, CNMI also acknowledges that documentation of its verification performed were not kept on file. In accordance with 2 CFR 200.403, costs must be adequately documented to be allowable under federal awards.

Finding No. 2023-034 Federal Agency: U.S. Department of the Treasury AL Program: COVID-19 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award No.: COVID-19 Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Criteria: Per the U.S. Treasury Interim and Final Rules, the U.S. Treasury is aligning the definition of subrecipient in the final rule with the definition of subrecipient in the Uniform Guidance, wherein, subrecipients are entities that receive a subaward from a recipient to carry out a program or project on behalf of the recipient with the recipient’s Federal award funding but does not include an individual that is a beneficiary of such award. The recipient remains responsible for monitoring and overseeing the subrecipient’s use of State and Local Fiscal Recovery Funds (SLFRF) and other activities related to the award to ensure that the subrecipient complies with the statutory and regulatory requirements and the terms and conditions of the award. Recipients also remain responsible for reporting to the U.S. Treasury on their subrecipients’ use of payments from the SLFRF funds for the duration of the award. Accordingly, in accordance with 2 CFR §200.332, a pass-through entity (PTE) must: 1. Verify that the subrecipient is not excluded or disqualified in accordance with §180.300. Verification methods are provided in §180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. 2. Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A PTE must provide the best available information when some of the information below is unavailable. A PTE must provide the unavailable information when it is obtained. One of the required information includes: (1) Federal award identification: (i) Subrecipient’s unique entity identifier; (ii) Federal Award Identification Number (FAIN); (iii) Federal Award Date; (iv) Subaward Period of Performance Start and End Date; (v) Total Amount of Federal Funds Obligated to the subrecipient by the PTE, including the current financial obligation; Finding No. 2023-034, continued Federal Agency: U.S. Department of the Treasury AL Program: COVID-19 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award No.: COVID-19 Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Criteria, continued: (vi) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (vii) Name of the Federal agency; and (viii) Assistance Listings title and number; the PTE must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement. (2) All requirements of the subaward, including requirements imposed by Federal statutes, regulations, and the terms and conditions of the Federal award; (3) Any additional requirements that the PTE imposes on the subrecipient for the PTE to meet its responsibilities under the Federal award. This includes information and certifications (see §200.415) required for submitting financial and performance reports that the PTE must provide to the Federal agency; (4) A requirement that the subrecipient permits the PTE and auditors to access the subrecipient's records and financial statements for the PTE to fulfill its monitoring requirements; and (5) Appropriate terms and conditions concerning the closeout of the subaward. 3. Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a PTE should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and Finding No. 2023-034, continued Federal Agency: U.S. Department of the Treasury AL Program: COVID-19 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award No.: COVID-19 Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Criteria, continued: (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). 4. If appropriate, consider implementing specific conditions in a subaward as described in §200.208 and notify the Federal agency of the specific conditions. 5. Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The PTE is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a PTE must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the PTE as required by §200.521. (4) Resolve audit findings specifically related to the subaward. However, the PTE is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the PTE may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Finding No. 2023-034, continued Federal Agency: U.S. Department of the Treasury AL Program: COVID-19 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award No.: COVID-19 Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Criteria, continued: 6. Depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. 7. Verify that a subrecipient is audited as required by subpart F of this part. 8. Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. 9. Consider taking enforcement action against noncompliant subrecipients as described in §200.339 and in program regulations. Condition: 1. Of four new subawards made during FY2023, aggregating $5,450,541 of a total population of $5,450,541, the following were noted: a. For four (or 100%), documentation of the risk assessments performed and verification as to whether the subrecipients are not suspended, debarred, or otherwise excluded from receiving Federal funds, were not provided. Finding No. 2023-034, continued Federal Agency: U.S. Department of the Treasury AL Program: COVID-19 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award No.: COVID-19 Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Condition, continued: b. For two (or 50%), subaward agreements provided were incomplete (pages missing). Accordingly, we could not determine if the subawards: (1) Were clearly identified to the subrecipients as subawards; (2) Included the following required information: (a) Federal award identification numbers (FAIN); (b) Federal award date; (c) Subaward period of performance start and end dates; (d) Total amount of federal funds obligated to the subrecipient by the pass-through entity including the current financial obligation for subaward number CNMI22046A/CNMI22046B, which has multiple subawards; (e) Total amount of the federal award committed to the subrecipient by the pass-through entity for subaward number CNMI22046A/CNMI22046, which has multiple subawards; (f) Name of Federal awarding agency; (g) Assistance Listing number for subaward number CNMI22046A/CNMI22046B); (h) Identification of the dollar amount made available under each Federal award at the time of disbursements; (3) Included all requirements of the subawards, including requirements imposed by Federal statutes, regulations, and the terms and conditions of the Federal award; (4) Included any additional requirements that the pass-through entity imposes on the subrecipient for the pass-through entity to meet its responsibilities under the Federal award. This includes information and certifications (see §200.415) required for submitting financial and performance reports that the pass-through entity must provide to the Federal agency; Finding No. 2023-034, continued Federal Agency: U.S. Department of the Treasury AL Program: COVID-19 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award No.: COVID-19 Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Condition, continued: (5) Included requirements that the subrecipients permit the pass-through entity and auditors to access the subrecipients’ records and financial statements for the pass-through entity to fulfill its monitoring requirements; and (6) Included appropriate terms and conditions concerning the closeout of the subaward. In addition, the page reflecting the award date for subaward number CNMI22051 was also not provided; thus, the award date is presented as Unknown. No questioned costs are presented as amounts are questioned at Condition 1a. c. For two (or 50%), subaward agreements did not include the following required information: (1) Subrecipients’ unique entity identifiers; (2) Federal award identification numbers (FAIN); (3) Federal award date; (4) Total amount of federal funds obligated to the subrecipient by the pass-through entity including the current financial obligation for subaward number CNMI22044A, which has two subawards; (5) Total amount of the federal award committed to the subrecipient by the pass-through entity for subaward number CNMI22044A, which has two subawards; (6) Identification of the dollar amount made available under each Federal award at the time of disbursements; (7) Appropriate terms and conditions concerning the closeout of the subaward No questioned costs are presented as amounts are questioned at Condition 1a. Finding No. 2023-034, continued Federal Agency: U.S. Department of the Treasury AL Program: COVID-19 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award No.: COVID-19 Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Condition, continued: 2. Of seven subrecipients tested for monitoring compliance requirements, aggregating $15,640,541 of a total population of $15,640,541, documentation on monitoring procedures performed during FY2023 for the seven (or 100%) subrecipients, including documentation of the verification as to whether the subrecipients are subject to the audit requirements, were not provided. In addition, other than Award Number CNMI22044, subaward agreements for six subrecipients were not provided; accordingly, award dates were presented as unknown. No questioned costs are presented for six subrecipients as there were no subaward disbursements made during FY2023. Finding No. 2023-034, continued Federal Agency: U.S. Department of the Treasury AL Program: COVID-19 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award No.: COVID-19 Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Condition, continued: 3. Of nine monitoring procedure requirements tested at the invoice/disbursement level, aggregating $16,693,880 of a total population of $16,693,880, for five (or 56%) disbursements, review and approval of either the invoices, drawdowns and/or payment requests to ensure that subrecipients used the subaward for authorized purposes in compliance with Federal statutes, regulations, and the terms and conditions of the subawards, were not evident. Cause: 1. CNMI does not have approved/adopted written subrecipient monitoring policies and procedures; 2. Documentation of the risks assessments and the monitoring procedures performed, including verifications as to whether the subrecipients are subject to the audit requirements and are not suspended, debarred, or otherwise excluded from receiving Federal funds, could not be located on file and/or were not performed; 3. CNMI failed to enforce compliance with subrecipient monitoring compliance requirements and lacks monitoring controls over the subrecipient monitoring compliance requirements. Finding No. 2023-034, continued Federal Agency: U.S. Department of the Treasury AL Program: COVID-19 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award No.: COVID-19 Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Cause: 4. Inadequate documentation and systematic filing of relevant documentation supporting program costs. In addition, for award numbers CNMI22044 and CNMI22044A, the Entity’s management has determined that it should be classified as a contractor under the agreement as the Entity’s role is to promote the program within CNMI, develop a marketing and promotional campaign and disburse the award to the recipients identified by the CNMI. The Entity was not involved in reviewing and deciding which grant applicant is eligible to receive the grant. CNMI’s role in the review of grant applications and eligibility determination may have caused confusion as to whether the Entity that received the funds is a subrecipient or a contractor. As of the auditor’s report date, CNMI and the Entity have yet to conclude whether the Entity received the funds in the role of a subrecipient or a contractor. Effect or Potential Effect: CNMI is in noncompliance with applicable subrecipient monitoring compliance requirements and questioned costs of $15,640,541 result. Identification as a Repeat Finding: Finding No. 2022-031 Recommendation: We recommend CNMI establish approved/adopted written subrecipient monitoring policies and procedures and an approved template that includes all required clauses needed for subrecipient agreements. In addition, CNMI should implement and enforce monitoring internal control procedures over the following: Finding No. 2023-034, continued Federal Agency: U.S. Department of the Treasury AL Program: COVID-19 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Award No.: COVID-19 Area: Subrecipient Monitoring Questioned Costs: $15,640,541 Recommendation, continued: 1. Verification as to whether the subrecipients are not suspended, debarred, or otherwise excluded from receiving Federal funds; 2. Evaluation over each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring; 3. Monitoring procedures to ensure that all subaward agreements include the required information in accordance with 2 CFR §200.332(b)(1); 4. Monitoring activities of a subrecipient to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward; 5. Verification that subrecipients are audited as required by 2 CFR Part 200 Subpart F; and 6. Adequate documentation and systematic filing of relevant documentation supporting program costs. Views of Responsible Officials: Conditions 1 to 3 - CNMI Department of Finance agrees with this finding. During FY2023, the Department of Finance became aware that existing practices for subrecipient monitoring did not fully meet federal requirements under 2 CFR 200.331–200.332. DOF began implementing corrective actions in the latter part of FY2023 and continued strengthening procedures throughout FY2024, including improvements in documentation, SAM.gov verification, and basic risk assessment elements. Refer to CNMI’s Corrective Action Plan for additional information.

Finding No. 2023-038 Federal Agency: U.S. Department of Education AL Program: COVID-19 84.425H Education Stabilization Fund - Governors (Outlying Areas) (ESF-Governor) Federal Award No.: S425H210001 Area: Subrecipient Monitoring Questioned Costs: $6,641,757 Criteria: Per 2 CFR § 200.1, a subrecipient in the Uniform Guidance are entities that receive a subaward from a recipient to carry out a program or project on behalf of the recipient with the recipient’s Federal award funding but does not include an individual that is a beneficiary of such award. The U.S. Department of Education engages with non-Federal entities by awarding federal funds in the form of a subaward as an extension of its services. The recipient remains responsible for monitoring and overseeing the use of federal funds and other activities related to the award to ensure that the subrecipient complies with the statutory and regulatory requirements and the terms and conditions of the award. Recipients also remain responsible for reporting to the U.S. Department of Education on their subrecipients’ use of payments from the ESF-Governor funds for the duration of the award. Accordingly, in accordance with 2 CFR §200.332, a pass-through entity (PTE) must: (a) Verify that the subrecipient is not excluded or disqualified in accordance with §180.300. Verification methods are provided in §180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A PTE must provide the best available information when some of the information below is unavailable. A PTE must provide the unavailable information when it is obtained. One of the required information includes: (1) Federal award identification: (i) Subrecipient’s unique entity identifier; (ii) Federal Award Identification Number (FAIN); (iii) Federal Award Date; (iv) Subaward Period of Performance Start and End Date; (v) Total Amount of Federal Funds Obligated to the subrecipient by the PTE, including the current financial obligation; Finding No. 2023-038, continued Federal Agency: U.S. Department of Education AL Program: COVID-19 84.425H Education Stabilization Fund - Governors (Outlying Areas) (ESF-Governor) Federal Award No.: S425H210001 Area: Subrecipient Monitoring Questioned Costs: $6,641,757 Criteria, continued: (vi) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (vii) Name of the Federal agency; and (viii) Assistance Listings title and number; the PTE must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement. (2) All requirements of the subaward, including requirements imposed by Federal statutes, regulations, and the terms and conditions of the Federal award; (3) Any additional requirements that the PTE imposes on the subrecipient for the PTE to meet its responsibilities under the Federal award. This includes information and certifications (see §200.415) required for submitting financial and performance reports that the PTE must provide to the Federal agency; (4) A requirement that the subrecipient permits the PTE and auditors to access the subrecipient's records and financial statements for the PTE to fulfill its monitoring requirements; and (5) Appropriate terms and conditions concerning the closeout of the subaward. (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a PTE should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and Finding No. 2023-038, continued Federal Agency: U.S. Department of Education AL Program: COVID-19 84.425H Education Stabilization Fund - Governors (Outlying Areas) (ESF-Governor) Federal Award No.: S425H210001 Area: Subrecipient Monitoring Questioned Costs: $6,641,757 Criteria, continued: (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (d) If appropriate, consider implementing specific conditions in a subaward as described in §200.208 and notify the Federal agency of the specific conditions. (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The PTE is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a PTE must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the PTE as required by §200.521. (4) Resolve audit findings specifically related to the subaward. However, the PTE is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the PTE may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Finding No. 2023-038, continued Federal Agency: U.S. Department of Education AL Program: COVID-19 84.425H Education Stabilization Fund - Governors (Outlying Areas) (ESF-Governor) Federal Award No.: S425H210001 Area: Subrecipient Monitoring Questioned Costs: $6,641,757 Criteria, continued: (f) Depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. (g) Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 and in program regulations. Condition: 1. For two (or 100%) new subawards made during FY2023, aggregating $6,641,757 of a total population of $6,641,757, there was no documentation of the risk assessments performed and verification as to whether the subrecipients are not suspended, debarred, or otherwise excluded from receiving Federal funds. Finding No. 2023-038, continued Federal Agency: U.S. Department of Education AL Program: COVID-19 84.425H Education Stabilization Fund - Governors (Outlying Areas) (ESF-Governor) Federal Award No.: S425H210001 Area: Subrecipient Monitoring Questioned Costs: $6,641,757 Condition, continued: Further, the subaward agreements did not include the following required information: (1) Subrecipients’ unique entity identifiers; and (2) Appropriate terms and conditions concerning the closeout of the subaward. 2. For two (or 100%) subrecipients subject to monitoring compliance requirements, aggregating $6,641,757 of a total population of $6,641,757, there was no documentation on monitoring procedures performed during FY2023, and no documentation of the verification as to whether the subrecipients are subject to the audit requirements. CNMI did not provide evidence of procedures used to determine that the subrecipients (which expended more than $750,000 in Federal awards) have met the audit requirement of 2 CFR part 200, subpart F and that the required audits are completed within nine months of the end of the subrecipient’s audit period. No questioned costs are presented as amounts are questioned at Condition 1. Cause: 1. CNMI does not have an established subrecipient risk assessment policy and procedures prior to entering into the subaward agreement and to identify the type of monitoring procedures required to be performed for the subrecipient. 2. CNMI does not have an established policy or procedure that monitors whether a subrecipient that incurs expenditures above $750,000 during the year, has hired the services of a reputable auditor to conduct a single audit engagement and to ensure that follow-up corrective actions have been performed as regards to the deficiencies identified during the previous audits. 3. Inadequate documentation and systematic filing of relevant documentation supporting program costs. Finding No. 2023-038, continued Federal Agency: U.S. Department of Education AL Program: COVID-19 84.425H Education Stabilization Fund - Governors (Outlying Areas) (ESF-Governor) Federal Award No.: S425H210001 Area: Subrecipient Monitoring Questioned Costs: $6,641,757 Effect or Potential Effect: CNMI is in noncompliance with applicable subrecipient monitoring compliance requirements and questioned costs of $6,641,757 result for Condition 1. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend CNMI establish approved/adopted written subrecipient monitoring policies and procedures and an approved template that includes all required clauses needed for subrecipient agreements. In addition, CNMI should implement and enforce monitoring internal control procedures over the following: a. Evaluation over each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring; b. Monitoring procedures to ensure that all subaward agreements include the required information in accordance with 2 CFR §200.332(b)(1); c. Monitoring activities of a subrecipient to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward; d. Verification that subrecipients are audited as required by 2 CFR Part 200 Subpart F; and e. Adequate documentation and systematic filing of relevant documentation supporting program costs. Finding No. 2023-038, continued Federal Agency: U.S. Department of Education AL Program: COVID-19 84.425H Education Stabilization Fund - Governors (Outlying Areas) (ESF-Governor) Federal Award No.: S425H210001 Area: Subrecipient Monitoring Questioned Costs: $6,641,757 Views of Responsible Officials: Conditions 1 and 2 - CNMI Department of Finance agrees with this finding. CNMI submitted risk assessment and monitoring compliance documentation to the auditor on February 26, 2026, after the agreed February 19, 2026 deadline, resulting in evidence timing deficiency. CNMI established Standard Operating Procedures for subrecipient monitoring effective October 28, 2026. Management will implement standardized file labeling and retention procedures in accordance with the SOP so that each subrecipient file contains the subrecipient determination, required subaward clauses, the unique entity identifier, documented SAM.gov exclusion checks, and verification of audit requirements. In alignment with 2 CFR §200.332, CNMI will review financial and performance reports quarterly, conduct an annual performance assessment using a standardized checklist (updated annually or upon project completion), maintain documentation of all monitoring activities, and verify audit status for entities subject to the Single Audit Act. The risk assessment and monitoring compliance documentation for this grant is available to the auditor upon request. Refer to CNMI’s Corrective Action Plan for additional information.

Finding No. 2023-050 Federal Agency: U.S. Department of the Homeland Security AL Program: 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) Federal Award No.: FEMA-4396-DR; FEMA-4235-DR; FEMA-4404-DR; FEMA-4511-DR Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Criteria: In accordance with 2 CFR 200.332, a pass-through entity (PTE) must do the following: 1. Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. When evaluating subrecipient’s risk, a PTE should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). 2. Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The PTE is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a PTE must review financial and performance reports. 3. Verify that a subrecipient is audited as required by Subpart F when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Condition: 1. For five (or 100%) new subawards tested, aggregating $2,415,252, of a total population of $2,415,252, documentation was not provided to indicate that subrecipient risk assessments were performed to determine the appropriate level of subrecipient monitoring required for the subrecipient. Finding No. 2023-050, continued Federal Agency: U.S. Department of the Homeland Security AL Program: 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) Federal Award No.: FEMA-4396-DR; FEMA-4235-DR; FEMA-4404-DR; FEMA-4511-DR Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Condition, continued: Further, CNMI did not provide a subaward agreement to the subrecipient to identify the subaward as a new award and other applicable requirements, so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award and any additional requirements imposed by CNMI to meet its own responsibility for the federal award. No questioned costs are presented as the amounts are questioned at Condition 2a. 2. Of eight subrecipients tested, aggregating $7,350,898, of a total population of $7,435,319, the following were noted: a. For eight (or 100%), CNMI did not provide evidence of its review of financial and programmatic reports. Finding No. 2023-050, continued Federal Agency: U.S. Department of the Homeland Security AL Program: 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) Federal Award No.: FEMA-4396-DR; FEMA-4235-DR; FEMA-4404-DR; FEMA-4511-DR Area: Subrecipient Monitoring Questioned Costs: $7,350,898 b. For two (or 25%), CNMI did not perform appropriate review and/or follow up of the subrecipients’ audited financial statements for fiscal year 2023, dated May 7, 2025 for subrecipient identified at No. 1 and October 7, 2025 for subrecipient identified at No. 2. The Schedule of Expenditures of Federal Awards (SEFA) for subrecipient No. 1 failed to include the funding it received from the CNMI. The amount passed-through to subrecipient identified at No. 2 from the CNMI did not match the amount reported in the SEFA by $103K. No questioned costs are presented as the amounts are questioned at Condition 2a. Finding No. 2023-050, continued Federal Agency: U.S. Department of the Homeland Security AL Program: 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) Federal Award No.: FEMA-4396-DR; FEMA-4235-DR; FEMA-4404-DR; FEMA-4511-DR Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Condition, continued: c. For three (or 38%), CNMI did not provide evidence of procedures used to determine that subrecipients expending $750,000 or more in Federal awards have met the audit requirement of 2 CFR part 200, subpart F and that the required audits are completed within nine months of the end of the subrecipient’s audit period. In addition, we are aware that Single Audit Reports are due for the Commonwealth Healthcare Corporation; however, the audit is still ongoing. No questioned costs are presented as the amounts are questioned at Condition 2a. Cause: CNMI lacks adequate procedures and internal controls to properly monitor subrecipient monitoring compliance requirements. Effect or Potential Effect: CNMI is in noncompliance with applicable subrecipient monitoring compliance requirements and questioned costs of $7,350,898 result for Condition 2a. Finding No. 2023-050, continued Federal Agency: U.S. Department of the Homeland Security AL Program: 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) Federal Award No.: FEMA-4396-DR; FEMA-4235-DR; FEMA-4404-DR; FEMA-4511-DR Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Identification as a repeat finding: Finding No. 2022-044 Recommendation: CNMI should apply effective internal controls and procedures over subrecipient monitoring and consider developing a tracking system to monitor compliance with applicable subrecipient monitoring requirements. Views of Responsible Officials: Conditions 1 and 2 - CNMI Public Assistance Office (PAO) acknowledges and agrees with the compliance deficiencies identified regarding subrecipient monitoring and documentation requirements under 2 CFR §200.332 and has developed corrective actions to address these weaknesses. However, PAO respectfully disagrees with the questioned costs determination. The finding relates to deficiencies in monitoring procedures and documentation rather than the allowability, eligibility, or support for the underlying expenditures. The expenditures identified were associated with FEMA-approved projects and no specific costs were identified as unallowable, unsupported, outside the approved scope of work, or otherwise ineligible for federal participation. While PAO recognizes that monitoring documentation was insufficient to demonstrate compliance with subrecipient monitoring requirements, PAO believes the appropriate classification is a compliance finding without questioned costs. Accordingly, PAO respectfully requests consideration that questioned costs associated with this finding be reduced to $-0-. Refer to CNMI’s Corrective Action Plan for additional information. Auditor Response: Conditions 1 and 2 - CNMI states disagreement with the questioned costs; however, CNMI also acknowledges that documentation supporting subrecipient monitoring compliance requirements were not provided. Questioned costs are retained as costs at the time of the audit were not supported by adequate documentation.

Subrecipient Monitoring Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 – 2021, 1505-0270 – 2021. January 6, 2022 – December 29, 2022 and May 5, 2021 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (d) through (f), all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: TDHCA maintains a Master Planning Summary (MPS) to track all active subrecipient contracts that have expenditures in the planning phase, which are to be considered for sampling and potential selection for review. During our testing, we noted one subrecipient contract with expenditures during the fiscal year that was not included in the MPS for potential selection for a review. Questioned costs: None. Context: See “Condition.” Cause: Management is not adhering to the subrecipient monitoring procedures to ensure all active subrecipient contracts with expenditures incurred during the fiscal year are at least considered for review by being included in the MPS. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat finding: No Recommendation: We recommend that TDHCA strengthen its internal controls to ensure that all subrecipients are included in the MPS and subject to review. Views of responsible officials: The Department’s Compliance Subrecipient Monitoring (CMSM) staff acknowledges that a subrecipient was erroneously not included in the Master Planning Summary. However, the Department’s procedures for risk assessment and monitoring activities for this review period remain compliant with 2 CFR section 200.303(a) as well as 2 CFR section 200.331(6)(b). Risk assessment for non-formula funded contracts is 100% risk based. Both risk assessment and subsequent monitoring functions represent a snapshot of the Department’s pass-through activities and 100% review is not required. It is the Department’s stance that this error does not materially impact the risk assessment process or the scope of this audit.

Subrecipient Monitoring Federal Agency: U.S. Department of Education Federal Program Title: Adult Education- Basic Grants to States ALN: 84.002 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: V002A200044, V002A210044, V002A220044, V002A230044 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (d) through (f), TWC must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: Per review of TWC's Subrecipient Monitoring Department's (SRM) Annual Monitoring Plan, the Adult Education and Literacy (AEL) program is designed to meet the education and training needs of adults. SRM will continue to work closely with the Workforce Development Division to identify the fiscal and program areas that present the highest risk to the Agency. SRM will also conduct data validation reviews of all AEL providers, once during each five-year grant period. During our testing, we noted seven AEL subrecipients were excluded from the SRM Plan and no reviews or data validations were performed within the previous five years. Questioned costs: None. Context: See “Condition.” Cause: Management is not adhering to the subrecipient monitoring procedures to ensure all Adult Education and Literacy subrecipients have a data validation review once during each five-year granting period. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend that TWC strengthen its internal controls to ensure that monitoring over all subrecipients is completed. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding with one observation. Follow-up review indicates that only 6 of 7 AEL subrecipients tested were not included in the risk assessment. ‘Restore Education’ was, in fact, assessed. It was SRM’s understanding from prior guidance that the types of AEL subrecipients tested as part of this audit were not applicable to SRM’s risk assessment process. We have confirmed with TWC’s AEL program staff that they should have been in scope for SRM’s annual and mid-year risk assessments.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Reference Number: 2023-002 – Significant Deficiency, Subrecipient Monitoring Criteria: Pass through entities must clearly identify to the subrecipient: (1) the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.332(a)(l); (2) all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.332(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.332(a)(3)). Condition: The contracts between the Council and its subrecipients did not identify the correct federal find source to its subrecipient as prescribed by 2 CFR Section 200.332. Cause: Historically, the Council has always received funding from the Department of Justice through the State of Texas. During 2023, grant award notifications indicated that the source of funding was the Department of Treasury under Assistance Listing Number 21.027, identified as Coronavirus State Fiscal Recovery Fund (Victims of Crime -SB 8). Controls in place did not allow the Council to notice that the funding source had changed and continued to inform its subrecipients that the federal funds came from the Department of Justice. Effect: The Council's subrecipients may not have timely or accurate information to determine the applicability of certain compliance requirements under the Uniform Guidance specific to the applicable Assistance Listing Number. Recommendation: Management should update policies and procedures to ensure that relevant staff are aware of funding sources and compliance requirements with respect to those sources. Management should update its sub-grant templates to ensure that required information is communicated to subrecipients. Management Response: See management’s corrective action plan.

Reference Number: 2023-002 – Significant Deficiency, Subrecipient Monitoring Criteria: Pass through entities must clearly identify to the subrecipient: (1) the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.332(a)(l); (2) all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.332(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.332(a)(3)). Condition: The contracts between the Council and its subrecipients did not identify the correct federal find source to its subrecipient as prescribed by 2 CFR Section 200.332. Cause: Historically, the Council has always received funding from the Department of Justice through the State of Texas. During 2023, grant award notifications indicated that the source of funding was the Department of Treasury under Assistance Listing Number 21.027, identified as Coronavirus State Fiscal Recovery Fund (Victims of Crime -SB 8). Controls in place did not allow the Council to notice that the funding source had changed and continued to inform its subrecipients that the federal funds came from the Department of Justice. Effect: The Council's subrecipients may not have timely or accurate information to determine the applicability of certain compliance requirements under the Uniform Guidance specific to the applicable Assistance Listing Number. Recommendation: Management should update policies and procedures to ensure that relevant staff are aware of funding sources and compliance requirements with respect to those sources. Management should update its sub-grant templates to ensure that required information is communicated to subrecipients. Management Response: See management’s corrective action plan.

Subrecipient Monitoring Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 – 2021, 1505-0270 – 2021. January 6, 2022 – December 29, 2022 and May 5, 2021 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (d) through (f), all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: TDHCA maintains a Master Planning Summary (MPS) to track all active subrecipient contracts that have expenditures in the planning phase, which are to be considered for sampling and potential selection for review. During our testing, we noted one subrecipient contract with expenditures during the fiscal year that was not included in the MPS for potential selection for a review. Questioned costs: None. Context: See “Condition.” Cause: Management is not adhering to the subrecipient monitoring procedures to ensure all active subrecipient contracts with expenditures incurred during the fiscal year are at least considered for review by being included in the MPS. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat finding: No Recommendation: We recommend that TDHCA strengthen its internal controls to ensure that all subrecipients are included in the MPS and subject to review. Views of responsible officials: The Department’s Compliance Subrecipient Monitoring (CMSM) staff acknowledges that a subrecipient was erroneously not included in the Master Planning Summary. However, the Department’s procedures for risk assessment and monitoring activities for this review period remain compliant with 2 CFR section 200.303(a) as well as 2 CFR section 200.331(6)(b). Risk assessment for non-formula funded contracts is 100% risk based. Both risk assessment and subsequent monitoring functions represent a snapshot of the Department’s pass-through activities and 100% review is not required. It is the Department’s stance that this error does not materially impact the risk assessment process or the scope of this audit.

Subrecipient Monitoring Federal Agency: U.S. Department of Education Federal Program Title: Adult Education- Basic Grants to States ALN: 84.002 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: V002A200044, V002A210044, V002A220044, V002A230044 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (d) through (f), TWC must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: Per review of TWC's Subrecipient Monitoring Department's (SRM) Annual Monitoring Plan, the Adult Education and Literacy (AEL) program is designed to meet the education and training needs of adults. SRM will continue to work closely with the Workforce Development Division to identify the fiscal and program areas that present the highest risk to the Agency. SRM will also conduct data validation reviews of all AEL providers, once during each five-year grant period. During our testing, we noted seven AEL subrecipients were excluded from the SRM Plan and no reviews or data validations were performed within the previous five years. Questioned costs: None. Context: See “Condition.” Cause: Management is not adhering to the subrecipient monitoring procedures to ensure all Adult Education and Literacy subrecipients have a data validation review once during each five-year granting period. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend that TWC strengthen its internal controls to ensure that monitoring over all subrecipients is completed. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding with one observation. Follow-up review indicates that only 6 of 7 AEL subrecipients tested were not included in the risk assessment. ‘Restore Education’ was, in fact, assessed. It was SRM’s understanding from prior guidance that the types of AEL subrecipients tested as part of this audit were not applicable to SRM’s risk assessment process. We have confirmed with TWC’s AEL program staff that they should have been in scope for SRM’s annual and mid-year risk assessments.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Reference Number: 2023-002 – Significant Deficiency, Subrecipient Monitoring Criteria: Pass through entities must clearly identify to the subrecipient: (1) the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.332(a)(l); (2) all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.332(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.332(a)(3)). Condition: The contracts between the Council and its subrecipients did not identify the correct federal find source to its subrecipient as prescribed by 2 CFR Section 200.332. Cause: Historically, the Council has always received funding from the Department of Justice through the State of Texas. During 2023, grant award notifications indicated that the source of funding was the Department of Treasury under Assistance Listing Number 21.027, identified as Coronavirus State Fiscal Recovery Fund (Victims of Crime -SB 8). Controls in place did not allow the Council to notice that the funding source had changed and continued to inform its subrecipients that the federal funds came from the Department of Justice. Effect: The Council's subrecipients may not have timely or accurate information to determine the applicability of certain compliance requirements under the Uniform Guidance specific to the applicable Assistance Listing Number. Recommendation: Management should update policies and procedures to ensure that relevant staff are aware of funding sources and compliance requirements with respect to those sources. Management should update its sub-grant templates to ensure that required information is communicated to subrecipients. Management Response: See management’s corrective action plan.

Reference Number: 2023-002 – Significant Deficiency, Subrecipient Monitoring Criteria: Pass through entities must clearly identify to the subrecipient: (1) the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.332(a)(l); (2) all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.332(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.332(a)(3)). Condition: The contracts between the Council and its subrecipients did not identify the correct federal find source to its subrecipient as prescribed by 2 CFR Section 200.332. Cause: Historically, the Council has always received funding from the Department of Justice through the State of Texas. During 2023, grant award notifications indicated that the source of funding was the Department of Treasury under Assistance Listing Number 21.027, identified as Coronavirus State Fiscal Recovery Fund (Victims of Crime -SB 8). Controls in place did not allow the Council to notice that the funding source had changed and continued to inform its subrecipients that the federal funds came from the Department of Justice. Effect: The Council's subrecipients may not have timely or accurate information to determine the applicability of certain compliance requirements under the Uniform Guidance specific to the applicable Assistance Listing Number. Recommendation: Management should update policies and procedures to ensure that relevant staff are aware of funding sources and compliance requirements with respect to those sources. Management should update its sub-grant templates to ensure that required information is communicated to subrecipients. Management Response: See management’s corrective action plan.

Department of Treasury Program Name: Emergency Rental Assistance Program Federal Assistance Listing Number: 21.023 Nonmaterial Noncompliance, Material Weakness – Subrecipient Monitoring Finding 2023-001 Criteria: An effective system of internal control contemplates that management properly review and assess the subrecipient through monitoring procedures and document the results of the procedures performed. This includes ensuring the subrecipient is following all direct and material compliance requirements applicable to each federal program. Condition: It was discovered while testing the program that the City did not monitor the activity of its subrecipient for the Emergency Rental Assistance Program and did not have a plan to complete monitoring for fiscal year 2023. However, the City did properly obtain and review the subrecipients single audit report for fiscal year 2022. Effect: The subrecipient could provide federal funds to ineligible individuals resulting in questioned costs that could go undetected by the City. Questioned Costs: No questioned costs were identified as a result of our procedures. Cause: The City has an overall policy on monitoring subrecipients but individual departments do not have formal policies or guidelines in place for specific monitoring plans on each of their subrecipients/programs. Recommendation: We recommend the City require, as part of their subrecipient policy, that departments have written monitoring plans for each program that utilizes subrecipients that includes, but is not limited to, an annual risk assessment of the subrecipient, timeline for monitoring (monthly, quarterly, semi-annually, annually) to take place and how it will communicate and follow up with any findings identified from the monitoring. Furthermore, management should further utilize 2 CFR 200.332 to ensure all monitoring requirements are met. Views of responsible officials: Management agrees with the finding and is implementing procedures to correct this which is further discussed in the corrective action plan. Corrective Action Plan: See Corrective Action Plan prepared by the City.

Department of Treasury Program Name: Emergency Rental Assistance Program Federal Assistance Listing Number: 21.023 Nonmaterial Noncompliance, Material Weakness – Subrecipient Monitoring Finding 2023-001 Criteria: An effective system of internal control contemplates that management properly review and assess the subrecipient through monitoring procedures and document the results of the procedures performed. This includes ensuring the subrecipient is following all direct and material compliance requirements applicable to each federal program. Condition: It was discovered while testing the program that the City did not monitor the activity of its subrecipient for the Emergency Rental Assistance Program and did not have a plan to complete monitoring for fiscal year 2023. However, the City did properly obtain and review the subrecipients single audit report for fiscal year 2022. Effect: The subrecipient could provide federal funds to ineligible individuals resulting in questioned costs that could go undetected by the City. Questioned Costs: No questioned costs were identified as a result of our procedures. Cause: The City has an overall policy on monitoring subrecipients but individual departments do not have formal policies or guidelines in place for specific monitoring plans on each of their subrecipients/programs. Recommendation: We recommend the City require, as part of their subrecipient policy, that departments have written monitoring plans for each program that utilizes subrecipients that includes, but is not limited to, an annual risk assessment of the subrecipient, timeline for monitoring (monthly, quarterly, semi-annually, annually) to take place and how it will communicate and follow up with any findings identified from the monitoring. Furthermore, management should further utilize 2 CFR 200.332 to ensure all monitoring requirements are met. Views of responsible officials: Management agrees with the finding and is implementing procedures to correct this which is further discussed in the corrective action plan. Corrective Action Plan: See Corrective Action Plan prepared by the City.

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2023-001 Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2023 Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Condition While the University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports, subsequent review of Uniform Guidance reports for monitoring purposes is not consistently completed. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment, or no less frequently than an annual basis per University policy, however, for 4 out of 25 subaward selections, the subawards were not amended within a year. As such, over a year passed since a Uniform Guidance report was reviewed for these subrecipients for monitoring purposes. Additionally, given the risk assessments are used to cover certain post-award subrecipient monitoring requirements, we noted the following: • 4 out of 25 selections did not have clear documentation as to which Uniform Guidance report had been specifically reviewed • 3 out of 25 subrecipients had findings/deficiencies in their Uniform Guidance reports and there was no documentation for how the University concluded these were not relevant to their subawards • 1 out of 5 subrecipients without Uniform Guidance reports did not have notations on alternative support that was reviewed in lieu of Uniform Guidance reports, as required by University policy. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause Review of Uniform Guidance reports for post-award monitoring purposes is dependent upon a subaward amendment being executed. If an annual amendment is not executed, there is a gap in the monitoring process as the latest Uniform Guidance reports did not get reviewed. While the University expected all subrecipients to have a subaward amendment processed within a year, the testing noted above identified instances where no amendment was processed, and as such, a Uniform Guidance report was not reviewed within that period of time. Additionally, in regard to the completeness of documentation within the risk assessments, while individuals executing the subaward agreements are required to review the risk assessment form in conjunction with the agreement, there is no formal secondary review required to be evidenced and as such, certain elements were overlooked. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. In addition, the lack of review of the risk assessment form may result in missing information not being identified. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the University review their policies and procedures specific to reviewing Uniform Guidance reports of subrecipients for post-award monitoring purposes to ensure all subrecipient reports are reviewed annually. Additionally, we recommend a formal secondary sign-off be included on the risk assessment form to ensure completeness and agreement with conclusions reached. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings