Findings Citing § 200.332

Finding 2023-015: U.S. Department of the Treasury ALN #21.027, Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Grant #SLFRP1747 Criteria: Federal regulation, 2 CFR 200.332, requires pass-through entities, as part of subrecipient monitoring, to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring. The activities of the subrecipient must then be monitored as necessary to ensure compliance. Pass-through entities are also responsible for verifying every subrecipient that expends $750,000 in federal awards in a fiscal year is audited. Non-federal entities are required to follow up on and resolve any findings pertaining to the federal award identified by these audits. Federal regulation, 2 CFR 200.303, requires non-federal entities to, among other things, establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Natural Resources and Conservation (department) did not have sufficient controls to ensure every subrecipient receiving State and Local Fiscal Recovery Fund (SLFRF) grant funds was evaluated for risk of noncompliance or reviewed for the applicability of single audit requirements, as required by federal regulations. Questioned Costs: No questioned costs identified. Context: As part of administering the SLFRF program, which was a new grant program for the department, subawards were made to local governments to improve drinking water access and support wastewater and stormwater infrastructure. We sampled 45 of 655 grant expenditure transactions totaling approximately $18.5 million. The sample was not statistically valid. We reviewed the subawards to determine if department controls were effective and if the department complied with program requirements. We found six local governments, affecting seven subawards, where the department did not obtain all information necessary to complete their risk assessments. In addition, due to the missing information on the risk assessments, the applicability of single audit requirements was not determined for those six local governments. Effect: Due to internal control deficiencies, the department did not comply with all subrecipient monitoring requirements for fiscal years 2022 and 2023. In addition, not establishing monitoring procedures based on a subrecipient’s risk level increases the risk of funds being used for unallowable costs, also increasing the department’s risk of noncompliance with other federal regulations. Cause: Based on our work and discussions with department staff, processes were in place to gather the necessary data, evaluate risk, and to determine the applicability of single audit requirements. However, these processes relied on subrecipient participation in a survey. If a survey was not returned, the risk assessment process remained incomplete, and the applicability of single audit requirements were not determined. The department did not establish procedures to address unreturned surveys. Recommendation: We recommend the Department of Natural Resources and Conservation: A) Enhance internal controls to ensure every subrecipient is evaluated for risk of noncompliance and reviewed for the applicability of single audit requirements. B) Perform all subrecipient monitoring activities as required by federal regulations. Views of Responsible Officials: The department partially concurs with this recommendation. The department disagrees with the interpretation that subrecipient monitoring activities must occur within a specified time period and believes controls were in place during the audit period. In addition, because the department’s policy is to assign every subrecipient the same risk level until an assessment is completed, it believes it is following subrecipient monitoring requirements. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. Assigning all subrecipients a common risk level is not the same as evaluating each subrecipient’s risk for the purpose of determining appropriate subrecipient monitoring. In addition, the department is subject to federal time requirements specific to monitoring subrecipient single audit reports. The subrecipient’s risk of noncompliance and single audit requirements are only documented as part of the risk assessment process, which was not completed for six subrecipients tested. In addition, four of the grants closed without this process being completed. As such, our recommendation stands.

Finding 2023-015: U.S. Department of the Treasury ALN #21.027, Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Grant #SLFRP1747 Criteria: Federal regulation, 2 CFR 200.332, requires pass-through entities, as part of subrecipient monitoring, to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring. The activities of the subrecipient must then be monitored as necessary to ensure compliance. Pass-through entities are also responsible for verifying every subrecipient that expends $750,000 in federal awards in a fiscal year is audited. Non-federal entities are required to follow up on and resolve any findings pertaining to the federal award identified by these audits. Federal regulation, 2 CFR 200.303, requires non-federal entities to, among other things, establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Natural Resources and Conservation (department) did not have sufficient controls to ensure every subrecipient receiving State and Local Fiscal Recovery Fund (SLFRF) grant funds was evaluated for risk of noncompliance or reviewed for the applicability of single audit requirements, as required by federal regulations. Questioned Costs: No questioned costs identified. Context: As part of administering the SLFRF program, which was a new grant program for the department, subawards were made to local governments to improve drinking water access and support wastewater and stormwater infrastructure. We sampled 45 of 655 grant expenditure transactions totaling approximately $18.5 million. The sample was not statistically valid. We reviewed the subawards to determine if department controls were effective and if the department complied with program requirements. We found six local governments, affecting seven subawards, where the department did not obtain all information necessary to complete their risk assessments. In addition, due to the missing information on the risk assessments, the applicability of single audit requirements was not determined for those six local governments. Effect: Due to internal control deficiencies, the department did not comply with all subrecipient monitoring requirements for fiscal years 2022 and 2023. In addition, not establishing monitoring procedures based on a subrecipient’s risk level increases the risk of funds being used for unallowable costs, also increasing the department’s risk of noncompliance with other federal regulations. Cause: Based on our work and discussions with department staff, processes were in place to gather the necessary data, evaluate risk, and to determine the applicability of single audit requirements. However, these processes relied on subrecipient participation in a survey. If a survey was not returned, the risk assessment process remained incomplete, and the applicability of single audit requirements were not determined. The department did not establish procedures to address unreturned surveys. Recommendation: We recommend the Department of Natural Resources and Conservation: A) Enhance internal controls to ensure every subrecipient is evaluated for risk of noncompliance and reviewed for the applicability of single audit requirements. B) Perform all subrecipient monitoring activities as required by federal regulations. Views of Responsible Officials: The department partially concurs with this recommendation. The department disagrees with the interpretation that subrecipient monitoring activities must occur within a specified time period and believes controls were in place during the audit period. In addition, because the department’s policy is to assign every subrecipient the same risk level until an assessment is completed, it believes it is following subrecipient monitoring requirements. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. Assigning all subrecipients a common risk level is not the same as evaluating each subrecipient’s risk for the purpose of determining appropriate subrecipient monitoring. In addition, the department is subject to federal time requirements specific to monitoring subrecipient single audit reports. The subrecipient’s risk of noncompliance and single audit requirements are only documented as part of the risk assessment process, which was not completed for six subrecipients tested. In addition, four of the grants closed without this process being completed. As such, our recommendation stands.

Finding 2023-015: U.S. Department of the Treasury ALN #21.027, Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Grant #SLFRP1747 Criteria: Federal regulation, 2 CFR 200.332, requires pass-through entities, as part of subrecipient monitoring, to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring. The activities of the subrecipient must then be monitored as necessary to ensure compliance. Pass-through entities are also responsible for verifying every subrecipient that expends $750,000 in federal awards in a fiscal year is audited. Non-federal entities are required to follow up on and resolve any findings pertaining to the federal award identified by these audits. Federal regulation, 2 CFR 200.303, requires non-federal entities to, among other things, establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Natural Resources and Conservation (department) did not have sufficient controls to ensure every subrecipient receiving State and Local Fiscal Recovery Fund (SLFRF) grant funds was evaluated for risk of noncompliance or reviewed for the applicability of single audit requirements, as required by federal regulations. Questioned Costs: No questioned costs identified. Context: As part of administering the SLFRF program, which was a new grant program for the department, subawards were made to local governments to improve drinking water access and support wastewater and stormwater infrastructure. We sampled 45 of 655 grant expenditure transactions totaling approximately $18.5 million. The sample was not statistically valid. We reviewed the subawards to determine if department controls were effective and if the department complied with program requirements. We found six local governments, affecting seven subawards, where the department did not obtain all information necessary to complete their risk assessments. In addition, due to the missing information on the risk assessments, the applicability of single audit requirements was not determined for those six local governments. Effect: Due to internal control deficiencies, the department did not comply with all subrecipient monitoring requirements for fiscal years 2022 and 2023. In addition, not establishing monitoring procedures based on a subrecipient’s risk level increases the risk of funds being used for unallowable costs, also increasing the department’s risk of noncompliance with other federal regulations. Cause: Based on our work and discussions with department staff, processes were in place to gather the necessary data, evaluate risk, and to determine the applicability of single audit requirements. However, these processes relied on subrecipient participation in a survey. If a survey was not returned, the risk assessment process remained incomplete, and the applicability of single audit requirements were not determined. The department did not establish procedures to address unreturned surveys. Recommendation: We recommend the Department of Natural Resources and Conservation: A) Enhance internal controls to ensure every subrecipient is evaluated for risk of noncompliance and reviewed for the applicability of single audit requirements. B) Perform all subrecipient monitoring activities as required by federal regulations. Views of Responsible Officials: The department partially concurs with this recommendation. The department disagrees with the interpretation that subrecipient monitoring activities must occur within a specified time period and believes controls were in place during the audit period. In addition, because the department’s policy is to assign every subrecipient the same risk level until an assessment is completed, it believes it is following subrecipient monitoring requirements. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. Assigning all subrecipients a common risk level is not the same as evaluating each subrecipient’s risk for the purpose of determining appropriate subrecipient monitoring. In addition, the department is subject to federal time requirements specific to monitoring subrecipient single audit reports. The subrecipient’s risk of noncompliance and single audit requirements are only documented as part of the risk assessment process, which was not completed for six subrecipients tested. In addition, four of the grants closed without this process being completed. As such, our recommendation stands.

Finding 2023-015: U.S. Department of the Treasury ALN #21.027, Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Grant #SLFRP1747 Criteria: Federal regulation, 2 CFR 200.332, requires pass-through entities, as part of subrecipient monitoring, to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring. The activities of the subrecipient must then be monitored as necessary to ensure compliance. Pass-through entities are also responsible for verifying every subrecipient that expends $750,000 in federal awards in a fiscal year is audited. Non-federal entities are required to follow up on and resolve any findings pertaining to the federal award identified by these audits. Federal regulation, 2 CFR 200.303, requires non-federal entities to, among other things, establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Natural Resources and Conservation (department) did not have sufficient controls to ensure every subrecipient receiving State and Local Fiscal Recovery Fund (SLFRF) grant funds was evaluated for risk of noncompliance or reviewed for the applicability of single audit requirements, as required by federal regulations. Questioned Costs: No questioned costs identified. Context: As part of administering the SLFRF program, which was a new grant program for the department, subawards were made to local governments to improve drinking water access and support wastewater and stormwater infrastructure. We sampled 45 of 655 grant expenditure transactions totaling approximately $18.5 million. The sample was not statistically valid. We reviewed the subawards to determine if department controls were effective and if the department complied with program requirements. We found six local governments, affecting seven subawards, where the department did not obtain all information necessary to complete their risk assessments. In addition, due to the missing information on the risk assessments, the applicability of single audit requirements was not determined for those six local governments. Effect: Due to internal control deficiencies, the department did not comply with all subrecipient monitoring requirements for fiscal years 2022 and 2023. In addition, not establishing monitoring procedures based on a subrecipient’s risk level increases the risk of funds being used for unallowable costs, also increasing the department’s risk of noncompliance with other federal regulations. Cause: Based on our work and discussions with department staff, processes were in place to gather the necessary data, evaluate risk, and to determine the applicability of single audit requirements. However, these processes relied on subrecipient participation in a survey. If a survey was not returned, the risk assessment process remained incomplete, and the applicability of single audit requirements were not determined. The department did not establish procedures to address unreturned surveys. Recommendation: We recommend the Department of Natural Resources and Conservation: A) Enhance internal controls to ensure every subrecipient is evaluated for risk of noncompliance and reviewed for the applicability of single audit requirements. B) Perform all subrecipient monitoring activities as required by federal regulations. Views of Responsible Officials: The department partially concurs with this recommendation. The department disagrees with the interpretation that subrecipient monitoring activities must occur within a specified time period and believes controls were in place during the audit period. In addition, because the department’s policy is to assign every subrecipient the same risk level until an assessment is completed, it believes it is following subrecipient monitoring requirements. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. Assigning all subrecipients a common risk level is not the same as evaluating each subrecipient’s risk for the purpose of determining appropriate subrecipient monitoring. In addition, the department is subject to federal time requirements specific to monitoring subrecipient single audit reports. The subrecipient’s risk of noncompliance and single audit requirements are only documented as part of the risk assessment process, which was not completed for six subrecipients tested. In addition, four of the grants closed without this process being completed. As such, our recommendation stands.

Finding 2023-015: U.S. Department of the Treasury ALN #21.027, Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Grant #SLFRP1747 Criteria: Federal regulation, 2 CFR 200.332, requires pass-through entities, as part of subrecipient monitoring, to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring. The activities of the subrecipient must then be monitored as necessary to ensure compliance. Pass-through entities are also responsible for verifying every subrecipient that expends $750,000 in federal awards in a fiscal year is audited. Non-federal entities are required to follow up on and resolve any findings pertaining to the federal award identified by these audits. Federal regulation, 2 CFR 200.303, requires non-federal entities to, among other things, establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Natural Resources and Conservation (department) did not have sufficient controls to ensure every subrecipient receiving State and Local Fiscal Recovery Fund (SLFRF) grant funds was evaluated for risk of noncompliance or reviewed for the applicability of single audit requirements, as required by federal regulations. Questioned Costs: No questioned costs identified. Context: As part of administering the SLFRF program, which was a new grant program for the department, subawards were made to local governments to improve drinking water access and support wastewater and stormwater infrastructure. We sampled 45 of 655 grant expenditure transactions totaling approximately $18.5 million. The sample was not statistically valid. We reviewed the subawards to determine if department controls were effective and if the department complied with program requirements. We found six local governments, affecting seven subawards, where the department did not obtain all information necessary to complete their risk assessments. In addition, due to the missing information on the risk assessments, the applicability of single audit requirements was not determined for those six local governments. Effect: Due to internal control deficiencies, the department did not comply with all subrecipient monitoring requirements for fiscal years 2022 and 2023. In addition, not establishing monitoring procedures based on a subrecipient’s risk level increases the risk of funds being used for unallowable costs, also increasing the department’s risk of noncompliance with other federal regulations. Cause: Based on our work and discussions with department staff, processes were in place to gather the necessary data, evaluate risk, and to determine the applicability of single audit requirements. However, these processes relied on subrecipient participation in a survey. If a survey was not returned, the risk assessment process remained incomplete, and the applicability of single audit requirements were not determined. The department did not establish procedures to address unreturned surveys. Recommendation: We recommend the Department of Natural Resources and Conservation: A) Enhance internal controls to ensure every subrecipient is evaluated for risk of noncompliance and reviewed for the applicability of single audit requirements. B) Perform all subrecipient monitoring activities as required by federal regulations. Views of Responsible Officials: The department partially concurs with this recommendation. The department disagrees with the interpretation that subrecipient monitoring activities must occur within a specified time period and believes controls were in place during the audit period. In addition, because the department’s policy is to assign every subrecipient the same risk level until an assessment is completed, it believes it is following subrecipient monitoring requirements. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. Assigning all subrecipients a common risk level is not the same as evaluating each subrecipient’s risk for the purpose of determining appropriate subrecipient monitoring. In addition, the department is subject to federal time requirements specific to monitoring subrecipient single audit reports. The subrecipient’s risk of noncompliance and single audit requirements are only documented as part of the risk assessment process, which was not completed for six subrecipients tested. In addition, four of the grants closed without this process being completed. As such, our recommendation stands.

Finding 2023-015: U.S. Department of the Treasury ALN #21.027, Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Grant #SLFRP1747 Criteria: Federal regulation, 2 CFR 200.332, requires pass-through entities, as part of subrecipient monitoring, to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring. The activities of the subrecipient must then be monitored as necessary to ensure compliance. Pass-through entities are also responsible for verifying every subrecipient that expends $750,000 in federal awards in a fiscal year is audited. Non-federal entities are required to follow up on and resolve any findings pertaining to the federal award identified by these audits. Federal regulation, 2 CFR 200.303, requires non-federal entities to, among other things, establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Natural Resources and Conservation (department) did not have sufficient controls to ensure every subrecipient receiving State and Local Fiscal Recovery Fund (SLFRF) grant funds was evaluated for risk of noncompliance or reviewed for the applicability of single audit requirements, as required by federal regulations. Questioned Costs: No questioned costs identified. Context: As part of administering the SLFRF program, which was a new grant program for the department, subawards were made to local governments to improve drinking water access and support wastewater and stormwater infrastructure. We sampled 45 of 655 grant expenditure transactions totaling approximately $18.5 million. The sample was not statistically valid. We reviewed the subawards to determine if department controls were effective and if the department complied with program requirements. We found six local governments, affecting seven subawards, where the department did not obtain all information necessary to complete their risk assessments. In addition, due to the missing information on the risk assessments, the applicability of single audit requirements was not determined for those six local governments. Effect: Due to internal control deficiencies, the department did not comply with all subrecipient monitoring requirements for fiscal years 2022 and 2023. In addition, not establishing monitoring procedures based on a subrecipient’s risk level increases the risk of funds being used for unallowable costs, also increasing the department’s risk of noncompliance with other federal regulations. Cause: Based on our work and discussions with department staff, processes were in place to gather the necessary data, evaluate risk, and to determine the applicability of single audit requirements. However, these processes relied on subrecipient participation in a survey. If a survey was not returned, the risk assessment process remained incomplete, and the applicability of single audit requirements were not determined. The department did not establish procedures to address unreturned surveys. Recommendation: We recommend the Department of Natural Resources and Conservation: A) Enhance internal controls to ensure every subrecipient is evaluated for risk of noncompliance and reviewed for the applicability of single audit requirements. B) Perform all subrecipient monitoring activities as required by federal regulations. Views of Responsible Officials: The department partially concurs with this recommendation. The department disagrees with the interpretation that subrecipient monitoring activities must occur within a specified time period and believes controls were in place during the audit period. In addition, because the department’s policy is to assign every subrecipient the same risk level until an assessment is completed, it believes it is following subrecipient monitoring requirements. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. Assigning all subrecipients a common risk level is not the same as evaluating each subrecipient’s risk for the purpose of determining appropriate subrecipient monitoring. In addition, the department is subject to federal time requirements specific to monitoring subrecipient single audit reports. The subrecipient’s risk of noncompliance and single audit requirements are only documented as part of the risk assessment process, which was not completed for six subrecipients tested. In addition, four of the grants closed without this process being completed. As such, our recommendation stands.

Finding 2023-074: U.S. Department of Homeland Security ALN #97.036, Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Grant #4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001 Criteria: Federal regulation, 2 CFR 200.332(a)(1), lays out the fourteen required elements to communicate to subrecipients to properly identify the federal award. Federal regulation, 2 CFR 200.332(d), requires the Department of Military Affairs (department) to monitor the subrecipient’s activities, including reviewing reports and resolving Single Audit findings related to the subaward. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department communicated the Agency Listing Number (ALN) for the disaster grant to some, but not all, of the subrecipients through an award letter. Additionally, the department did not review subrecipient audit reports as required by federal regulations. The department does not have adequate controls in place to ensure that either of these two things occurred. Questioned Costs: No questioned costs identified. Context: The department subgrants funds to cities, counties, and non-profit entities. During the audit, we reviewed expenditures related to four disasters, awarded to 32 entities. We judgmentally sampled payments made to 14 of these entities and found eight were not provided the ALN. This sample was not statistically valid. We did not complete a sample related to subrecipient monitoring as the department does not have procedures in place to review audit reports for any entity. Effect: Subrecipients may not be fully aware or adhere to all relevant federal regulations related to the grant if they do not receive the correct ALN, increasing the risk of non-compliance. Furthermore, subrecipients lack essential data to accurately report their federal awards on their Schedule of Expenditures of Federal Awards. Additionally, the department's failure to review audit reports from subrecipients has led to a lack of awareness of findings related to department grants or other federal grants with similar requirements. Consequently, the department has not issued management letters or requested corrective action plans as required. This deficiency has left the department without the necessary information to implement proper monitoring procedures for federal compliance at the subrecipient level, which increases the risk of misallocation of federal funds by subrecipients. Cause: During the audit period, department turnover resulted in the omission of the ALN in some award letters. The department and subrecipient meet prior to a grant award to determine if there are any risks at the entity applying for a grant. The department was unaware of the federal requirement to review audit reports as part of its monitoring procedures. Recommendation: We recommend the Department of Military Affairs: A. Implement controls to ensure the ALN is communicated to subrecipients when awarding grants and subrecipient audit reports are obtained and reviewed. B. Communicate the ALN to all subrecipients awarded disaster funds. C. Obtain and review audit reports of entities receiving grants. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-074: U.S. Department of Homeland Security ALN #97.036, Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Grant #4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001 Criteria: Federal regulation, 2 CFR 200.332(a)(1), lays out the fourteen required elements to communicate to subrecipients to properly identify the federal award. Federal regulation, 2 CFR 200.332(d), requires the Department of Military Affairs (department) to monitor the subrecipient’s activities, including reviewing reports and resolving Single Audit findings related to the subaward. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department communicated the Agency Listing Number (ALN) for the disaster grant to some, but not all, of the subrecipients through an award letter. Additionally, the department did not review subrecipient audit reports as required by federal regulations. The department does not have adequate controls in place to ensure that either of these two things occurred. Questioned Costs: No questioned costs identified. Context: The department subgrants funds to cities, counties, and non-profit entities. During the audit, we reviewed expenditures related to four disasters, awarded to 32 entities. We judgmentally sampled payments made to 14 of these entities and found eight were not provided the ALN. This sample was not statistically valid. We did not complete a sample related to subrecipient monitoring as the department does not have procedures in place to review audit reports for any entity. Effect: Subrecipients may not be fully aware or adhere to all relevant federal regulations related to the grant if they do not receive the correct ALN, increasing the risk of non-compliance. Furthermore, subrecipients lack essential data to accurately report their federal awards on their Schedule of Expenditures of Federal Awards. Additionally, the department's failure to review audit reports from subrecipients has led to a lack of awareness of findings related to department grants or other federal grants with similar requirements. Consequently, the department has not issued management letters or requested corrective action plans as required. This deficiency has left the department without the necessary information to implement proper monitoring procedures for federal compliance at the subrecipient level, which increases the risk of misallocation of federal funds by subrecipients. Cause: During the audit period, department turnover resulted in the omission of the ALN in some award letters. The department and subrecipient meet prior to a grant award to determine if there are any risks at the entity applying for a grant. The department was unaware of the federal requirement to review audit reports as part of its monitoring procedures. Recommendation: We recommend the Department of Military Affairs: A. Implement controls to ensure the ALN is communicated to subrecipients when awarding grants and subrecipient audit reports are obtained and reviewed. B. Communicate the ALN to all subrecipients awarded disaster funds. C. Obtain and review audit reports of entities receiving grants. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-074: U.S. Department of Homeland Security ALN #97.036, Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Grant #4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001 Criteria: Federal regulation, 2 CFR 200.332(a)(1), lays out the fourteen required elements to communicate to subrecipients to properly identify the federal award. Federal regulation, 2 CFR 200.332(d), requires the Department of Military Affairs (department) to monitor the subrecipient’s activities, including reviewing reports and resolving Single Audit findings related to the subaward. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department communicated the Agency Listing Number (ALN) for the disaster grant to some, but not all, of the subrecipients through an award letter. Additionally, the department did not review subrecipient audit reports as required by federal regulations. The department does not have adequate controls in place to ensure that either of these two things occurred. Questioned Costs: No questioned costs identified. Context: The department subgrants funds to cities, counties, and non-profit entities. During the audit, we reviewed expenditures related to four disasters, awarded to 32 entities. We judgmentally sampled payments made to 14 of these entities and found eight were not provided the ALN. This sample was not statistically valid. We did not complete a sample related to subrecipient monitoring as the department does not have procedures in place to review audit reports for any entity. Effect: Subrecipients may not be fully aware or adhere to all relevant federal regulations related to the grant if they do not receive the correct ALN, increasing the risk of non-compliance. Furthermore, subrecipients lack essential data to accurately report their federal awards on their Schedule of Expenditures of Federal Awards. Additionally, the department's failure to review audit reports from subrecipients has led to a lack of awareness of findings related to department grants or other federal grants with similar requirements. Consequently, the department has not issued management letters or requested corrective action plans as required. This deficiency has left the department without the necessary information to implement proper monitoring procedures for federal compliance at the subrecipient level, which increases the risk of misallocation of federal funds by subrecipients. Cause: During the audit period, department turnover resulted in the omission of the ALN in some award letters. The department and subrecipient meet prior to a grant award to determine if there are any risks at the entity applying for a grant. The department was unaware of the federal requirement to review audit reports as part of its monitoring procedures. Recommendation: We recommend the Department of Military Affairs: A. Implement controls to ensure the ALN is communicated to subrecipients when awarding grants and subrecipient audit reports are obtained and reviewed. B. Communicate the ALN to all subrecipients awarded disaster funds. C. Obtain and review audit reports of entities receiving grants. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-074: U.S. Department of Homeland Security ALN #97.036, Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Grant #4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001 Criteria: Federal regulation, 2 CFR 200.332(a)(1), lays out the fourteen required elements to communicate to subrecipients to properly identify the federal award. Federal regulation, 2 CFR 200.332(d), requires the Department of Military Affairs (department) to monitor the subrecipient’s activities, including reviewing reports and resolving Single Audit findings related to the subaward. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department communicated the Agency Listing Number (ALN) for the disaster grant to some, but not all, of the subrecipients through an award letter. Additionally, the department did not review subrecipient audit reports as required by federal regulations. The department does not have adequate controls in place to ensure that either of these two things occurred. Questioned Costs: No questioned costs identified. Context: The department subgrants funds to cities, counties, and non-profit entities. During the audit, we reviewed expenditures related to four disasters, awarded to 32 entities. We judgmentally sampled payments made to 14 of these entities and found eight were not provided the ALN. This sample was not statistically valid. We did not complete a sample related to subrecipient monitoring as the department does not have procedures in place to review audit reports for any entity. Effect: Subrecipients may not be fully aware or adhere to all relevant federal regulations related to the grant if they do not receive the correct ALN, increasing the risk of non-compliance. Furthermore, subrecipients lack essential data to accurately report their federal awards on their Schedule of Expenditures of Federal Awards. Additionally, the department's failure to review audit reports from subrecipients has led to a lack of awareness of findings related to department grants or other federal grants with similar requirements. Consequently, the department has not issued management letters or requested corrective action plans as required. This deficiency has left the department without the necessary information to implement proper monitoring procedures for federal compliance at the subrecipient level, which increases the risk of misallocation of federal funds by subrecipients. Cause: During the audit period, department turnover resulted in the omission of the ALN in some award letters. The department and subrecipient meet prior to a grant award to determine if there are any risks at the entity applying for a grant. The department was unaware of the federal requirement to review audit reports as part of its monitoring procedures. Recommendation: We recommend the Department of Military Affairs: A. Implement controls to ensure the ALN is communicated to subrecipients when awarding grants and subrecipient audit reports are obtained and reviewed. B. Communicate the ALN to all subrecipients awarded disaster funds. C. Obtain and review audit reports of entities receiving grants. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-032: U.S. Department of Education ALN #84.425D and #84.425U, Education Stabilization Fund (ESF) (COVID-19) Grant #S425D200006, S425D210006, and S452U210006-21A Criteria: Federal regulation, 2CFR 200.332(d), requires pass through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." The Office of Management and Budget 2022 Compliance Supplement (compliance supplement), ESF Program (Section III, Part F-Equipment /Real Property Management) explains that construction projects using Elementary and Secondary School Emergency Relief Fund (ESSER funds) must meet Davis-Bacon prevailing wage requirements, meaning they must pay wages based on federal requirements. A memo from the Department of Education related to Davis-Bacon released April 2023 further clarified that states should be collecting and monitoring all Local Educational Agencies’ (LEA) wage certifications. The compliance supplement (Section III, Part A Activities Allowed or Unallowed) also requires costs to be consistent with the purpose of the ESF, “to prevent, prepare for, and respond to COVID-19”. Federal regulation, 2 CFR 200.403 (a) and (g), requires allowable costs to be “necessary and reasonable for the performance of the Federal award” and to be “adequately documented”. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: ESSER is part of the ESF. The Office of Public Instruction’s (office) controls were not sufficient to prevent, or detect and correct, noncompliance with federal requirements during the audit period. The office assessed subrecipients risk, reviewed audit reports for LEAs whose audits included ESSER as a major program, and required subrecipients to document their use of ESSER funds on cash requests. However, the office did not comply with federal allowable cost regulations. This is because they did not require documentation beyond the cash requests to ensure those expenditures followed ESSER program requirements. Examples include being related to the COVID-19 pandemic, being reasonable and necessary, and complying with equipment and construction requirements. In addition, the office did not complete any after the award monitoring, including collecting Davis-Bacon wage certifications related to subrecipients’ construction projects as required by federal regulations. Questioned Costs: We question costs of over $52 million. Specifically, $19,748,561 for 84.425D (ESSER I and II) and $32,288,058 for 84.425U (ESSER III). We calculated this amount by summing the payments from the cash draws we tested that lacked sufficient documentation. The potential questioned costs could be higher since our testing was limited to cash requests over $1 million. Context: During the audit period, over $257 million of ESSER grants were paid to LEAs. We tested 27 ESSER cash requests over $1 million each in fiscal years 2022 and 2023. Total payments made to subrecipients from these cash draws exceeded $77 million. We first considered support retained at the office. We also requested further support from LEAs in an attempt to consider all information available. Not all requested support was provided. We reviewed what was provided as part of our testing. This was not a sample as we tested all cash requests above $1 million. Each cash request contained a variety of items on the same request. We noted the following: • Documentation in 12 out of the 27 cash requests tested did not indicate how the expenses related to preventing, preparing for, and responding to COVID-19 pandemic. • 14 out of the 27 cash requests tested did not have enough detail to determine if the costs were reasonable and necessary. • 12 of the cash requests reviewed involved construction and the office did not review any wage certifications during the audit period. In addition, there was no monitoring of LEAs’ compliance related to equipment and real property management requirements beyond compliance certifications by the LEAs. • Descriptions on two cash requests indicated ESSER funds were spent on items we believe are unreasonable or have no clear connection to the pandemic. These costs include t-shirts for a new teacher event and massage chairs for a teacher’s lounge. Overall, the cash requests are more detailed than in the prior audit, but they still are not sufficient to meet the office’s obligation to ensure subrecipients’ compliance with federal regulations. In addition, fiscal year 2023 was the third year of ESSER spending, indicating there has been time to set up an after the award subrecipient monitoring program. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2021-036 in the audit for the two fiscal years ended June 30, 2021. Effect: The office is not in compliance with federal regulations and subrecipients may have spent ESSER funds on activities not allowed by federal requirements, to prevent, prepare for, and respond to the coronavirus pandemic, or on items that are not necessary and reasonable for the performance of the federal award. Cause: The office believes there was sufficient detail on the cash requests for the office to decide on the reasonableness, necessity, and allowability under ESSER regulations. The office agrees that subrecipient monitoring was not sufficient during the audit period, but since there are three funding sources that all have the same allowable uses, personnel decided they would monitor all phases of the grant using one self-assessment. The office sent out a monitoring survey at the end of the audit period, but no responses had been received during fiscal year 2023. The office noted that they will conduct additional monitoring, particularly for unique activities like construction projects, to ensure ESSER compliance. ESSER is defined in the compliance supplement as a “higher risk” federal program, because of the additional risk associated with certain COVID-19 funding. We believe the office’s decision to monitor three years into the grant is not sufficient for the following reasons: • LEAs spent funds on unusual activity, like construction projects. These projects have different compliance requirements than the other federal grants most LEAs receive. • Less than 20 percent of LEA ESSER subrecipients will receive an audit that requires any federal compliance testing. • If the office finds issues this late in the grant process, it will be difficult to recover funds from LEAs. We believe federal requirements direct the office to use a combination of sufficient documentation at the time of disbursement and strong monitoring procedures to ensure LEAs properly comply with applicable allowable cost requirements. Recommendation: We recommend the Office of Public Instruction: A. Strengthen internal controls to ensure subrecipient grant expenditures comply with federal program requirements. B. Obtain sufficient documentation of subrecipient expenditures to ensure costs are related to the pandemic and are reasonable and necessary for performance of the federal award. C. Monitor subrecipients’ compliance with construction and equipment requirements, including reviewing wage certifications for construction projects. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-032: U.S. Department of Education ALN #84.425D and #84.425U, Education Stabilization Fund (ESF) (COVID-19) Grant #S425D200006, S425D210006, and S452U210006-21A Criteria: Federal regulation, 2CFR 200.332(d), requires pass through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." The Office of Management and Budget 2022 Compliance Supplement (compliance supplement), ESF Program (Section III, Part F-Equipment /Real Property Management) explains that construction projects using Elementary and Secondary School Emergency Relief Fund (ESSER funds) must meet Davis-Bacon prevailing wage requirements, meaning they must pay wages based on federal requirements. A memo from the Department of Education related to Davis-Bacon released April 2023 further clarified that states should be collecting and monitoring all Local Educational Agencies’ (LEA) wage certifications. The compliance supplement (Section III, Part A Activities Allowed or Unallowed) also requires costs to be consistent with the purpose of the ESF, “to prevent, prepare for, and respond to COVID-19”. Federal regulation, 2 CFR 200.403 (a) and (g), requires allowable costs to be “necessary and reasonable for the performance of the Federal award” and to be “adequately documented”. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: ESSER is part of the ESF. The Office of Public Instruction’s (office) controls were not sufficient to prevent, or detect and correct, noncompliance with federal requirements during the audit period. The office assessed subrecipients risk, reviewed audit reports for LEAs whose audits included ESSER as a major program, and required subrecipients to document their use of ESSER funds on cash requests. However, the office did not comply with federal allowable cost regulations. This is because they did not require documentation beyond the cash requests to ensure those expenditures followed ESSER program requirements. Examples include being related to the COVID-19 pandemic, being reasonable and necessary, and complying with equipment and construction requirements. In addition, the office did not complete any after the award monitoring, including collecting Davis-Bacon wage certifications related to subrecipients’ construction projects as required by federal regulations. Questioned Costs: We question costs of over $52 million. Specifically, $19,748,561 for 84.425D (ESSER I and II) and $32,288,058 for 84.425U (ESSER III). We calculated this amount by summing the payments from the cash draws we tested that lacked sufficient documentation. The potential questioned costs could be higher since our testing was limited to cash requests over $1 million. Context: During the audit period, over $257 million of ESSER grants were paid to LEAs. We tested 27 ESSER cash requests over $1 million each in fiscal years 2022 and 2023. Total payments made to subrecipients from these cash draws exceeded $77 million. We first considered support retained at the office. We also requested further support from LEAs in an attempt to consider all information available. Not all requested support was provided. We reviewed what was provided as part of our testing. This was not a sample as we tested all cash requests above $1 million. Each cash request contained a variety of items on the same request. We noted the following: • Documentation in 12 out of the 27 cash requests tested did not indicate how the expenses related to preventing, preparing for, and responding to COVID-19 pandemic. • 14 out of the 27 cash requests tested did not have enough detail to determine if the costs were reasonable and necessary. • 12 of the cash requests reviewed involved construction and the office did not review any wage certifications during the audit period. In addition, there was no monitoring of LEAs’ compliance related to equipment and real property management requirements beyond compliance certifications by the LEAs. • Descriptions on two cash requests indicated ESSER funds were spent on items we believe are unreasonable or have no clear connection to the pandemic. These costs include t-shirts for a new teacher event and massage chairs for a teacher’s lounge. Overall, the cash requests are more detailed than in the prior audit, but they still are not sufficient to meet the office’s obligation to ensure subrecipients’ compliance with federal regulations. In addition, fiscal year 2023 was the third year of ESSER spending, indicating there has been time to set up an after the award subrecipient monitoring program. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2021-036 in the audit for the two fiscal years ended June 30, 2021. Effect: The office is not in compliance with federal regulations and subrecipients may have spent ESSER funds on activities not allowed by federal requirements, to prevent, prepare for, and respond to the coronavirus pandemic, or on items that are not necessary and reasonable for the performance of the federal award. Cause: The office believes there was sufficient detail on the cash requests for the office to decide on the reasonableness, necessity, and allowability under ESSER regulations. The office agrees that subrecipient monitoring was not sufficient during the audit period, but since there are three funding sources that all have the same allowable uses, personnel decided they would monitor all phases of the grant using one self-assessment. The office sent out a monitoring survey at the end of the audit period, but no responses had been received during fiscal year 2023. The office noted that they will conduct additional monitoring, particularly for unique activities like construction projects, to ensure ESSER compliance. ESSER is defined in the compliance supplement as a “higher risk” federal program, because of the additional risk associated with certain COVID-19 funding. We believe the office’s decision to monitor three years into the grant is not sufficient for the following reasons: • LEAs spent funds on unusual activity, like construction projects. These projects have different compliance requirements than the other federal grants most LEAs receive. • Less than 20 percent of LEA ESSER subrecipients will receive an audit that requires any federal compliance testing. • If the office finds issues this late in the grant process, it will be difficult to recover funds from LEAs. We believe federal requirements direct the office to use a combination of sufficient documentation at the time of disbursement and strong monitoring procedures to ensure LEAs properly comply with applicable allowable cost requirements. Recommendation: We recommend the Office of Public Instruction: A. Strengthen internal controls to ensure subrecipient grant expenditures comply with federal program requirements. B. Obtain sufficient documentation of subrecipient expenditures to ensure costs are related to the pandemic and are reasonable and necessary for performance of the federal award. C. Monitor subrecipients’ compliance with construction and equipment requirements, including reviewing wage certifications for construction projects. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-032: U.S. Department of Education ALN #84.425D and #84.425U, Education Stabilization Fund (ESF) (COVID-19) Grant #S425D200006, S425D210006, and S452U210006-21A Criteria: Federal regulation, 2CFR 200.332(d), requires pass through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." The Office of Management and Budget 2022 Compliance Supplement (compliance supplement), ESF Program (Section III, Part F-Equipment /Real Property Management) explains that construction projects using Elementary and Secondary School Emergency Relief Fund (ESSER funds) must meet Davis-Bacon prevailing wage requirements, meaning they must pay wages based on federal requirements. A memo from the Department of Education related to Davis-Bacon released April 2023 further clarified that states should be collecting and monitoring all Local Educational Agencies’ (LEA) wage certifications. The compliance supplement (Section III, Part A Activities Allowed or Unallowed) also requires costs to be consistent with the purpose of the ESF, “to prevent, prepare for, and respond to COVID-19”. Federal regulation, 2 CFR 200.403 (a) and (g), requires allowable costs to be “necessary and reasonable for the performance of the Federal award” and to be “adequately documented”. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: ESSER is part of the ESF. The Office of Public Instruction’s (office) controls were not sufficient to prevent, or detect and correct, noncompliance with federal requirements during the audit period. The office assessed subrecipients risk, reviewed audit reports for LEAs whose audits included ESSER as a major program, and required subrecipients to document their use of ESSER funds on cash requests. However, the office did not comply with federal allowable cost regulations. This is because they did not require documentation beyond the cash requests to ensure those expenditures followed ESSER program requirements. Examples include being related to the COVID-19 pandemic, being reasonable and necessary, and complying with equipment and construction requirements. In addition, the office did not complete any after the award monitoring, including collecting Davis-Bacon wage certifications related to subrecipients’ construction projects as required by federal regulations. Questioned Costs: We question costs of over $52 million. Specifically, $19,748,561 for 84.425D (ESSER I and II) and $32,288,058 for 84.425U (ESSER III). We calculated this amount by summing the payments from the cash draws we tested that lacked sufficient documentation. The potential questioned costs could be higher since our testing was limited to cash requests over $1 million. Context: During the audit period, over $257 million of ESSER grants were paid to LEAs. We tested 27 ESSER cash requests over $1 million each in fiscal years 2022 and 2023. Total payments made to subrecipients from these cash draws exceeded $77 million. We first considered support retained at the office. We also requested further support from LEAs in an attempt to consider all information available. Not all requested support was provided. We reviewed what was provided as part of our testing. This was not a sample as we tested all cash requests above $1 million. Each cash request contained a variety of items on the same request. We noted the following: • Documentation in 12 out of the 27 cash requests tested did not indicate how the expenses related to preventing, preparing for, and responding to COVID-19 pandemic. • 14 out of the 27 cash requests tested did not have enough detail to determine if the costs were reasonable and necessary. • 12 of the cash requests reviewed involved construction and the office did not review any wage certifications during the audit period. In addition, there was no monitoring of LEAs’ compliance related to equipment and real property management requirements beyond compliance certifications by the LEAs. • Descriptions on two cash requests indicated ESSER funds were spent on items we believe are unreasonable or have no clear connection to the pandemic. These costs include t-shirts for a new teacher event and massage chairs for a teacher’s lounge. Overall, the cash requests are more detailed than in the prior audit, but they still are not sufficient to meet the office’s obligation to ensure subrecipients’ compliance with federal regulations. In addition, fiscal year 2023 was the third year of ESSER spending, indicating there has been time to set up an after the award subrecipient monitoring program. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2021-036 in the audit for the two fiscal years ended June 30, 2021. Effect: The office is not in compliance with federal regulations and subrecipients may have spent ESSER funds on activities not allowed by federal requirements, to prevent, prepare for, and respond to the coronavirus pandemic, or on items that are not necessary and reasonable for the performance of the federal award. Cause: The office believes there was sufficient detail on the cash requests for the office to decide on the reasonableness, necessity, and allowability under ESSER regulations. The office agrees that subrecipient monitoring was not sufficient during the audit period, but since there are three funding sources that all have the same allowable uses, personnel decided they would monitor all phases of the grant using one self-assessment. The office sent out a monitoring survey at the end of the audit period, but no responses had been received during fiscal year 2023. The office noted that they will conduct additional monitoring, particularly for unique activities like construction projects, to ensure ESSER compliance. ESSER is defined in the compliance supplement as a “higher risk” federal program, because of the additional risk associated with certain COVID-19 funding. We believe the office’s decision to monitor three years into the grant is not sufficient for the following reasons: • LEAs spent funds on unusual activity, like construction projects. These projects have different compliance requirements than the other federal grants most LEAs receive. • Less than 20 percent of LEA ESSER subrecipients will receive an audit that requires any federal compliance testing. • If the office finds issues this late in the grant process, it will be difficult to recover funds from LEAs. We believe federal requirements direct the office to use a combination of sufficient documentation at the time of disbursement and strong monitoring procedures to ensure LEAs properly comply with applicable allowable cost requirements. Recommendation: We recommend the Office of Public Instruction: A. Strengthen internal controls to ensure subrecipient grant expenditures comply with federal program requirements. B. Obtain sufficient documentation of subrecipient expenditures to ensure costs are related to the pandemic and are reasonable and necessary for performance of the federal award. C. Monitor subrecipients’ compliance with construction and equipment requirements, including reviewing wage certifications for construction projects. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-032: U.S. Department of Education ALN #84.425D and #84.425U, Education Stabilization Fund (ESF) (COVID-19) Grant #S425D200006, S425D210006, and S452U210006-21A Criteria: Federal regulation, 2CFR 200.332(d), requires pass through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." The Office of Management and Budget 2022 Compliance Supplement (compliance supplement), ESF Program (Section III, Part F-Equipment /Real Property Management) explains that construction projects using Elementary and Secondary School Emergency Relief Fund (ESSER funds) must meet Davis-Bacon prevailing wage requirements, meaning they must pay wages based on federal requirements. A memo from the Department of Education related to Davis-Bacon released April 2023 further clarified that states should be collecting and monitoring all Local Educational Agencies’ (LEA) wage certifications. The compliance supplement (Section III, Part A Activities Allowed or Unallowed) also requires costs to be consistent with the purpose of the ESF, “to prevent, prepare for, and respond to COVID-19”. Federal regulation, 2 CFR 200.403 (a) and (g), requires allowable costs to be “necessary and reasonable for the performance of the Federal award” and to be “adequately documented”. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: ESSER is part of the ESF. The Office of Public Instruction’s (office) controls were not sufficient to prevent, or detect and correct, noncompliance with federal requirements during the audit period. The office assessed subrecipients risk, reviewed audit reports for LEAs whose audits included ESSER as a major program, and required subrecipients to document their use of ESSER funds on cash requests. However, the office did not comply with federal allowable cost regulations. This is because they did not require documentation beyond the cash requests to ensure those expenditures followed ESSER program requirements. Examples include being related to the COVID-19 pandemic, being reasonable and necessary, and complying with equipment and construction requirements. In addition, the office did not complete any after the award monitoring, including collecting Davis-Bacon wage certifications related to subrecipients’ construction projects as required by federal regulations. Questioned Costs: We question costs of over $52 million. Specifically, $19,748,561 for 84.425D (ESSER I and II) and $32,288,058 for 84.425U (ESSER III). We calculated this amount by summing the payments from the cash draws we tested that lacked sufficient documentation. The potential questioned costs could be higher since our testing was limited to cash requests over $1 million. Context: During the audit period, over $257 million of ESSER grants were paid to LEAs. We tested 27 ESSER cash requests over $1 million each in fiscal years 2022 and 2023. Total payments made to subrecipients from these cash draws exceeded $77 million. We first considered support retained at the office. We also requested further support from LEAs in an attempt to consider all information available. Not all requested support was provided. We reviewed what was provided as part of our testing. This was not a sample as we tested all cash requests above $1 million. Each cash request contained a variety of items on the same request. We noted the following: • Documentation in 12 out of the 27 cash requests tested did not indicate how the expenses related to preventing, preparing for, and responding to COVID-19 pandemic. • 14 out of the 27 cash requests tested did not have enough detail to determine if the costs were reasonable and necessary. • 12 of the cash requests reviewed involved construction and the office did not review any wage certifications during the audit period. In addition, there was no monitoring of LEAs’ compliance related to equipment and real property management requirements beyond compliance certifications by the LEAs. • Descriptions on two cash requests indicated ESSER funds were spent on items we believe are unreasonable or have no clear connection to the pandemic. These costs include t-shirts for a new teacher event and massage chairs for a teacher’s lounge. Overall, the cash requests are more detailed than in the prior audit, but they still are not sufficient to meet the office’s obligation to ensure subrecipients’ compliance with federal regulations. In addition, fiscal year 2023 was the third year of ESSER spending, indicating there has been time to set up an after the award subrecipient monitoring program. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2021-036 in the audit for the two fiscal years ended June 30, 2021. Effect: The office is not in compliance with federal regulations and subrecipients may have spent ESSER funds on activities not allowed by federal requirements, to prevent, prepare for, and respond to the coronavirus pandemic, or on items that are not necessary and reasonable for the performance of the federal award. Cause: The office believes there was sufficient detail on the cash requests for the office to decide on the reasonableness, necessity, and allowability under ESSER regulations. The office agrees that subrecipient monitoring was not sufficient during the audit period, but since there are three funding sources that all have the same allowable uses, personnel decided they would monitor all phases of the grant using one self-assessment. The office sent out a monitoring survey at the end of the audit period, but no responses had been received during fiscal year 2023. The office noted that they will conduct additional monitoring, particularly for unique activities like construction projects, to ensure ESSER compliance. ESSER is defined in the compliance supplement as a “higher risk” federal program, because of the additional risk associated with certain COVID-19 funding. We believe the office’s decision to monitor three years into the grant is not sufficient for the following reasons: • LEAs spent funds on unusual activity, like construction projects. These projects have different compliance requirements than the other federal grants most LEAs receive. • Less than 20 percent of LEA ESSER subrecipients will receive an audit that requires any federal compliance testing. • If the office finds issues this late in the grant process, it will be difficult to recover funds from LEAs. We believe federal requirements direct the office to use a combination of sufficient documentation at the time of disbursement and strong monitoring procedures to ensure LEAs properly comply with applicable allowable cost requirements. Recommendation: We recommend the Office of Public Instruction: A. Strengthen internal controls to ensure subrecipient grant expenditures comply with federal program requirements. B. Obtain sufficient documentation of subrecipient expenditures to ensure costs are related to the pandemic and are reasonable and necessary for performance of the federal award. C. Monitor subrecipients’ compliance with construction and equipment requirements, including reviewing wage certifications for construction projects. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-013: U.S. Department of Transportation ALN #20.509, Formula Grants for Rural Areas (COVID-19) Grant #MT-2022-022-00 and MT-2023-011-00 Criteria: Federal regulation, 2 CFR 200.317, requires the Montana Department of Transportation (department) to follow state procurement policy when procuring property and services with federal funds. Federal regulation, 2 CFR 200.403, indicates costs must meet certain criteria to be allowable, such as being consistent with policies and procedures that apply uniformly to both federally and state financed activities of the department. Federal regulation, 2 CFR 200.332(d), requires the state to perform monitoring of subrecipients sufficient to ensure subrecipients have complied with federal requirements. Federal regulation, 2 CFR 200.313(d), requires the department to maintain accurate property records and have adequate internal controls to safeguard equipment purchased with federal funds. State policy in the Montana Operations Manual (MOM) policy requires all procurements either have a purchase order or contract. The purchase order or contract must include all elements negotiated and required for the purchase. Department policy and procedures require an inspection on each received vehicle be documented by a post-delivery certification. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s internal controls did not ensure vehicle procurement, funded by federal funds, followed state policy and procedures. Further, the department did not adequately review and monitor vehicle records to ensure compliance with federal requirements. Questioned Costs: We question $37,990 of costs charged to the program related to the vehicle purchase made without a contract. Context: In administering the Formula Grants for Rural Areas program, the department provides capital grants to subrecipients for purchase of equipment. The department utilizes a data processing system to obtain and store information from the subrecipients to assist in monitoring compliance with various requirements of the program. We reviewed the system information regarding equipment records, procurements, and subrecipient monitoring for the subrecipient’s equipment and procurement federal requirements. We sampled five of the department’s 15 vehicle purchases as part of our audit. This sample was not statistically valid. Our review identified: • Three purchases did not contain evidence of post-delivery certifications. • One purchase with inaccurate vehicle information in the system. • One purchase without a contract, totaling $37,990. The information maintained in the system is necessary to demonstrate compliance with federal procurement and equipment requirements. We analyzed the population of 127 vehicle records in the system and identified the records did not contain all the elements necessary to track and monitor vehicles purchased with federal funds properly. We conducted a sample of 23 vehicle records. The sample was not statistically valid. Our sample identified: • 11 vehicle records did not contain complete and accurate system information, including inaccurate VIN numbers and the condition of vehicle at time of inspection. • Three vehicles did not contain mileage reported. This information is used during the department’s biennial inspections of subrecipient fleet vehicles to determine reasonableness of mileage reimbursements. Repeat Finding: This is a repeat finding and was reported as Single Audit finding #2021-003 in the audit for the two fiscal years ended June 30, 2021. Effect: The department is not in compliance with state procurement policies and procedures. Additionally, the vehicle purchased without a contract resulted in questioned costs which the department may be required to repay to the federal government. Failure to complete post-delivery certifications may mean vehicles do not meet program specifications. Cause: The post-delivery certifications were overlooked by staff who completed the vehicle inspections at the time of delivery. Further, staff turnover and lack of necessary training contributed to the internal control deficiencies and noncompliance. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls and provide training to staff to ensure vehicle procurements follow state policy to comply with federal requirements. B. Enhance internal controls and provide training to staff to ensure information maintained in the system is complete and accurate. C. Comply with state procurement policy by using a contract agreement for all vehicle purchases. D. Complete and submit the post-delivery certifications, as required by department policy. E. Review and update the system vehicle records to ensure they are complete and accurate. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-014: U.S. Department of Transportation ALN #20.509, Formula Grants for Rural Areas (COVID-19) Grant #MT-2022-022-00 and MT-2023-011-00 Criteria: Federal regulation, 2 CFR 200.332, specifies the 14 required elements to communicate to subrecipients, the requirements for risk assessments, and monitoring during and after the award to ensure subrecipient compliance. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Montana Department of Transportation (department) did not ensure subrecipients of the Formula Grants for Rural Areas program funds were provided required information to identify their subaward or consistently assess and respond to risk levels for subrecipients, contrary to federal regulations. Previously reported internal control deficiencies continue to require improvement. Questioned Costs: No questioned costs identified. Context: The department provides operating and capital grant awards to subrecipients. The department’s 44 subrecipients include local government transit authorities, nonprofit organizations, and operators of public transportation or intercity bus services. As part of our audit, we conducted two samples to review various subrecipient monitoring requirements including award notification, risk assessment, and subrecipient reviews. Neither sample was statistically valid. In our sample of eight subrecipients that received federal funding during the audit period, we determined: • The department did not assess a risk level or perform post-award monitoring for two subrecipients. • The department, after assessing a higher level of risk to one subrecipient, did not conduct increased monitoring. Department policy requires staff perform additional reviews of all the subrecipient’s quarterly reports when higher risk levels are assigned. In our second sample, we reviewed five of 15 vehicle purchases made during the audit period. We determined two contracts did not contain the 14 elements, which include award identification and requirements, the department is required to communicate to subrecipients. Repeat Finding: This is a repeat finding and was reported as a Single Audit finding 2021-004 in the audit for the two fiscal years ended June 30, 2021. Effect: Without efficient internal controls over compliance to ensure all elements of subrecipient monitoring are followed, the department is noncompliant with federal regulations. Additionally, noncompliance with subrecipient monitoring could result in undetected noncompliance on the part of the subrecipients and potentially unidentified questioned costs. Cause: Department staff identified turnover and the need for training as reasons for the internal control deficiencies and noncompliance. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls and provide training to staff to ensure subrecipient monitoring is completed following department policy and procedure and federal subrecipient monitoring requirements. B. Perform and document risk assessments for subrecipients. C. Perform enhanced monitoring in response to higher assessed subrecipient risk levels. D. Include required elements in subaward agreements for vehicle purchases. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-013: U.S. Department of Transportation ALN #20.509, Formula Grants for Rural Areas (COVID-19) Grant #MT-2022-022-00 and MT-2023-011-00 Criteria: Federal regulation, 2 CFR 200.317, requires the Montana Department of Transportation (department) to follow state procurement policy when procuring property and services with federal funds. Federal regulation, 2 CFR 200.403, indicates costs must meet certain criteria to be allowable, such as being consistent with policies and procedures that apply uniformly to both federally and state financed activities of the department. Federal regulation, 2 CFR 200.332(d), requires the state to perform monitoring of subrecipients sufficient to ensure subrecipients have complied with federal requirements. Federal regulation, 2 CFR 200.313(d), requires the department to maintain accurate property records and have adequate internal controls to safeguard equipment purchased with federal funds. State policy in the Montana Operations Manual (MOM) policy requires all procurements either have a purchase order or contract. The purchase order or contract must include all elements negotiated and required for the purchase. Department policy and procedures require an inspection on each received vehicle be documented by a post-delivery certification. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s internal controls did not ensure vehicle procurement, funded by federal funds, followed state policy and procedures. Further, the department did not adequately review and monitor vehicle records to ensure compliance with federal requirements. Questioned Costs: We question $37,990 of costs charged to the program related to the vehicle purchase made without a contract. Context: In administering the Formula Grants for Rural Areas program, the department provides capital grants to subrecipients for purchase of equipment. The department utilizes a data processing system to obtain and store information from the subrecipients to assist in monitoring compliance with various requirements of the program. We reviewed the system information regarding equipment records, procurements, and subrecipient monitoring for the subrecipient’s equipment and procurement federal requirements. We sampled five of the department’s 15 vehicle purchases as part of our audit. This sample was not statistically valid. Our review identified: • Three purchases did not contain evidence of post-delivery certifications. • One purchase with inaccurate vehicle information in the system. • One purchase without a contract, totaling $37,990. The information maintained in the system is necessary to demonstrate compliance with federal procurement and equipment requirements. We analyzed the population of 127 vehicle records in the system and identified the records did not contain all the elements necessary to track and monitor vehicles purchased with federal funds properly. We conducted a sample of 23 vehicle records. The sample was not statistically valid. Our sample identified: • 11 vehicle records did not contain complete and accurate system information, including inaccurate VIN numbers and the condition of vehicle at time of inspection. • Three vehicles did not contain mileage reported. This information is used during the department’s biennial inspections of subrecipient fleet vehicles to determine reasonableness of mileage reimbursements. Repeat Finding: This is a repeat finding and was reported as Single Audit finding #2021-003 in the audit for the two fiscal years ended June 30, 2021. Effect: The department is not in compliance with state procurement policies and procedures. Additionally, the vehicle purchased without a contract resulted in questioned costs which the department may be required to repay to the federal government. Failure to complete post-delivery certifications may mean vehicles do not meet program specifications. Cause: The post-delivery certifications were overlooked by staff who completed the vehicle inspections at the time of delivery. Further, staff turnover and lack of necessary training contributed to the internal control deficiencies and noncompliance. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls and provide training to staff to ensure vehicle procurements follow state policy to comply with federal requirements. B. Enhance internal controls and provide training to staff to ensure information maintained in the system is complete and accurate. C. Comply with state procurement policy by using a contract agreement for all vehicle purchases. D. Complete and submit the post-delivery certifications, as required by department policy. E. Review and update the system vehicle records to ensure they are complete and accurate. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-014: U.S. Department of Transportation ALN #20.509, Formula Grants for Rural Areas (COVID-19) Grant #MT-2022-022-00 and MT-2023-011-00 Criteria: Federal regulation, 2 CFR 200.332, specifies the 14 required elements to communicate to subrecipients, the requirements for risk assessments, and monitoring during and after the award to ensure subrecipient compliance. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Montana Department of Transportation (department) did not ensure subrecipients of the Formula Grants for Rural Areas program funds were provided required information to identify their subaward or consistently assess and respond to risk levels for subrecipients, contrary to federal regulations. Previously reported internal control deficiencies continue to require improvement. Questioned Costs: No questioned costs identified. Context: The department provides operating and capital grant awards to subrecipients. The department’s 44 subrecipients include local government transit authorities, nonprofit organizations, and operators of public transportation or intercity bus services. As part of our audit, we conducted two samples to review various subrecipient monitoring requirements including award notification, risk assessment, and subrecipient reviews. Neither sample was statistically valid. In our sample of eight subrecipients that received federal funding during the audit period, we determined: • The department did not assess a risk level or perform post-award monitoring for two subrecipients. • The department, after assessing a higher level of risk to one subrecipient, did not conduct increased monitoring. Department policy requires staff perform additional reviews of all the subrecipient’s quarterly reports when higher risk levels are assigned. In our second sample, we reviewed five of 15 vehicle purchases made during the audit period. We determined two contracts did not contain the 14 elements, which include award identification and requirements, the department is required to communicate to subrecipients. Repeat Finding: This is a repeat finding and was reported as a Single Audit finding 2021-004 in the audit for the two fiscal years ended June 30, 2021. Effect: Without efficient internal controls over compliance to ensure all elements of subrecipient monitoring are followed, the department is noncompliant with federal regulations. Additionally, noncompliance with subrecipient monitoring could result in undetected noncompliance on the part of the subrecipients and potentially unidentified questioned costs. Cause: Department staff identified turnover and the need for training as reasons for the internal control deficiencies and noncompliance. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls and provide training to staff to ensure subrecipient monitoring is completed following department policy and procedure and federal subrecipient monitoring requirements. B. Perform and document risk assessments for subrecipients. C. Perform enhanced monitoring in response to higher assessed subrecipient risk levels. D. Include required elements in subaward agreements for vehicle purchases. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-013: U.S. Department of Transportation ALN #20.509, Formula Grants for Rural Areas (COVID-19) Grant #MT-2022-022-00 and MT-2023-011-00 Criteria: Federal regulation, 2 CFR 200.317, requires the Montana Department of Transportation (department) to follow state procurement policy when procuring property and services with federal funds. Federal regulation, 2 CFR 200.403, indicates costs must meet certain criteria to be allowable, such as being consistent with policies and procedures that apply uniformly to both federally and state financed activities of the department. Federal regulation, 2 CFR 200.332(d), requires the state to perform monitoring of subrecipients sufficient to ensure subrecipients have complied with federal requirements. Federal regulation, 2 CFR 200.313(d), requires the department to maintain accurate property records and have adequate internal controls to safeguard equipment purchased with federal funds. State policy in the Montana Operations Manual (MOM) policy requires all procurements either have a purchase order or contract. The purchase order or contract must include all elements negotiated and required for the purchase. Department policy and procedures require an inspection on each received vehicle be documented by a post-delivery certification. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s internal controls did not ensure vehicle procurement, funded by federal funds, followed state policy and procedures. Further, the department did not adequately review and monitor vehicle records to ensure compliance with federal requirements. Questioned Costs: We question $37,990 of costs charged to the program related to the vehicle purchase made without a contract. Context: In administering the Formula Grants for Rural Areas program, the department provides capital grants to subrecipients for purchase of equipment. The department utilizes a data processing system to obtain and store information from the subrecipients to assist in monitoring compliance with various requirements of the program. We reviewed the system information regarding equipment records, procurements, and subrecipient monitoring for the subrecipient’s equipment and procurement federal requirements. We sampled five of the department’s 15 vehicle purchases as part of our audit. This sample was not statistically valid. Our review identified: • Three purchases did not contain evidence of post-delivery certifications. • One purchase with inaccurate vehicle information in the system. • One purchase without a contract, totaling $37,990. The information maintained in the system is necessary to demonstrate compliance with federal procurement and equipment requirements. We analyzed the population of 127 vehicle records in the system and identified the records did not contain all the elements necessary to track and monitor vehicles purchased with federal funds properly. We conducted a sample of 23 vehicle records. The sample was not statistically valid. Our sample identified: • 11 vehicle records did not contain complete and accurate system information, including inaccurate VIN numbers and the condition of vehicle at time of inspection. • Three vehicles did not contain mileage reported. This information is used during the department’s biennial inspections of subrecipient fleet vehicles to determine reasonableness of mileage reimbursements. Repeat Finding: This is a repeat finding and was reported as Single Audit finding #2021-003 in the audit for the two fiscal years ended June 30, 2021. Effect: The department is not in compliance with state procurement policies and procedures. Additionally, the vehicle purchased without a contract resulted in questioned costs which the department may be required to repay to the federal government. Failure to complete post-delivery certifications may mean vehicles do not meet program specifications. Cause: The post-delivery certifications were overlooked by staff who completed the vehicle inspections at the time of delivery. Further, staff turnover and lack of necessary training contributed to the internal control deficiencies and noncompliance. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls and provide training to staff to ensure vehicle procurements follow state policy to comply with federal requirements. B. Enhance internal controls and provide training to staff to ensure information maintained in the system is complete and accurate. C. Comply with state procurement policy by using a contract agreement for all vehicle purchases. D. Complete and submit the post-delivery certifications, as required by department policy. E. Review and update the system vehicle records to ensure they are complete and accurate. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-014: U.S. Department of Transportation ALN #20.509, Formula Grants for Rural Areas (COVID-19) Grant #MT-2022-022-00 and MT-2023-011-00 Criteria: Federal regulation, 2 CFR 200.332, specifies the 14 required elements to communicate to subrecipients, the requirements for risk assessments, and monitoring during and after the award to ensure subrecipient compliance. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Montana Department of Transportation (department) did not ensure subrecipients of the Formula Grants for Rural Areas program funds were provided required information to identify their subaward or consistently assess and respond to risk levels for subrecipients, contrary to federal regulations. Previously reported internal control deficiencies continue to require improvement. Questioned Costs: No questioned costs identified. Context: The department provides operating and capital grant awards to subrecipients. The department’s 44 subrecipients include local government transit authorities, nonprofit organizations, and operators of public transportation or intercity bus services. As part of our audit, we conducted two samples to review various subrecipient monitoring requirements including award notification, risk assessment, and subrecipient reviews. Neither sample was statistically valid. In our sample of eight subrecipients that received federal funding during the audit period, we determined: • The department did not assess a risk level or perform post-award monitoring for two subrecipients. • The department, after assessing a higher level of risk to one subrecipient, did not conduct increased monitoring. Department policy requires staff perform additional reviews of all the subrecipient’s quarterly reports when higher risk levels are assigned. In our second sample, we reviewed five of 15 vehicle purchases made during the audit period. We determined two contracts did not contain the 14 elements, which include award identification and requirements, the department is required to communicate to subrecipients. Repeat Finding: This is a repeat finding and was reported as a Single Audit finding 2021-004 in the audit for the two fiscal years ended June 30, 2021. Effect: Without efficient internal controls over compliance to ensure all elements of subrecipient monitoring are followed, the department is noncompliant with federal regulations. Additionally, noncompliance with subrecipient monitoring could result in undetected noncompliance on the part of the subrecipients and potentially unidentified questioned costs. Cause: Department staff identified turnover and the need for training as reasons for the internal control deficiencies and noncompliance. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls and provide training to staff to ensure subrecipient monitoring is completed following department policy and procedure and federal subrecipient monitoring requirements. B. Perform and document risk assessments for subrecipients. C. Perform enhanced monitoring in response to higher assessed subrecipient risk levels. D. Include required elements in subaward agreements for vehicle purchases. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-013: U.S. Department of Transportation ALN #20.509, Formula Grants for Rural Areas (COVID-19) Grant #MT-2022-022-00 and MT-2023-011-00 Criteria: Federal regulation, 2 CFR 200.317, requires the Montana Department of Transportation (department) to follow state procurement policy when procuring property and services with federal funds. Federal regulation, 2 CFR 200.403, indicates costs must meet certain criteria to be allowable, such as being consistent with policies and procedures that apply uniformly to both federally and state financed activities of the department. Federal regulation, 2 CFR 200.332(d), requires the state to perform monitoring of subrecipients sufficient to ensure subrecipients have complied with federal requirements. Federal regulation, 2 CFR 200.313(d), requires the department to maintain accurate property records and have adequate internal controls to safeguard equipment purchased with federal funds. State policy in the Montana Operations Manual (MOM) policy requires all procurements either have a purchase order or contract. The purchase order or contract must include all elements negotiated and required for the purchase. Department policy and procedures require an inspection on each received vehicle be documented by a post-delivery certification. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s internal controls did not ensure vehicle procurement, funded by federal funds, followed state policy and procedures. Further, the department did not adequately review and monitor vehicle records to ensure compliance with federal requirements. Questioned Costs: We question $37,990 of costs charged to the program related to the vehicle purchase made without a contract. Context: In administering the Formula Grants for Rural Areas program, the department provides capital grants to subrecipients for purchase of equipment. The department utilizes a data processing system to obtain and store information from the subrecipients to assist in monitoring compliance with various requirements of the program. We reviewed the system information regarding equipment records, procurements, and subrecipient monitoring for the subrecipient’s equipment and procurement federal requirements. We sampled five of the department’s 15 vehicle purchases as part of our audit. This sample was not statistically valid. Our review identified: • Three purchases did not contain evidence of post-delivery certifications. • One purchase with inaccurate vehicle information in the system. • One purchase without a contract, totaling $37,990. The information maintained in the system is necessary to demonstrate compliance with federal procurement and equipment requirements. We analyzed the population of 127 vehicle records in the system and identified the records did not contain all the elements necessary to track and monitor vehicles purchased with federal funds properly. We conducted a sample of 23 vehicle records. The sample was not statistically valid. Our sample identified: • 11 vehicle records did not contain complete and accurate system information, including inaccurate VIN numbers and the condition of vehicle at time of inspection. • Three vehicles did not contain mileage reported. This information is used during the department’s biennial inspections of subrecipient fleet vehicles to determine reasonableness of mileage reimbursements. Repeat Finding: This is a repeat finding and was reported as Single Audit finding #2021-003 in the audit for the two fiscal years ended June 30, 2021. Effect: The department is not in compliance with state procurement policies and procedures. Additionally, the vehicle purchased without a contract resulted in questioned costs which the department may be required to repay to the federal government. Failure to complete post-delivery certifications may mean vehicles do not meet program specifications. Cause: The post-delivery certifications were overlooked by staff who completed the vehicle inspections at the time of delivery. Further, staff turnover and lack of necessary training contributed to the internal control deficiencies and noncompliance. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls and provide training to staff to ensure vehicle procurements follow state policy to comply with federal requirements. B. Enhance internal controls and provide training to staff to ensure information maintained in the system is complete and accurate. C. Comply with state procurement policy by using a contract agreement for all vehicle purchases. D. Complete and submit the post-delivery certifications, as required by department policy. E. Review and update the system vehicle records to ensure they are complete and accurate. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-014: U.S. Department of Transportation ALN #20.509, Formula Grants for Rural Areas (COVID-19) Grant #MT-2022-022-00 and MT-2023-011-00 Criteria: Federal regulation, 2 CFR 200.332, specifies the 14 required elements to communicate to subrecipients, the requirements for risk assessments, and monitoring during and after the award to ensure subrecipient compliance. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Montana Department of Transportation (department) did not ensure subrecipients of the Formula Grants for Rural Areas program funds were provided required information to identify their subaward or consistently assess and respond to risk levels for subrecipients, contrary to federal regulations. Previously reported internal control deficiencies continue to require improvement. Questioned Costs: No questioned costs identified. Context: The department provides operating and capital grant awards to subrecipients. The department’s 44 subrecipients include local government transit authorities, nonprofit organizations, and operators of public transportation or intercity bus services. As part of our audit, we conducted two samples to review various subrecipient monitoring requirements including award notification, risk assessment, and subrecipient reviews. Neither sample was statistically valid. In our sample of eight subrecipients that received federal funding during the audit period, we determined: • The department did not assess a risk level or perform post-award monitoring for two subrecipients. • The department, after assessing a higher level of risk to one subrecipient, did not conduct increased monitoring. Department policy requires staff perform additional reviews of all the subrecipient’s quarterly reports when higher risk levels are assigned. In our second sample, we reviewed five of 15 vehicle purchases made during the audit period. We determined two contracts did not contain the 14 elements, which include award identification and requirements, the department is required to communicate to subrecipients. Repeat Finding: This is a repeat finding and was reported as a Single Audit finding 2021-004 in the audit for the two fiscal years ended June 30, 2021. Effect: Without efficient internal controls over compliance to ensure all elements of subrecipient monitoring are followed, the department is noncompliant with federal regulations. Additionally, noncompliance with subrecipient monitoring could result in undetected noncompliance on the part of the subrecipients and potentially unidentified questioned costs. Cause: Department staff identified turnover and the need for training as reasons for the internal control deficiencies and noncompliance. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls and provide training to staff to ensure subrecipient monitoring is completed following department policy and procedure and federal subrecipient monitoring requirements. B. Perform and document risk assessments for subrecipients. C. Perform enhanced monitoring in response to higher assessed subrecipient risk levels. D. Include required elements in subaward agreements for vehicle purchases. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-035: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A Criteria: Federal regulation, 2CFR 200.334, requires non-federal entities to retain records related to the federal awards for three years past the submission of the final expenditure report. Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) uses a spreadsheet to track monitoring reviews for subrecipients of the Title I program. The spreadsheet is designed to track both the schedule and the completion status of all monitoring reviews. The completion status for monitoring reviews scheduled to be performed in fiscal years 2022 and 2023 was not complete by August 2023, which is the month the spreadsheet was provided for audit. Internal controls were not adequate to ensure relevant columns were updated to demonstrate compliance with federal regulations. Further, the office could not demonstrate compliance with monitoring requirements because the documentation of the monitoring reviews, including the completion of a monitoring checklist, was incomplete. Questioned Costs: No questioned costs identified. Context: On average, the office plans to monitor about 29 Local Educational Agencies (LEAs) each year. Checklist forms are used to document monitoring and a spreadsheet is used to track the progress of multiple reviews. The spreadsheet used to track and document all Title I monitoring reviews was not complete and the office could not provide documentation all planned subrecipient monitoring reviews were complete. Of the 60 LEAs sampled, nine were missing a complete monitoring checklist. Therefore, there is no evidence demonstrating that all required monitoring reviews took place. The sample was not statistically valid. Effect: The office did not comply with federal regulations. Also, the risk the office will not detect noncompliance on the part of a subrecipient increases when planned subrecipient monitoring does not occur. Cause: Staff indicated that the upkeep of this spreadsheet was the responsibility of the Title I Administrative Assistant, a position vacant for nearly two years at the time of testing. The office switched the form used to document monitoring reviews. The new form documents exceptions rather than the entire review. Additionally, staff indicated files for two LEAs were missing due to a glitch with the network folder on which they were stored during a software update. Recommendation: We recommend the Office of Public Instruction: A. Improve internal controls by requiring and maintaining documentation related to the Title I subrecipient monitoring process. B. Conduct monitoring of subrecipient activities and retain documentation of monitoring reviews, as required by federal regulations. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-038: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A ALN #84.367, Supporting Effective Instruction State Grants (Title II) Grant #S367A220025, S367A210025, S367A200025 ALN #84.365, English Language Acquisition State Grants (Title III) Grant #S365A22002, S365A20002 ALN #84.424 Student Support and Academic Enrichment Program (Title IV) Grant #S424A200027 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) reimbursed Local Educational Agencies (LEAs) without receiving sufficiently detailed documentation to determine whether the LEAs were seeking reimbursement for allowed activities or allowable costs. Internal controls were not adequate to ensure proper documentation is received from the LEAs before making a reimbursement. We also addressed incomplete subrecipient monitoring in finding number 2023-035. Questioned Costs: We question $5,943,419 in Title I payments that were reimbursed without adequate support. This amount represents the errors found in eight out of ten tested sample items. Given a total population of $102,446,866, we estimate likely questioned costs exceed $25 million for the Title I program. Additionally, we question $523,706 in Title II costs, $66,040 in Title III costs, and $73,152 in Title IV costs, as these were part of the same subrecipient cash requests reviewed for the Title I program. Context: The major federal program we tested was Title I. The objective of the program is to improve the teaching and learning of children who are at risk of not meeting challenging state academic standards and who reside in areas with high concentrations of children from low-income families. We designed a sample to test 60 items out of a population of 4,214 reimbursements. This sample was not statistically valid. We tested the first 10 sample items and found inadequate documentation for eight. We considered this material noncompliance and did not test the remaining 50 items. We noted the following exceptions: • One closeout cash request for $62,795 included no documentation to indicate what costs the LEA incurred. • Most cash requests for salary and fringe benefits lacked the names of individuals compensated, the roles/titles of personnel, and the dates associated with the compensation. • Documentation did not provide enough detail to discern whether costs were necessary for or related to the Title I program. • One cash request included supplies of $146,646, including food purchases for pizza, although the office’s own monitoring tool indicates, “Activities offered using Title I funds must provide information to or build the capacity of parents and families to support their child’s academic achievement. Open houses, Muffin/Donut days, BBQs, or other meet-and-greet activities are unacceptable.” We cannot tell how much was spent on pizza because it was combined with other items. Office approval is typically limited to comparing the approved budget categories on the Grant Application Notification (GAN) to the budget categories on the LEA’s cash request. Title I is part of the Elementary and Secondary Education Act (ESEA). Federal regulations allow states to accept consolidated applications for all titles included under ESEA. The office accepts consolidated applications from the school districts. Under the ESEA consolidated application, school districts are able to submit a schoolwide cash request for all federal titles included under their consolidated application. In our review, we identified eight questioned cash requests, six were for schoolwide cash requests. While Title II, Title III and Title IV were not major federal programs, the known questioned costs for these three programs exceeded the federal reporting threshold. Effect: The office reimbursed LEAs for Title I costs that were not adequately supported at the time of reimbursement. This increases the risk that LEAs used Title I funds for unallowable activities or unallowed costs. Finally, subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: Office staff believe they are requesting sufficient documentation, and they said the cash requests and applications contain all the information for office staff to be confident in the expenditures. Office staff also note that they can request more information from LEAs if there is something they are not confident about. They point out that LEAs receive annual independent audits and the office must depend on the accuracy and reliability of those audit processes and reports. However, based on office documentation, less than 17 percent of Title I LEAs get an audit with federal compliance testing. In addition, federal regulations require more subrecipient monitoring than reviewing audit reports, and we found noncompliance with the office’s other subrecipient monitoring procedures during the audit period. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to require LEAs to submit adequate documentation with reimbursement requests. B. Only reimburse LEAs for expenditures when their documentation is sufficient to determine if the costs are allowable to the program, in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management notes that they increased the documentation requirements for cash requests at the end of the first year of the audit period. LEAs are required to maintain all receipts and provide them upon request. Management also notes no request for additional LEA documentation was included as part of this audit process. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. Cash requests from both years of the audit period were tested, and instances of insufficient documentation were found throughout the audit period. While we are not prohibited from requesting subrecipients’ documentation during an audit, we are not required to do so. It is our position that unless the office maintains this documentation or documents their monitoring activities, compliance with the requirements applicable to the office cannot be demonstrated. As such, our recommendation stands.

Finding 2023-035: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A Criteria: Federal regulation, 2CFR 200.334, requires non-federal entities to retain records related to the federal awards for three years past the submission of the final expenditure report. Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) uses a spreadsheet to track monitoring reviews for subrecipients of the Title I program. The spreadsheet is designed to track both the schedule and the completion status of all monitoring reviews. The completion status for monitoring reviews scheduled to be performed in fiscal years 2022 and 2023 was not complete by August 2023, which is the month the spreadsheet was provided for audit. Internal controls were not adequate to ensure relevant columns were updated to demonstrate compliance with federal regulations. Further, the office could not demonstrate compliance with monitoring requirements because the documentation of the monitoring reviews, including the completion of a monitoring checklist, was incomplete. Questioned Costs: No questioned costs identified. Context: On average, the office plans to monitor about 29 Local Educational Agencies (LEAs) each year. Checklist forms are used to document monitoring and a spreadsheet is used to track the progress of multiple reviews. The spreadsheet used to track and document all Title I monitoring reviews was not complete and the office could not provide documentation all planned subrecipient monitoring reviews were complete. Of the 60 LEAs sampled, nine were missing a complete monitoring checklist. Therefore, there is no evidence demonstrating that all required monitoring reviews took place. The sample was not statistically valid. Effect: The office did not comply with federal regulations. Also, the risk the office will not detect noncompliance on the part of a subrecipient increases when planned subrecipient monitoring does not occur. Cause: Staff indicated that the upkeep of this spreadsheet was the responsibility of the Title I Administrative Assistant, a position vacant for nearly two years at the time of testing. The office switched the form used to document monitoring reviews. The new form documents exceptions rather than the entire review. Additionally, staff indicated files for two LEAs were missing due to a glitch with the network folder on which they were stored during a software update. Recommendation: We recommend the Office of Public Instruction: A. Improve internal controls by requiring and maintaining documentation related to the Title I subrecipient monitoring process. B. Conduct monitoring of subrecipient activities and retain documentation of monitoring reviews, as required by federal regulations. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-038: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A ALN #84.367, Supporting Effective Instruction State Grants (Title II) Grant #S367A220025, S367A210025, S367A200025 ALN #84.365, English Language Acquisition State Grants (Title III) Grant #S365A22002, S365A20002 ALN #84.424 Student Support and Academic Enrichment Program (Title IV) Grant #S424A200027 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) reimbursed Local Educational Agencies (LEAs) without receiving sufficiently detailed documentation to determine whether the LEAs were seeking reimbursement for allowed activities or allowable costs. Internal controls were not adequate to ensure proper documentation is received from the LEAs before making a reimbursement. We also addressed incomplete subrecipient monitoring in finding number 2023-035. Questioned Costs: We question $5,943,419 in Title I payments that were reimbursed without adequate support. This amount represents the errors found in eight out of ten tested sample items. Given a total population of $102,446,866, we estimate likely questioned costs exceed $25 million for the Title I program. Additionally, we question $523,706 in Title II costs, $66,040 in Title III costs, and $73,152 in Title IV costs, as these were part of the same subrecipient cash requests reviewed for the Title I program. Context: The major federal program we tested was Title I. The objective of the program is to improve the teaching and learning of children who are at risk of not meeting challenging state academic standards and who reside in areas with high concentrations of children from low-income families. We designed a sample to test 60 items out of a population of 4,214 reimbursements. This sample was not statistically valid. We tested the first 10 sample items and found inadequate documentation for eight. We considered this material noncompliance and did not test the remaining 50 items. We noted the following exceptions: • One closeout cash request for $62,795 included no documentation to indicate what costs the LEA incurred. • Most cash requests for salary and fringe benefits lacked the names of individuals compensated, the roles/titles of personnel, and the dates associated with the compensation. • Documentation did not provide enough detail to discern whether costs were necessary for or related to the Title I program. • One cash request included supplies of $146,646, including food purchases for pizza, although the office’s own monitoring tool indicates, “Activities offered using Title I funds must provide information to or build the capacity of parents and families to support their child’s academic achievement. Open houses, Muffin/Donut days, BBQs, or other meet-and-greet activities are unacceptable.” We cannot tell how much was spent on pizza because it was combined with other items. Office approval is typically limited to comparing the approved budget categories on the Grant Application Notification (GAN) to the budget categories on the LEA’s cash request. Title I is part of the Elementary and Secondary Education Act (ESEA). Federal regulations allow states to accept consolidated applications for all titles included under ESEA. The office accepts consolidated applications from the school districts. Under the ESEA consolidated application, school districts are able to submit a schoolwide cash request for all federal titles included under their consolidated application. In our review, we identified eight questioned cash requests, six were for schoolwide cash requests. While Title II, Title III and Title IV were not major federal programs, the known questioned costs for these three programs exceeded the federal reporting threshold. Effect: The office reimbursed LEAs for Title I costs that were not adequately supported at the time of reimbursement. This increases the risk that LEAs used Title I funds for unallowable activities or unallowed costs. Finally, subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: Office staff believe they are requesting sufficient documentation, and they said the cash requests and applications contain all the information for office staff to be confident in the expenditures. Office staff also note that they can request more information from LEAs if there is something they are not confident about. They point out that LEAs receive annual independent audits and the office must depend on the accuracy and reliability of those audit processes and reports. However, based on office documentation, less than 17 percent of Title I LEAs get an audit with federal compliance testing. In addition, federal regulations require more subrecipient monitoring than reviewing audit reports, and we found noncompliance with the office’s other subrecipient monitoring procedures during the audit period. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to require LEAs to submit adequate documentation with reimbursement requests. B. Only reimburse LEAs for expenditures when their documentation is sufficient to determine if the costs are allowable to the program, in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management notes that they increased the documentation requirements for cash requests at the end of the first year of the audit period. LEAs are required to maintain all receipts and provide them upon request. Management also notes no request for additional LEA documentation was included as part of this audit process. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. Cash requests from both years of the audit period were tested, and instances of insufficient documentation were found throughout the audit period. While we are not prohibited from requesting subrecipients’ documentation during an audit, we are not required to do so. It is our position that unless the office maintains this documentation or documents their monitoring activities, compliance with the requirements applicable to the office cannot be demonstrated. As such, our recommendation stands.

Finding 2023-038: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A ALN #84.367, Supporting Effective Instruction State Grants (Title II) Grant #S367A220025, S367A210025, S367A200025 ALN #84.365, English Language Acquisition State Grants (Title III) Grant #S365A22002, S365A20002 ALN #84.424 Student Support and Academic Enrichment Program (Title IV) Grant #S424A200027 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) reimbursed Local Educational Agencies (LEAs) without receiving sufficiently detailed documentation to determine whether the LEAs were seeking reimbursement for allowed activities or allowable costs. Internal controls were not adequate to ensure proper documentation is received from the LEAs before making a reimbursement. We also addressed incomplete subrecipient monitoring in finding number 2023-035. Questioned Costs: We question $5,943,419 in Title I payments that were reimbursed without adequate support. This amount represents the errors found in eight out of ten tested sample items. Given a total population of $102,446,866, we estimate likely questioned costs exceed $25 million for the Title I program. Additionally, we question $523,706 in Title II costs, $66,040 in Title III costs, and $73,152 in Title IV costs, as these were part of the same subrecipient cash requests reviewed for the Title I program. Context: The major federal program we tested was Title I. The objective of the program is to improve the teaching and learning of children who are at risk of not meeting challenging state academic standards and who reside in areas with high concentrations of children from low-income families. We designed a sample to test 60 items out of a population of 4,214 reimbursements. This sample was not statistically valid. We tested the first 10 sample items and found inadequate documentation for eight. We considered this material noncompliance and did not test the remaining 50 items. We noted the following exceptions: • One closeout cash request for $62,795 included no documentation to indicate what costs the LEA incurred. • Most cash requests for salary and fringe benefits lacked the names of individuals compensated, the roles/titles of personnel, and the dates associated with the compensation. • Documentation did not provide enough detail to discern whether costs were necessary for or related to the Title I program. • One cash request included supplies of $146,646, including food purchases for pizza, although the office’s own monitoring tool indicates, “Activities offered using Title I funds must provide information to or build the capacity of parents and families to support their child’s academic achievement. Open houses, Muffin/Donut days, BBQs, or other meet-and-greet activities are unacceptable.” We cannot tell how much was spent on pizza because it was combined with other items. Office approval is typically limited to comparing the approved budget categories on the Grant Application Notification (GAN) to the budget categories on the LEA’s cash request. Title I is part of the Elementary and Secondary Education Act (ESEA). Federal regulations allow states to accept consolidated applications for all titles included under ESEA. The office accepts consolidated applications from the school districts. Under the ESEA consolidated application, school districts are able to submit a schoolwide cash request for all federal titles included under their consolidated application. In our review, we identified eight questioned cash requests, six were for schoolwide cash requests. While Title II, Title III and Title IV were not major federal programs, the known questioned costs for these three programs exceeded the federal reporting threshold. Effect: The office reimbursed LEAs for Title I costs that were not adequately supported at the time of reimbursement. This increases the risk that LEAs used Title I funds for unallowable activities or unallowed costs. Finally, subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: Office staff believe they are requesting sufficient documentation, and they said the cash requests and applications contain all the information for office staff to be confident in the expenditures. Office staff also note that they can request more information from LEAs if there is something they are not confident about. They point out that LEAs receive annual independent audits and the office must depend on the accuracy and reliability of those audit processes and reports. However, based on office documentation, less than 17 percent of Title I LEAs get an audit with federal compliance testing. In addition, federal regulations require more subrecipient monitoring than reviewing audit reports, and we found noncompliance with the office’s other subrecipient monitoring procedures during the audit period. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to require LEAs to submit adequate documentation with reimbursement requests. B. Only reimburse LEAs for expenditures when their documentation is sufficient to determine if the costs are allowable to the program, in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management notes that they increased the documentation requirements for cash requests at the end of the first year of the audit period. LEAs are required to maintain all receipts and provide them upon request. Management also notes no request for additional LEA documentation was included as part of this audit process. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. Cash requests from both years of the audit period were tested, and instances of insufficient documentation were found throughout the audit period. While we are not prohibited from requesting subrecipients’ documentation during an audit, we are not required to do so. It is our position that unless the office maintains this documentation or documents their monitoring activities, compliance with the requirements applicable to the office cannot be demonstrated. As such, our recommendation stands.

Finding 2023-038: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A ALN #84.367, Supporting Effective Instruction State Grants (Title II) Grant #S367A220025, S367A210025, S367A200025 ALN #84.365, English Language Acquisition State Grants (Title III) Grant #S365A22002, S365A20002 ALN #84.424 Student Support and Academic Enrichment Program (Title IV) Grant #S424A200027 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) reimbursed Local Educational Agencies (LEAs) without receiving sufficiently detailed documentation to determine whether the LEAs were seeking reimbursement for allowed activities or allowable costs. Internal controls were not adequate to ensure proper documentation is received from the LEAs before making a reimbursement. We also addressed incomplete subrecipient monitoring in finding number 2023-035. Questioned Costs: We question $5,943,419 in Title I payments that were reimbursed without adequate support. This amount represents the errors found in eight out of ten tested sample items. Given a total population of $102,446,866, we estimate likely questioned costs exceed $25 million for the Title I program. Additionally, we question $523,706 in Title II costs, $66,040 in Title III costs, and $73,152 in Title IV costs, as these were part of the same subrecipient cash requests reviewed for the Title I program. Context: The major federal program we tested was Title I. The objective of the program is to improve the teaching and learning of children who are at risk of not meeting challenging state academic standards and who reside in areas with high concentrations of children from low-income families. We designed a sample to test 60 items out of a population of 4,214 reimbursements. This sample was not statistically valid. We tested the first 10 sample items and found inadequate documentation for eight. We considered this material noncompliance and did not test the remaining 50 items. We noted the following exceptions: • One closeout cash request for $62,795 included no documentation to indicate what costs the LEA incurred. • Most cash requests for salary and fringe benefits lacked the names of individuals compensated, the roles/titles of personnel, and the dates associated with the compensation. • Documentation did not provide enough detail to discern whether costs were necessary for or related to the Title I program. • One cash request included supplies of $146,646, including food purchases for pizza, although the office’s own monitoring tool indicates, “Activities offered using Title I funds must provide information to or build the capacity of parents and families to support their child’s academic achievement. Open houses, Muffin/Donut days, BBQs, or other meet-and-greet activities are unacceptable.” We cannot tell how much was spent on pizza because it was combined with other items. Office approval is typically limited to comparing the approved budget categories on the Grant Application Notification (GAN) to the budget categories on the LEA’s cash request. Title I is part of the Elementary and Secondary Education Act (ESEA). Federal regulations allow states to accept consolidated applications for all titles included under ESEA. The office accepts consolidated applications from the school districts. Under the ESEA consolidated application, school districts are able to submit a schoolwide cash request for all federal titles included under their consolidated application. In our review, we identified eight questioned cash requests, six were for schoolwide cash requests. While Title II, Title III and Title IV were not major federal programs, the known questioned costs for these three programs exceeded the federal reporting threshold. Effect: The office reimbursed LEAs for Title I costs that were not adequately supported at the time of reimbursement. This increases the risk that LEAs used Title I funds for unallowable activities or unallowed costs. Finally, subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: Office staff believe they are requesting sufficient documentation, and they said the cash requests and applications contain all the information for office staff to be confident in the expenditures. Office staff also note that they can request more information from LEAs if there is something they are not confident about. They point out that LEAs receive annual independent audits and the office must depend on the accuracy and reliability of those audit processes and reports. However, based on office documentation, less than 17 percent of Title I LEAs get an audit with federal compliance testing. In addition, federal regulations require more subrecipient monitoring than reviewing audit reports, and we found noncompliance with the office’s other subrecipient monitoring procedures during the audit period. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to require LEAs to submit adequate documentation with reimbursement requests. B. Only reimburse LEAs for expenditures when their documentation is sufficient to determine if the costs are allowable to the program, in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management notes that they increased the documentation requirements for cash requests at the end of the first year of the audit period. LEAs are required to maintain all receipts and provide them upon request. Management also notes no request for additional LEA documentation was included as part of this audit process. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. Cash requests from both years of the audit period were tested, and instances of insufficient documentation were found throughout the audit period. While we are not prohibited from requesting subrecipients’ documentation during an audit, we are not required to do so. It is our position that unless the office maintains this documentation or documents their monitoring activities, compliance with the requirements applicable to the office cannot be demonstrated. As such, our recommendation stands.

Finding 2023-038: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A ALN #84.367, Supporting Effective Instruction State Grants (Title II) Grant #S367A220025, S367A210025, S367A200025 ALN #84.365, English Language Acquisition State Grants (Title III) Grant #S365A22002, S365A20002 ALN #84.424 Student Support and Academic Enrichment Program (Title IV) Grant #S424A200027 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) reimbursed Local Educational Agencies (LEAs) without receiving sufficiently detailed documentation to determine whether the LEAs were seeking reimbursement for allowed activities or allowable costs. Internal controls were not adequate to ensure proper documentation is received from the LEAs before making a reimbursement. We also addressed incomplete subrecipient monitoring in finding number 2023-035. Questioned Costs: We question $5,943,419 in Title I payments that were reimbursed without adequate support. This amount represents the errors found in eight out of ten tested sample items. Given a total population of $102,446,866, we estimate likely questioned costs exceed $25 million for the Title I program. Additionally, we question $523,706 in Title II costs, $66,040 in Title III costs, and $73,152 in Title IV costs, as these were part of the same subrecipient cash requests reviewed for the Title I program. Context: The major federal program we tested was Title I. The objective of the program is to improve the teaching and learning of children who are at risk of not meeting challenging state academic standards and who reside in areas with high concentrations of children from low-income families. We designed a sample to test 60 items out of a population of 4,214 reimbursements. This sample was not statistically valid. We tested the first 10 sample items and found inadequate documentation for eight. We considered this material noncompliance and did not test the remaining 50 items. We noted the following exceptions: • One closeout cash request for $62,795 included no documentation to indicate what costs the LEA incurred. • Most cash requests for salary and fringe benefits lacked the names of individuals compensated, the roles/titles of personnel, and the dates associated with the compensation. • Documentation did not provide enough detail to discern whether costs were necessary for or related to the Title I program. • One cash request included supplies of $146,646, including food purchases for pizza, although the office’s own monitoring tool indicates, “Activities offered using Title I funds must provide information to or build the capacity of parents and families to support their child’s academic achievement. Open houses, Muffin/Donut days, BBQs, or other meet-and-greet activities are unacceptable.” We cannot tell how much was spent on pizza because it was combined with other items. Office approval is typically limited to comparing the approved budget categories on the Grant Application Notification (GAN) to the budget categories on the LEA’s cash request. Title I is part of the Elementary and Secondary Education Act (ESEA). Federal regulations allow states to accept consolidated applications for all titles included under ESEA. The office accepts consolidated applications from the school districts. Under the ESEA consolidated application, school districts are able to submit a schoolwide cash request for all federal titles included under their consolidated application. In our review, we identified eight questioned cash requests, six were for schoolwide cash requests. While Title II, Title III and Title IV were not major federal programs, the known questioned costs for these three programs exceeded the federal reporting threshold. Effect: The office reimbursed LEAs for Title I costs that were not adequately supported at the time of reimbursement. This increases the risk that LEAs used Title I funds for unallowable activities or unallowed costs. Finally, subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: Office staff believe they are requesting sufficient documentation, and they said the cash requests and applications contain all the information for office staff to be confident in the expenditures. Office staff also note that they can request more information from LEAs if there is something they are not confident about. They point out that LEAs receive annual independent audits and the office must depend on the accuracy and reliability of those audit processes and reports. However, based on office documentation, less than 17 percent of Title I LEAs get an audit with federal compliance testing. In addition, federal regulations require more subrecipient monitoring than reviewing audit reports, and we found noncompliance with the office’s other subrecipient monitoring procedures during the audit period. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to require LEAs to submit adequate documentation with reimbursement requests. B. Only reimburse LEAs for expenditures when their documentation is sufficient to determine if the costs are allowable to the program, in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management notes that they increased the documentation requirements for cash requests at the end of the first year of the audit period. LEAs are required to maintain all receipts and provide them upon request. Management also notes no request for additional LEA documentation was included as part of this audit process. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. Cash requests from both years of the audit period were tested, and instances of insufficient documentation were found throughout the audit period. While we are not prohibited from requesting subrecipients’ documentation during an audit, we are not required to do so. It is our position that unless the office maintains this documentation or documents their monitoring activities, compliance with the requirements applicable to the office cannot be demonstrated. As such, our recommendation stands.

Finding 2023-038: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A ALN #84.367, Supporting Effective Instruction State Grants (Title II) Grant #S367A220025, S367A210025, S367A200025 ALN #84.365, English Language Acquisition State Grants (Title III) Grant #S365A22002, S365A20002 ALN #84.424 Student Support and Academic Enrichment Program (Title IV) Grant #S424A200027 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) reimbursed Local Educational Agencies (LEAs) without receiving sufficiently detailed documentation to determine whether the LEAs were seeking reimbursement for allowed activities or allowable costs. Internal controls were not adequate to ensure proper documentation is received from the LEAs before making a reimbursement. We also addressed incomplete subrecipient monitoring in finding number 2023-035. Questioned Costs: We question $5,943,419 in Title I payments that were reimbursed without adequate support. This amount represents the errors found in eight out of ten tested sample items. Given a total population of $102,446,866, we estimate likely questioned costs exceed $25 million for the Title I program. Additionally, we question $523,706 in Title II costs, $66,040 in Title III costs, and $73,152 in Title IV costs, as these were part of the same subrecipient cash requests reviewed for the Title I program. Context: The major federal program we tested was Title I. The objective of the program is to improve the teaching and learning of children who are at risk of not meeting challenging state academic standards and who reside in areas with high concentrations of children from low-income families. We designed a sample to test 60 items out of a population of 4,214 reimbursements. This sample was not statistically valid. We tested the first 10 sample items and found inadequate documentation for eight. We considered this material noncompliance and did not test the remaining 50 items. We noted the following exceptions: • One closeout cash request for $62,795 included no documentation to indicate what costs the LEA incurred. • Most cash requests for salary and fringe benefits lacked the names of individuals compensated, the roles/titles of personnel, and the dates associated with the compensation. • Documentation did not provide enough detail to discern whether costs were necessary for or related to the Title I program. • One cash request included supplies of $146,646, including food purchases for pizza, although the office’s own monitoring tool indicates, “Activities offered using Title I funds must provide information to or build the capacity of parents and families to support their child’s academic achievement. Open houses, Muffin/Donut days, BBQs, or other meet-and-greet activities are unacceptable.” We cannot tell how much was spent on pizza because it was combined with other items. Office approval is typically limited to comparing the approved budget categories on the Grant Application Notification (GAN) to the budget categories on the LEA’s cash request. Title I is part of the Elementary and Secondary Education Act (ESEA). Federal regulations allow states to accept consolidated applications for all titles included under ESEA. The office accepts consolidated applications from the school districts. Under the ESEA consolidated application, school districts are able to submit a schoolwide cash request for all federal titles included under their consolidated application. In our review, we identified eight questioned cash requests, six were for schoolwide cash requests. While Title II, Title III and Title IV were not major federal programs, the known questioned costs for these three programs exceeded the federal reporting threshold. Effect: The office reimbursed LEAs for Title I costs that were not adequately supported at the time of reimbursement. This increases the risk that LEAs used Title I funds for unallowable activities or unallowed costs. Finally, subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: Office staff believe they are requesting sufficient documentation, and they said the cash requests and applications contain all the information for office staff to be confident in the expenditures. Office staff also note that they can request more information from LEAs if there is something they are not confident about. They point out that LEAs receive annual independent audits and the office must depend on the accuracy and reliability of those audit processes and reports. However, based on office documentation, less than 17 percent of Title I LEAs get an audit with federal compliance testing. In addition, federal regulations require more subrecipient monitoring than reviewing audit reports, and we found noncompliance with the office’s other subrecipient monitoring procedures during the audit period. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to require LEAs to submit adequate documentation with reimbursement requests. B. Only reimburse LEAs for expenditures when their documentation is sufficient to determine if the costs are allowable to the program, in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management notes that they increased the documentation requirements for cash requests at the end of the first year of the audit period. LEAs are required to maintain all receipts and provide them upon request. Management also notes no request for additional LEA documentation was included as part of this audit process. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. Cash requests from both years of the audit period were tested, and instances of insufficient documentation were found throughout the audit period. While we are not prohibited from requesting subrecipients’ documentation during an audit, we are not required to do so. It is our position that unless the office maintains this documentation or documents their monitoring activities, compliance with the requirements applicable to the office cannot be demonstrated. As such, our recommendation stands.

Finding 2023-038: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A ALN #84.367, Supporting Effective Instruction State Grants (Title II) Grant #S367A220025, S367A210025, S367A200025 ALN #84.365, English Language Acquisition State Grants (Title III) Grant #S365A22002, S365A20002 ALN #84.424 Student Support and Academic Enrichment Program (Title IV) Grant #S424A200027 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) reimbursed Local Educational Agencies (LEAs) without receiving sufficiently detailed documentation to determine whether the LEAs were seeking reimbursement for allowed activities or allowable costs. Internal controls were not adequate to ensure proper documentation is received from the LEAs before making a reimbursement. We also addressed incomplete subrecipient monitoring in finding number 2023-035. Questioned Costs: We question $5,943,419 in Title I payments that were reimbursed without adequate support. This amount represents the errors found in eight out of ten tested sample items. Given a total population of $102,446,866, we estimate likely questioned costs exceed $25 million for the Title I program. Additionally, we question $523,706 in Title II costs, $66,040 in Title III costs, and $73,152 in Title IV costs, as these were part of the same subrecipient cash requests reviewed for the Title I program. Context: The major federal program we tested was Title I. The objective of the program is to improve the teaching and learning of children who are at risk of not meeting challenging state academic standards and who reside in areas with high concentrations of children from low-income families. We designed a sample to test 60 items out of a population of 4,214 reimbursements. This sample was not statistically valid. We tested the first 10 sample items and found inadequate documentation for eight. We considered this material noncompliance and did not test the remaining 50 items. We noted the following exceptions: • One closeout cash request for $62,795 included no documentation to indicate what costs the LEA incurred. • Most cash requests for salary and fringe benefits lacked the names of individuals compensated, the roles/titles of personnel, and the dates associated with the compensation. • Documentation did not provide enough detail to discern whether costs were necessary for or related to the Title I program. • One cash request included supplies of $146,646, including food purchases for pizza, although the office’s own monitoring tool indicates, “Activities offered using Title I funds must provide information to or build the capacity of parents and families to support their child’s academic achievement. Open houses, Muffin/Donut days, BBQs, or other meet-and-greet activities are unacceptable.” We cannot tell how much was spent on pizza because it was combined with other items. Office approval is typically limited to comparing the approved budget categories on the Grant Application Notification (GAN) to the budget categories on the LEA’s cash request. Title I is part of the Elementary and Secondary Education Act (ESEA). Federal regulations allow states to accept consolidated applications for all titles included under ESEA. The office accepts consolidated applications from the school districts. Under the ESEA consolidated application, school districts are able to submit a schoolwide cash request for all federal titles included under their consolidated application. In our review, we identified eight questioned cash requests, six were for schoolwide cash requests. While Title II, Title III and Title IV were not major federal programs, the known questioned costs for these three programs exceeded the federal reporting threshold. Effect: The office reimbursed LEAs for Title I costs that were not adequately supported at the time of reimbursement. This increases the risk that LEAs used Title I funds for unallowable activities or unallowed costs. Finally, subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: Office staff believe they are requesting sufficient documentation, and they said the cash requests and applications contain all the information for office staff to be confident in the expenditures. Office staff also note that they can request more information from LEAs if there is something they are not confident about. They point out that LEAs receive annual independent audits and the office must depend on the accuracy and reliability of those audit processes and reports. However, based on office documentation, less than 17 percent of Title I LEAs get an audit with federal compliance testing. In addition, federal regulations require more subrecipient monitoring than reviewing audit reports, and we found noncompliance with the office’s other subrecipient monitoring procedures during the audit period. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to require LEAs to submit adequate documentation with reimbursement requests. B. Only reimburse LEAs for expenditures when their documentation is sufficient to determine if the costs are allowable to the program, in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management notes that they increased the documentation requirements for cash requests at the end of the first year of the audit period. LEAs are required to maintain all receipts and provide them upon request. Management also notes no request for additional LEA documentation was included as part of this audit process. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. Cash requests from both years of the audit period were tested, and instances of insufficient documentation were found throughout the audit period. While we are not prohibited from requesting subrecipients’ documentation during an audit, we are not required to do so. It is our position that unless the office maintains this documentation or documents their monitoring activities, compliance with the requirements applicable to the office cannot be demonstrated. As such, our recommendation stands.

Finding 2023-038: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A ALN #84.367, Supporting Effective Instruction State Grants (Title II) Grant #S367A220025, S367A210025, S367A200025 ALN #84.365, English Language Acquisition State Grants (Title III) Grant #S365A22002, S365A20002 ALN #84.424 Student Support and Academic Enrichment Program (Title IV) Grant #S424A200027 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) reimbursed Local Educational Agencies (LEAs) without receiving sufficiently detailed documentation to determine whether the LEAs were seeking reimbursement for allowed activities or allowable costs. Internal controls were not adequate to ensure proper documentation is received from the LEAs before making a reimbursement. We also addressed incomplete subrecipient monitoring in finding number 2023-035. Questioned Costs: We question $5,943,419 in Title I payments that were reimbursed without adequate support. This amount represents the errors found in eight out of ten tested sample items. Given a total population of $102,446,866, we estimate likely questioned costs exceed $25 million for the Title I program. Additionally, we question $523,706 in Title II costs, $66,040 in Title III costs, and $73,152 in Title IV costs, as these were part of the same subrecipient cash requests reviewed for the Title I program. Context: The major federal program we tested was Title I. The objective of the program is to improve the teaching and learning of children who are at risk of not meeting challenging state academic standards and who reside in areas with high concentrations of children from low-income families. We designed a sample to test 60 items out of a population of 4,214 reimbursements. This sample was not statistically valid. We tested the first 10 sample items and found inadequate documentation for eight. We considered this material noncompliance and did not test the remaining 50 items. We noted the following exceptions: • One closeout cash request for $62,795 included no documentation to indicate what costs the LEA incurred. • Most cash requests for salary and fringe benefits lacked the names of individuals compensated, the roles/titles of personnel, and the dates associated with the compensation. • Documentation did not provide enough detail to discern whether costs were necessary for or related to the Title I program. • One cash request included supplies of $146,646, including food purchases for pizza, although the office’s own monitoring tool indicates, “Activities offered using Title I funds must provide information to or build the capacity of parents and families to support their child’s academic achievement. Open houses, Muffin/Donut days, BBQs, or other meet-and-greet activities are unacceptable.” We cannot tell how much was spent on pizza because it was combined with other items. Office approval is typically limited to comparing the approved budget categories on the Grant Application Notification (GAN) to the budget categories on the LEA’s cash request. Title I is part of the Elementary and Secondary Education Act (ESEA). Federal regulations allow states to accept consolidated applications for all titles included under ESEA. The office accepts consolidated applications from the school districts. Under the ESEA consolidated application, school districts are able to submit a schoolwide cash request for all federal titles included under their consolidated application. In our review, we identified eight questioned cash requests, six were for schoolwide cash requests. While Title II, Title III and Title IV were not major federal programs, the known questioned costs for these three programs exceeded the federal reporting threshold. Effect: The office reimbursed LEAs for Title I costs that were not adequately supported at the time of reimbursement. This increases the risk that LEAs used Title I funds for unallowable activities or unallowed costs. Finally, subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: Office staff believe they are requesting sufficient documentation, and they said the cash requests and applications contain all the information for office staff to be confident in the expenditures. Office staff also note that they can request more information from LEAs if there is something they are not confident about. They point out that LEAs receive annual independent audits and the office must depend on the accuracy and reliability of those audit processes and reports. However, based on office documentation, less than 17 percent of Title I LEAs get an audit with federal compliance testing. In addition, federal regulations require more subrecipient monitoring than reviewing audit reports, and we found noncompliance with the office’s other subrecipient monitoring procedures during the audit period. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to require LEAs to submit adequate documentation with reimbursement requests. B. Only reimburse LEAs for expenditures when their documentation is sufficient to determine if the costs are allowable to the program, in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management notes that they increased the documentation requirements for cash requests at the end of the first year of the audit period. LEAs are required to maintain all receipts and provide them upon request. Management also notes no request for additional LEA documentation was included as part of this audit process. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. Cash requests from both years of the audit period were tested, and instances of insufficient documentation were found throughout the audit period. While we are not prohibited from requesting subrecipients’ documentation during an audit, we are not required to do so. It is our position that unless the office maintains this documentation or documents their monitoring activities, compliance with the requirements applicable to the office cannot be demonstrated. As such, our recommendation stands.

Finding 2023-038: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A ALN #84.367, Supporting Effective Instruction State Grants (Title II) Grant #S367A220025, S367A210025, S367A200025 ALN #84.365, English Language Acquisition State Grants (Title III) Grant #S365A22002, S365A20002 ALN #84.424 Student Support and Academic Enrichment Program (Title IV) Grant #S424A200027 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) reimbursed Local Educational Agencies (LEAs) without receiving sufficiently detailed documentation to determine whether the LEAs were seeking reimbursement for allowed activities or allowable costs. Internal controls were not adequate to ensure proper documentation is received from the LEAs before making a reimbursement. We also addressed incomplete subrecipient monitoring in finding number 2023-035. Questioned Costs: We question $5,943,419 in Title I payments that were reimbursed without adequate support. This amount represents the errors found in eight out of ten tested sample items. Given a total population of $102,446,866, we estimate likely questioned costs exceed $25 million for the Title I program. Additionally, we question $523,706 in Title II costs, $66,040 in Title III costs, and $73,152 in Title IV costs, as these were part of the same subrecipient cash requests reviewed for the Title I program. Context: The major federal program we tested was Title I. The objective of the program is to improve the teaching and learning of children who are at risk of not meeting challenging state academic standards and who reside in areas with high concentrations of children from low-income families. We designed a sample to test 60 items out of a population of 4,214 reimbursements. This sample was not statistically valid. We tested the first 10 sample items and found inadequate documentation for eight. We considered this material noncompliance and did not test the remaining 50 items. We noted the following exceptions: • One closeout cash request for $62,795 included no documentation to indicate what costs the LEA incurred. • Most cash requests for salary and fringe benefits lacked the names of individuals compensated, the roles/titles of personnel, and the dates associated with the compensation. • Documentation did not provide enough detail to discern whether costs were necessary for or related to the Title I program. • One cash request included supplies of $146,646, including food purchases for pizza, although the office’s own monitoring tool indicates, “Activities offered using Title I funds must provide information to or build the capacity of parents and families to support their child’s academic achievement. Open houses, Muffin/Donut days, BBQs, or other meet-and-greet activities are unacceptable.” We cannot tell how much was spent on pizza because it was combined with other items. Office approval is typically limited to comparing the approved budget categories on the Grant Application Notification (GAN) to the budget categories on the LEA’s cash request. Title I is part of the Elementary and Secondary Education Act (ESEA). Federal regulations allow states to accept consolidated applications for all titles included under ESEA. The office accepts consolidated applications from the school districts. Under the ESEA consolidated application, school districts are able to submit a schoolwide cash request for all federal titles included under their consolidated application. In our review, we identified eight questioned cash requests, six were for schoolwide cash requests. While Title II, Title III and Title IV were not major federal programs, the known questioned costs for these three programs exceeded the federal reporting threshold. Effect: The office reimbursed LEAs for Title I costs that were not adequately supported at the time of reimbursement. This increases the risk that LEAs used Title I funds for unallowable activities or unallowed costs. Finally, subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: Office staff believe they are requesting sufficient documentation, and they said the cash requests and applications contain all the information for office staff to be confident in the expenditures. Office staff also note that they can request more information from LEAs if there is something they are not confident about. They point out that LEAs receive annual independent audits and the office must depend on the accuracy and reliability of those audit processes and reports. However, based on office documentation, less than 17 percent of Title I LEAs get an audit with federal compliance testing. In addition, federal regulations require more subrecipient monitoring than reviewing audit reports, and we found noncompliance with the office’s other subrecipient monitoring procedures during the audit period. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to require LEAs to submit adequate documentation with reimbursement requests. B. Only reimburse LEAs for expenditures when their documentation is sufficient to determine if the costs are allowable to the program, in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management notes that they increased the documentation requirements for cash requests at the end of the first year of the audit period. LEAs are required to maintain all receipts and provide them upon request. Management also notes no request for additional LEA documentation was included as part of this audit process. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. Cash requests from both years of the audit period were tested, and instances of insufficient documentation were found throughout the audit period. While we are not prohibited from requesting subrecipients’ documentation during an audit, we are not required to do so. It is our position that unless the office maintains this documentation or documents their monitoring activities, compliance with the requirements applicable to the office cannot be demonstrated. As such, our recommendation stands.

Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds Federal Catalog Number: 21.027 Federal Agency: U.S. Department of Treasury Category of Finding: Subrecipient Monitoring Criteria: Pursuant to the Office of Management and Budget (OMB) 2 CFR Part 200, Appendix XI, Compliance Supplement May 2023, sections 3-M-1 and 3-M-2: "A pass-through entity (PTE) must: Monitor - Monitor the activites of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Condition: The City does not have a current written policy for subrecipient monitoring conforming to applicable Federal statutes per 2 CFR part 200, Appendix XI, Compliance Supplement May 2023, sections 3-M-1 and 3-M2. 1 of 3 invoices selected for testing did not have department head review and approval to ensure that subrecipient reimbursement request comply with the CSLFRF allowable costs. Cause: Lack of formal policies and procedures over federal requirement for subrecipient monitoring. Effect or Potential Effect: City may be sending funds to subrecipients for activities and services that are nonconforming to allowed costs under the Uniform Guidance. Questioned Cost: None Context: During the audit, we found one instance of subrecipient reimbursement that lacked evidence of review and approval. Statistical Sampling Validity: Non-statistical sampling was performed in relation to this finding. Repeat of a Prior-Year Finding: No Recommendation: We recommend the City establish an official written policy for subrecipient monitoring that is in line with the requirements of the Uniform Guidance. The policy should contain components for compliance with and references to Federal requirements, such as review of reports requested from the subrecipient regarding project status, reviewing invoices to ensure spending is limited to expenses involving approved projects, and proper approval procedures key personnel perform to ensure these invoices are valid. Management Response and Corrective Action Plan City's Response: The City concurs with the finding. Corrective Action Plan: The City will establish an official written policy for subrecipient monitoring that is in line with the requirements of the Uniform Guidance. Planned Implementation Date: December 2024 Responsible Person: Finance & Community Development Departments

2023-013 CACFP Subrecipient Monitoring BCFNA subrecipient risk assessment and monitoring procedures are not sufficient to ensure CACFP subrecipient compliance with program requirements. During the year ended June 30, 2023, the BCFNA disbursed approximately $75 million to over 750 CACFP subrecipients, which consist of child and adult care centers and sponsors of centers. Disbursements to subrecipients represented approximately 98 percent of the program's expenditures. As part of its pass-through responsibilities, 7 CFR Section 226.6(a)(5), the BCFNA is required to ensure subrecipients effectively operate the program. Regulation 2 CFR Section 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Regulation 2 CFR Section 200.332(d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. The BCFNA's subrecipient monitoring process, outlined in the Internal Nutritionist Manual, provides the requirements for monitoring the CACFP facilities/sponsors. The manual provides the planned frequency and type of monitoring activities, monitoring methods, and corrective action requirements. The manual requires the preparation of a risk assessment at the end of each monitoring review that assigns a grade of A, B, B-, or C to the facility/sponsor based on the number and severity of deficiencies and findings. Facilities/sponsors that receive a C grade are determined to be "Seriously Deficient." The assigned grade determines the required timing of future monitoring reviews of the facility/sponsor. Facilities/sponsors with an A grade will be next monitored in 3 years, a B grade within 2 years, a B- grade within 6 months to 1 year, and a C grade within 90 days. During each monitoring review, BCFNA personnel review documentation supporting a sample of claims during a test month. Any identified errors and associated overclaims/underclaims exceeding established thresholds are recouped/reimbursed in the facility's/sponsor's future claims. When reviews identify noncompliance, facilities/sponsors are required to prepare and submit a Corrective Action Plan (CAP) to the BCFNA. In addition, as noted at finding number 2023-012, the BCFNA relies on these subrecipient monitoring procedures to prevent and detect meal reimbursement claim errors. Monitoring reviews have identified significant issues and claim errors, including some potentially fraudulent activity, and led to over 15 contract terminations in recent years. To test compliance with subrecipient monitoring requirements, and to evaluate the effectiveness of BCFNA monitoring procedures, we reviewed and analyzed a randomly-selected sample of 60 BCFNA monitoring reviews conducted for 58 CACFP facilities/sponsors during the year ended June 30, 2023. While our review found the sample monitoring reviews were performed in accordance with the policies and procedures outlined in the Internal Nutritionist Manual, we identified areas where these policies and procedures could be strengthened and improved to ensure facilities/sponsors comply with program requirements and submit proper claims. Our review and analysis of the 60 sampled monitoring reviews noted the monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims. Our comparison of the sampled reviews to prior reviews noted deficient facilities/sponsors generally had continued deficiencies and little improvement from prior reviews, as shown below: • 30 facilities/sponsors received an A grade, while 28 received grades of B, B-, or C • Of the 26 facilities/sponsors that received grades of B, B-, or C, and had a prior review, 19 (73 percent) received the same or lower grade than the prior review • Of the 5 facilities/sponsors that received a C grade and had a prior review, 2 (40 percent) received the same grade as the prior review, and 3 (60 percent) received a lower grade than the prior review • 2 of the 5 facilities/sponsors that received a C grade were terminated as a result of the review or a subsequent 90-day follow-up review • For 41 of 58 (71 percent) monitoring reviews for which the BCFNA tested claims (with claims totaling $482,654 during the test months), the BCFNA identified net overclaims totaling $50,674, or at least 11 percent of the reimbursements tested. A. Risk Assessments The BCFNA prepares and uses risk assessments to determine the extent of monitoring necessary for each facility/sponsor. However, these risk assessments consider only the previous monitoring review grade (conducted up to 3 years previously), and do not consider other pertinent risk factors outlined in federal regulations. Regulation 2 CFR Section 200.332(b) suggests risk assessments should consider the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially-changed systems, and the extent and results of federal awarding agency monitoring. Upon our inquiries about these risk factors, BCFNA officials indicated they are not required to consider these other factors in the risk assessments. While federal regulations provide the BCFNA discretion in selecting risk factors to consider, limiting risk assessments to only one risk factor and ignoring other relevant factors hinders the BCFNA 's ability to identify red flags and fraud risk factors and properly assess facility/sponsor risk of noncompliance. Sufficient risk assessments are necessary to ensure monitoring reviews are conducted with adequate frequency to help ensure subrecipient compliance with program requirements. Finding classification This finding is classified as a significant deficiency in internal control and nonmaterial noncompliance with the federal subrecipient monitoring requirements regarding risk assessments. As noted in the finding, BCFNA risk assessments do not meet the spirit of the federal regulation which suggests the extent and level of monitoring for each subrecipient be based on various risk factors. As a result, there is a risk that monitoring reviews will not be performed as frequently and thoroughly as needed to identify and address subrecipient noncompliance. Because the BCFNA does perform risk assessments for each subrecipient and does monitor the subrecipients with lower grades with more frequency, the finding did not rise to a level of material noncompliance, and was therefore considered nonmaterial noncompliance. Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits and the AICPA Audit Guide: Government Auditing Standards and Single Audits (Audit Guide). In addition to the definitions outlined in part B of this finding, the Audit Guide states "[a] significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with a type of compliance requirement of a federal program that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance." Our evaluation of the deficiencies for the possibility and magnitude of potential noncompliance determined the deficiencies are considered a significant deficiency. B. Subrecipient Monitoring Procedures Our review of BCFNA subrecipient monitoring procedures noted areas that should be strengthened and improved. Corrective action plans BCFNA CAP review procedures are not adequate to ensure facilities/sponsors have made or planned sufficient corrective actions to address noncompliance, as required by federal regulations. The Internal Nutritionist Manual requires nutritionists to review subrecipient CAPs outlining corrective actions taken or planned for completeness and to ensure the required action items are adequately addressed. However, this review is generally performed without verifying the accuracy of the CAP information through review of supporting documentation, testing, or other methods. The BCFNA does not require submission of supporting documentation of corrective actions taken or planned. BCFNA officials indicated they may request supporting documentation on occasion depending on the complexity of the finding; and indicated they verify the CAP during 90-day follow-up reviews of Seriously Deficient facilities/sponsors. Of the 60 monitoring reviews in our sample, 51 required a CAP. The monitoring review documentation indicated the CAP was verified during the five 90-day follow-up reviews and one technical assistance review, but there was no documentation that the nutritionist verified the CAP information for any of the remaining 45 reviews (88 percent of the 51 reviews that required a CAP). Furthermore, our review of monitoring review documentation noted numerous instances where the prior year CAP indicated a specific deficiency was addressed, but the same deficiency was again noted in the subsequent review. Regulation 2 CFR Section 200.332(d) provides that monitoring must include following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies identified. The USDA CACFP handbook, Monitoring Handbook for State Agencies (USDA Monitoring Handbook), provides that follow-up reviews (on-site or desk reviews of paperwork) may be conducted any time corrective action is required to ensure the facility/sponsor has completely corrected the review findings, according to their approved corrective action response. Example CAP forms included in the USDA Monitoring Handbook require facilities/sponsors to submit supporting documentation along with the CAP to verify corrections were made or will be implemented. The USDA CACFP handbook, Serious Deficiency, Suspension, & Appeals for State Agencies & Sponsoring Organizations, provides that facilities/sponsors deemed Seriously Deficient must submit additional supporting documentation with the CAP to document that corrective actions have occurred; this might include copies of income eligibility forms, enrollment rosters, staff training documentation, site monitoring reports, menus, child nutrition labels or manufacturers’ product analysis sheets or recipes, attendance records, meal count forms, and itemized food receipts. BCFNA officials stated they believe their practices comply with federal regulations. They also stated they believe federal regulations do not require physical verification or review of supporting documentation to verify the CAPs immediately at the time of submission, and following up during the next scheduled review is allowed. Without verifying information in CAPs submitted, the BCFNA cannot demonstrate compliance with federal regulations and lacks assurance the facilities/sponsors took timely and appropriate action on all deficiencies identified during monitoring reviews. In addition, there is increased risk that deficiencies will not be corrected and will continue without detection. Claims testing The Internal Nutritionist Manual and monitoring practices provide for testing of a sample of claims within only 1 test month during each monitoring review, and do not provide for expanded testing when significant errors are identified. BCFNA personnel indicated monitoring reviews are limited to only 1 test month since the USDA Monitoring Handbook does not require expanded testing of records beyond 1 month. While the BCFNA performs additional testing during 90-day follow-up reviews for facilities/sponsors deemed Seriously Deficient, additional testing is not performed in any other situation. For example, one facility had a 43% overpayment rate and received a B grade and another facility had a 29% overpayment rate and received a B- grade; however, additional testing was not performed for either facility and subsequent monitoring was not yet scheduled for 2 years and 1 year, respectively. The USDA Monitoring Handbook suggests testing activities during 1 test month, and also suggests the state agency may determine additional review is warranted and review records beyond the test month to determine the extent of the noncompliance. When significant errors are identified, additional testing would help BCFNA nutritionists determine the extent that instances of noncompliance are isolated versus pervasive. Such information would be valuable to the overall conclusions and grade assigned to the review, and in decisions regarding subsequent monitoring. Overclaim recoupment BCFNA subrecipient monitoring procedures do not provide for identification and pursuit of recoupment of all overpayments associated with errors identified during monitoring reviews. When overclaims due to noncompliance with eligibility requirements are identified during monitoring reviews, the BCFNA only identifies and seeks recoupment for the overclaims made during the test month. Overclaims associated with eligibility errors begin at the time the eligibility determination was made and continue until the error is discovered. Although the BCFNA is aware noncompliance occurred during the month(s) before the test month, the BCFNA does not attempt to identify those overclaims. In addition, when a facility/sponsor is terminated, the BCFNA does not always identify or seek recoupment of overclaim amounts. In our sample of 60 monitoring reviews, contracts for 2 sponsors were terminated as a result of a 90-day follow-up review. For these 2 sponsors, in the reviews prior to the 90-day follow-up reviews, the BCFNA identified and recouped significant overclaims ($21,998, or 99 percent of total claims tested for one sponsor; and $3,501, or 64 percent, for the other sponsor). In the subsequent 90-day follow-up reviews for these 2 sponsors, significant claim errors were identified in the test month claims, which totaled $12,445; however, the test month claims were not fully tested, and overclaims were not identified or recouped. Any overclaims not identified and recouped from these 2 terminated sponsors would be considered questioned costs; however, those questioned costs are unknown. BCFNA officials indicated they do not pursue recoupment of overclaims beyond the test month because this practice is allowed by the USDA. They indicated they pursue recoupment of overclaims for facilities/sponsors with terminated contracts on a case-by-case basis, considering various factors. However, 7 CFR Section 226.14 provides that state agencies shall disallow and recover any portion of a claim for reimbursement not properly payable, including claims not made in accordance with recordkeeping requirements. Pursuing full recoupment would hold facilities/sponsors accountable for all overclaims and would serve as a deterrent to future errors, noncompliance, and overclaims. Furthermore, without procedures to identify and recoup all overclaims, there is a risk that significant overclaims will go undetected and unrecouped, and questioned costs could be significant. Conclusions In addition to complying with federal requirements, strong subrecipient monitoring procedures are necessary to ensure facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. Without strong internal controls, there is increased risk of noncompliance, errors, fraud, waste, and abuse of federal funds. Strong monitoring procedures would ensure facilities/sponsors are held accountable for and correct errors and noncompliance identified. The BCFNA should enhance procedures to provide for verification of CAPs and identification and recoupment of overclaims associated with all errors identified during monitoring reviews, as required by federal regulations; and expand testing when significant errors are identified. Regulation 2 CFR Section 200.332(g) requires pass-through entities to consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. Furthermore, 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing that Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Finding classification This finding is classified as a material weakness in internal control and material noncompliance with the federal subrecipient monitoring requirements. Our audit of the BCFNA's compliance with federal subrecipient monitoring requirements concluded the BCFNA did not materially comply with federal requirements to ensure subrecipients effectively operate the CACFP and to monitor the activities of the subrecipient as necessary to ensure the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. This conclusion is based on the facts, deficiencies, and noncompliance stated in the finding, including the following: 1) Disbursements to subrecipients represented approximately 98 percent of the CACFP expenditures. 2) BCFNA subrecipient monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims; and deficiencies identified often continued for years with little improvement from review to review. The 11 percent subrecipient payment error rate identified by the BCFNA, which exceeds our audit materiality threshold of 4 percent, along with the high rate of continued noncompliance, serve as indicators of the effectiveness or ineffectiveness of the BCFNA monitoring process. 3) The BCFNA did not comply with specific components of federal subrecipient monitoring requirements, including properly following up and ensuring subrecipients take timely and appropriate action on all deficiencies identified and disallowing and recovering improper payments. 4) Multiple deficiencies in monitoring procedures were identified, including the previously-listed deficiencies and inadequate payment testing. In conducting a single audit in accordance with 2 CFR Part 200 (Uniform Guidance), auditors are required by 2 CFR Section 200.514(d)(1)(2), to determine whether the auditee has complied with federal statutes, regulations, and the terms and conditions of federal awards that may have a direct and material effect on each of its major programs, as outlined in the OMB Compliance Supplement. While compliance with the USDA CACFP handbooks was considered in the our audit, our conclusion on compliance is based on the BCFNA's compliance with the federal statutes and regulations, as required. Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits and the Audit Guide. The Audit Guide provides the following definitions regarding internal control deficiencies: "A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis." "A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis." "A reasonable possibility exists when the likelihood of the event is either reasonably possible or probable…" Reasonably possible is "[t]he chance of the future event or events occurring is more than remote but less than likely." Probable means "[t]he future event or events are likely to occur." The failure to design and implement adequate controls and procedures over subrecipient monitoring led to material noncompliance with the subrecipient monitoring requirements. The BCFNA's controls failed to develop an effective subrecipient monitoring process that ensures subrecipients use subawards for authorized purposes, comply with the terms and conditions of the subawards, and achieve performance goals. Because the internal control deficiencies have not been corrected, it is probable that the material noncompliance will continue. For these reasons, the deficiencies are considered a material weakness. Recommendations The DHSS through the BCFNA: A. Implement a CACFP subrecipient risk assessment process that is consistent with federal regulations. B. Review, strengthen, and enforce subrecipient monitoring procedures to ensure CACFP facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. The BCFNA should enhance procedures to provide for verification of CAP information and identification and recoupment of overclaims associated with all errors identified during monitoring reviews, as required by federal regulations; and expand testing when significant errors are identified. The DHSS should identify and recoup the overclaims for the 2 terminated sponsors noted in this finding. Auditee's Response A. We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement. B. We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement. Auditor's Comment Finding A. The DHSS Corrective Action Plan (CAP) states the DHSS disagrees with the State Auditor's Office (SAO) recommendation because they believe the BCFNA risk assessment process considers relevant information and complies with the substance and spirit of the federal regulations. During the audit, BCFNA officials stated their risk assessments consider only one risk factor because they are not required to consider all suggested risk factors outlined in 2 CFR Section 200.332(b). However, in their CAP, the DHSS claims the BCFNA formal risk assessment process considers all suggested risk factors. During our audit, the documented risk assessments completed by DHSS for the 58 sampled subrecipients showed the BCFNA only considered one risk factor, and did not consider other pertinent risk factors outlined in 2 CFR Section 200.332(b) which contradicts the DHSS position presented in their CAP. Additionally, the CAP indicates considerations for new personnel or systems are made during onsite monitoring visits; however, 2 CFR Section 200.332(b) requires these considerations to be evaluated prior to the monitoring visit as part of the risk assessment process. Finding B. The DHSS CAP states the DHSS disagrees with the SAO's recommendation that monitoring procedures should be strengthened. The CAP states the DHSS believes the BCFNA has a strong system of internal controls over subrecipient monitoring documented in the Internal Nutritionist Manual and believes these controls are in compliance with federal regulations. However, in making these statements, the DHSS has failed to recognize and acknowledge existing subrecipient monitoring procedures have allowed serious and material subrecipient noncompliance. As part of its pass-through responsibilities outlined in the federal regulations, the BCFNA is required to ensure subrecipients comply with federal regulations and terms and conditions of the subaward, and effectively operate the program. Given the level of material subrecipient noncompliance that has occurred and continues to occur, BCFNA subrecipient monitoring procedures are clearly not sufficient to prevent future noncompliance. The BCFNA has focused on individual components of its systems, but has not holistically evaluated whether the procedures, collectively and in their entirety, comply with the federal subrecipient monitoring requirements. The BCFNA continues to strictly follow existing procedures without making adequate adjustments to address and mitigate the serious subrecipient problems. Recognizing problems and reacting to those problems are critical components of an effective internal control system designed to ensure compliance with the federal requirements. The finding addresses three specific aspects of the BCFNA subrecipient monitoring program that could be strengthened to help bring the BCFNA into overall compliance with federal subrecipient monitoring requirements. Some individual processes are not in compliance with federal regulations and some could be improved by doing more than what is minimally required. The DHSS CAP argues they are in full compliance with each of these aspects and no improvements are needed. Corrective action plans The DHSS CAP claims the BCFNA process to verify subrecipient CAPs during the next scheduled review is in compliance with federal regulations which require the BCFNA to ensure subrecipients take timely and appropriate action. While verifications performed during 90-day follow up reviews would be considered timely, for verifications conducted 6 months to 3 years after receipt of the subrecipient CAP, it is impossible for the BCFNA to ensure corrective action was taken within timeframes indicated in the subrecipient CAP or to demonstrate compliance with this monitoring requirement. The DHSS CAP claims this process is in accordance with USDA regulations; however, as noted in the finding, USDA guidance suggests the BCFNA perform follow up reviews to ensure the subrecipient has completely corrected the review findings. When follow up reviews are not performed timely, the BCFNA has no assurance that subrecipients are in compliance with their CAPs. Claims testing The DHSS CAP claims BCFNA procedures are adequate since they comply with the minimum USDA guidance for testing claims. The CAP further claims the Internal Nutritionist Manual allows for, and the BCFNA conducts, expanded testing beyond the test month when warranted. However, the manual does not mention testing beyond the test month, and no expanded testing was performed for any of the 60 sampled monitoring reviews. The finding notes instances where subrecipients had significant overpayment rates (43% and 29%), yet no additional testing was performed and subsequent monitoring was not scheduled for 1 or 2 years. This indicates the DHSS claims testing could be improved to ensure compliance with subrecipient monitoring responsibilities. Overclaim recoupment The DHSS CAP claims the BCFNA practice to pursue recoupment of overclaims for only the test month is adequate since this minimum practice is allowed by the USDA. This practice could be viewed as an incentive for subrecipients to intentionally overclaim meals, knowing that only 1 month of overclaims (out of a period up to 3 years since the last monitoring review) would be subject to repayment. The CAP also claims recoupment of overclaims is pursued for subrecipients with terminated contracts on a case-by-case basis; however, such recoupment was not pursued for the 2 applicable sampled reviews with significant claims errors identified in the test month. Without pursuing recoupment of overclaims, the BCFNA is not in compliance with 7 CFR Section 226.14 and lacks strong policies for deterring future noncompliance and overclaims. The DHSS CAP argues the 11 percent error rate, based on the sample of monitoring reviews performed during the year ended June 30, 2023, is inflated because the reviews are proportionally more likely to include a higher number of claims with discrepancies. However, this error rate is just one indicator of the serious ongoing subrecipient problems. The DHSS CAP includes various misrepresentations of the contents of the finding. These statements, which attempt to negate or reduce the significance of the noncompliance noted in the finding, are listed below (in quotes): 1) "The SAO has not noted any specific noncompliance with federal requirements regarding subrecipient monitoring." This statement is incorrect. The finding states the BCFNA did not comply with overall subrecipient monitoring requirements as well as specific components of those requirements, including properly following up and ensuring subrecipients take timely and appropriate action on all deficiencies identified and disallowing and recovering improper payments. 2) "Out of the SAO's test sample of 60 monitoring reviews, only 9 of the overclaims were over the $600 threshold of acceptable risk set by the USDA." This statement is incorrect. Of the 36 sampled monitoring reviews with overclaims totaling $50,954, 13 reviews with overclaims totaling $46,724, were in excess of $600. As noted in the finding, if the remaining 23 overpayments of $600 or less, totaling $4,230 are excluded, the error rate is at least 9 percent. Subrecipient data clearly shows significant subrecipient noncompliance is occurring within the CACFP program. These problems cannot be denied and should not be ignored. Until the DHSS recognizes these problems, acknowledges there are weaknesses in its existing procedures, and takes action to strengthen its procedures, significant subrecipient noncompliance will likely continue.

2023-010 SLFRF Program Subrecipient Monitoring The OA has not established policies and procedures regarding monitoring subrecipients of the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program. As a result, the OA did not comply with the Uniform Guidance (UG) requirements regarding identifying and monitoring subrecipients of the SLFRF program. The OA is the lead agency responsible for administering the SLFRF program. The purpose of the SLFRF program is to provide funding to respond to the COVID-19 public health emergency (PHE) or its negative impacts; respond to workers performing essential work during the PHE; provide government services, to the extent of the reduction in revenue due to the PHE (revenue replacement); and make necessary investments in water, sewer, or broadband infrastructure. The OA and various state agencies designed projects within the allowable SLFRF program categories, and are responsible for administering the projects. The OA developed the American Rescue Plan Act Grant Portal (portal) to serve as the official repository of information and documentation supporting each SLFRF program project. The state agencies upload supporting documentation to the portal, including contracts, payment requests, and other supporting documentation. Most payments are made on a reimbursement basis. The OA reviews each payment request and processes the payments. Some SLFRF program projects are administered through subawards. The OA establishes contracts with each subrecipient that outline various SLFRF program requirements, terms, and conditions. In the Schedule of Expenditures of Federal Awards (SEFA), the OA reported approximately $86 million was passed through to subrecipients of the SLFRF program during the year ended June 30, 2023. This amount represents approximately 50 percent of the SLFRF program expenditures. These awards were administered through the OA and 7 other state agencies. However, as noted in finding A., the amount is not accurate due to subrecipient determination errors. Of the 8 state agencies that administered subawards reported in the SEFA during the year ended June 30, 2023, 3 administered the majority of the subawards, with payments totaling approximately $72.7 million, or 85 percent of the total subrecipient payments reported in the SEFA. Our review and testing of subrecipient monitoring procedures focused on the OA and the 3 state agencies. For the 3 state agencies, a total of 55 recipients were identified as subrecipients in the SEFA. However, as noted in finding A., some of these recipients were not truly subrecipients. To understand the OA and agency procedures, and to test compliance with subrecipient monitoring requirements, we randomly selected a sample of payments to 9 subrecipients for the 3 state agencies. The 9 subrecipients were awarded nearly $166 million in SLFRF program funding and were paid a total of approximately $36.5 million during the year ended June 30, 2023. We reviewed records in the portal supporting the subaward and 1 payment for each of the 9 subrecipients. We reviewed payments totaling approximately $8 million. A. Subrecipient Determination The OA has not established policies and procedures to determine whether recipients of SLFRF program funds are subrecipients or contractors. As a result, some recipients were incorrectly classified as subrecipients, and the OA lacks a complete and accurate listing of subrecipients. Subrecipient monitoring requirements are outlined in the UG. Regulation 2 CFR Section 200.331 states a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. The classification of a subrecipient is dependent on whether the entity is responsible for making eligibility determinations for assistance, has its performance measured in relation to whether the objectives of the federal program were met, has responsibility for programmatic decision-making, is responsible for adherence to federal program requirements, and uses the federal funds to carry out a program for its public purpose. The OA did not evaluate each SLFRF program recipient for the UG criteria, and make a determination whether the entity was a subrecipient or contractor. OA officials assigned responsibility for making these determinations and identifying subrecipients to the applicable state agencies, but did not provide clear guidance to the state agencies or ensure the state agencies properly performed and documented the determinations. Two of the 3 state agencies had not documented their determination for any of their sampled subrecipients and the other state agency had not documented their determinations for 1 of 3 sampled subrecipients. Our analysis and review of the population of 55 subrecipients identified in the SEFA for the 3 state agencies revealed 2 of the state agencies had incorrectly recorded several recipients as subrecipients. For example, 1 agency incorrectly reported 8 revenue replacement project subawards, with payments totaling approximately $18.1 million and another agency incorrectly reported a revenue replacement project subaward, with payments totaling approximately $89,000, as subrecipients, during the year ended June 30, 2023. The Treasury SLFRF FAQ 13.14 says recipients of revenue replacement funds are not subrecipients. One of the agencies also incorrectly reported a software contractor, with payments totaling approximately $295,000, as a subrecipient. Without adequate procedures over subrecipient or contractor determinations, the OA lacks assurance that its subrecipients have been identified for subrecipient monitoring purposes. B. Subrecipient Monitoring The OA did not implement an effective subrecipient monitoring program to monitor the SLFRF program subrecipients. As a result, some subrecipient monitoring procedures were not performed as required by the UG. Regulation 2 CFR Section 200.332(b) states that pass-through entities must evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Risk assessments may consider factors such as the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially-changed systems, and the extent and results of federal awarding agency monitoring. Regulation 2 CFR Section 200.332(d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure that the subrecipient is in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity; (2) following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address single audit findings related to the particular subaward; and (3) issuing a management decision for applicable findings pertaining only to the federal award provided to the subrecipient from the pass-through entity. Regulation 2 CFR Section 200.332(f) requires pass-through entities to verify that every subrecipient had a single audit when it is expected that the subrecipient spent $750,000 or more during the subrecipient's fiscal year. To monitor subrecipients of the SLFRF program, the OA relies on its pre-payment monitoring process and does not perform any post-payment monitoring procedures. The OA did not establish policies and procedures over the pre-payment review process and these reviews were not always clearly documented. In addition, the OA did not formally communicate with the state agencies regarding subrecipient monitoring responsibilities or ensure the state agencies performed monitoring reviews. The information communicated to the state agencies in memos and emails and during periodic meetings with state agency officials were not formalized in a policy and did not cover all relevant compliance requirements. In addition, the OA did not perform risk assessments or ensure subrecipients received single audits as required by the UG. Risk assessments The OA did not perform required risk assessments for subrecipients of the SLFRF program to determine the nature, timing, and extent of monitoring procedures necessary. None of the 3 state agencies performed risk assessments for the sampled subrecipients. OA officials indicated they did not believe risk assessment procedures were necessary because extensive pre-payment monitoring procedures are performed for all payments. In addition to complying with federal requirements, risk assessments are necessary to ensure monitoring reviews are conducted with adequate frequency to help ensure subrecipient compliance with program requirements. OA pre-payment monitoring procedures The OA has not developed policies and procedures outlining its pre-payment monitoring procedures and did not always clearly document monitoring performed prior to making payments. In their review and approval of each SLFRF subrecipient payment request, OA officials stated they thoroughly review supporting documentation uploaded to the portal by the state agencies, including contracts, bid documentation, invoices, and other supporting documentation. OA officials further stated they review for compliance with certain types of SLFRF program compliance requirements, including allowable activities and allowable costs, procurement, and period of performance. However, the OA does not clearly document review procedures performed. For each of the 9 subrecipients sampled, the portal included documentation pertaining to some, but not all of the applicable compliance requirements. For example, for all 9 subrecipient payments reviewed, the portal lacked any documentation the subrecipient used a competitive procurement process to obtain the applicable items or services. Also, for 3 of the 9 payments reviewed, the portal included summary invoices, but did not include sufficiently detailed documentation showing compliance with the allowable activities and allowable costs and period of performance compliance requirements. Without documented policies and procedures and documentation of pre-payment monitoring procedures performed, the OA cannot demonstrate subrecipient monitoring procedures were performed. Additional monitoring procedures The OA does not monitor subrecipients beyond the pre-payment monitoring process previously described. In addition, the OA did not formally communicate with the state agencies regarding subrecipient monitoring responsibilities or ensure the state agencies performed monitoring reviews. Subrecipient contracts outline various federal requirements and terms and conditions that subrecipients must comply with both before and after receiving payments. For example, the purpose of a contract with a subrecipient is "Preparing and Credentialing Employees for Tomorrow." In addition to complying with various requirements prior to requesting reimbursement, the subrecipient is also required to comply with various requirements, terms, and conditions post-payment, such as ensuring performance goals are achieved. OA officials indicated post-payment monitoring procedures are not necessary because extensive pre-payment monitoring procedures are performed for all payments. However, the pre-payment procedures alone are not sufficient to fully comply with the OA's subrecipient monitoring responsibilities to evaluate whether subrecipients complied with federal requirements and subaward terms and conditions, and subaward performance goals are achieved. Additionally, the OA did not formally communicate subrecipient monitoring responsibilities to the state agencies or ensure the state agencies performed monitoring reviews. Our review of subrecipient monitoring procedures at the 3 state agencies noted none of the agencies had developed written policies or procedures regarding subrecipient monitoring, and review procedures did not cover all significant compliance requirements or were not always documented. While officials of 2 state agencies indicated they perform detailed pre-payment reviews for compliance with allowable activities and allowable costs, period of performance, and local match requirements, officials of the other agency explained they and the OA review only summary invoices from the subrecipients prior to payment. Officials of the other state agency stated they review the supporting documentation during their annual monitoring process; however, such reviews had not been performed for the sampled items. While officials of 1 state agency indicated they review compliance with procurement requirements, officials of 2 agencies indicated they do not review compliance with procurement requirements. Additionally, while officials of 2 state agencies described various post-payment review procedures including reviews for compliance with certain requirements, reviews of documentation supporting expenditures of funds advanced to the subrecipient, billing reviews of documentation supporting summary invoices, and reviews of the final work product; officials of the other agency indicated post-payment reviews are not performed. In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure sufficient monitoring procedures were performed and documented increases the risk that subrecipient noncompliance will not be prevented or detected timely. Subrecipient audits The OA did not conduct the required review of single audit reports for applicable SLFRF program subrecipients. The OA does not have procedures to verify every subrecipient had a single audit when required. Our review of subrecipient monitoring procedures at the 3 state agencies noted 1 agency had not established a process to monitor and follow up on single audit reports. Officials from the OA and the agency stated they were not aware of the requirement to verify that single audits were obtained. Each subrecipient that spent in excess of $750,000 in federal awards during its fiscal year must obtain a single audit in accordance with the UG within 9 months after the end of the fiscal year. In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure subrecipients received required audits and to review and follow up on the related audit reports, increases the risk that subrecipient noncompliance will not be identified and addressed. Conclusions OA officials stated they believe their pre-payment review procedures satisfy most of their subrecipient monitoring requirements. However, as noted throughout the finding, these procedures alone do not substitute for, or remove, the OA's comprehensive subrecipient monitoring responsibilities which include performing risk assessments; monitoring for compliance with federal requirements and subaward terms and conditions, and ensuring subaward performance goals are achieved; and reviewing subrecipient single audit reports. OA officials further indicated the state agencies were responsible for some of the subrecipient monitoring requirements. However, without clear communication and monitoring of these responsibilities, the OA lacks assurance of compliance with all subrecipient monitoring requirements. Without an established subrecipient monitoring program, the OA cannot provide assurance subrecipients are complying with SLFRF program requirements and there is increased risk that noncompliance with program requirements or subaward terms and conditions will go undetected, or that subaward performance goals will not be achieved. In addition, a subrecipient monitoring program is necessary to demonstrate adequate internal controls over compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraph 3.10 of the Standards for Internal Control in the Federal Government, also known as the Green Book, states "[e]ffective documentation assists in management’s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors." Paragraph 12.01 states "[m]anagement should implement control activities through policies." Recommendations The OA: A. Develop policies and procedures to determine whether recipients of SLFRF program funds are subrecipients or contractors. Work with the state agencies to ensure accurate and documented determinations are prepared for all recipients, and modify subrecipient records as needed. B. Develop a subrecipient monitoring program in accordance with the Uniform Guidance, that includes performing risk assessments for each subrecipient for the purposes of determining the appropriate subrecipient monitoring procedures; monitoring for compliance with federal requirements and subaward terms and conditions, and ensuring subaward performance goals are achieved; and reviewing subrecipient single audit reports. Ensure tasks delegated to state agencies are adequately communicated and establish procedures to ensure those tasks are appropriately completed. Auditee's Response A. We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding. B. We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding. Auditor's Comment Finding A. The OA Corrective Action Plan (CAP) states the OA disagrees with the recommendation to develop policies and procedures since the requirements are already stated in the Uniform Guidance and SLFRF program regulations. The CAP states the OA believes improved communication with the state agencies and ensuring compliance with federal regulations can be performed in lieu of developing policies and procedures. Because effective internal controls include documented policies and procedures that clearly communicate responsibilities and prevent misunderstandings, this finding is valid.

Finding Reference 2023-004 Federal Agency: U.S. Department of Housing and Urban Development Pass-Through Agency: P.R. Department of Housing Program: Community Development Block Grant/State’s Program and Non-Entitlement Grants in Hawaii (Assistance Listing No. 14.228) Compliance Requirement: Reporting (L) Type of Finding: Significant Deficiency (SD), Instance of Noncompliance (NC) Statement of Condition In our reporting test, we found that the Municipality did not submit the corresponding reports for the fiscal year ended on June 30, 2023. Criteria Based on the CDBG agreements, the Municipality must submit to the Department of Housing reports on records, collections, and disbursements of Program Income on an annual and quarterly basis. Including the progress of the projects developed with the CDBG program. In addition, the Municipality will submit all the reports required by the Agency. Failure to comply with this provision will be just cause for the Department to stop the fund requisition process. § 200.332 Requirements for pass-through entities. (1) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award. (2) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports. Cause of Condition The Municipality does not have the necessary personnel assigned to prepare and present reports in a timely manner. Effect of Condition The program is not in compliance with the reporting requirements as established in the contract agreement. Recommendation We recommend that the Municipality maintain constant monitoring to improve program controls. The reports must be presented as established in the agreement and guidelines of the Department of Housing. This will ensure compliance with the reporting requirements under the Community Development Block Grants/State’s Program and Non-entitlement Grant in Hawaii agreement. Questioned Cost None Prior Year Finding No Views of Responsible Officials and Planned Corrective Action We concur with the finding. The Municipality appointed a person to work on all the required reports. Implementation Date: August 31, 2024 Responsible Person: Belinda Álvarez Finance Director

Finding Reference 2023-004 Federal Agency: U.S. Department of Housing and Urban Development Pass-Through Agency: P.R. Department of Housing Program: Community Development Block Grant/State’s Program and Non-Entitlement Grants in Hawaii (Assistance Listing No. 14.228) Compliance Requirement: Reporting (L) Type of Finding: Significant Deficiency (SD), Instance of Noncompliance (NC) Statement of Condition In our reporting test, we found that the Municipality did not submit the corresponding reports for the fiscal year ended on June 30, 2023. Criteria Based on the CDBG agreements, the Municipality must submit to the Department of Housing reports on records, collections, and disbursements of Program Income on an annual and quarterly basis. Including the progress of the projects developed with the CDBG program. In addition, the Municipality will submit all the reports required by the Agency. Failure to comply with this provision will be just cause for the Department to stop the fund requisition process. § 200.332 Requirements for pass-through entities. (1) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award. (2) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports. Cause of Condition The Municipality does not have the necessary personnel assigned to prepare and present reports in a timely manner. Effect of Condition The program is not in compliance with the reporting requirements as established in the contract agreement. Recommendation We recommend that the Municipality maintain constant monitoring to improve program controls. The reports must be presented as established in the agreement and guidelines of the Department of Housing. This will ensure compliance with the reporting requirements under the Community Development Block Grants/State’s Program and Non-entitlement Grant in Hawaii agreement. Questioned Cost None Prior Year Finding No Views of Responsible Officials and Planned Corrective Action We concur with the finding. The Municipality appointed a person to work on all the required reports. Implementation Date: August 31, 2024 Responsible Person: Belinda Álvarez Finance Director

Subrecipient Monitoring (Significant Deficiency in Internal Controls over Compliance and instance of noncompliance) Federal agency – U.S. Department of Health and Human Services Federal program title – Foster Care – Title IV-E Assistance listing number – 93.658 Criteria – 2 CFR Part 200 Uniform Administrative Requirements, Post Federal Award Requirements and Cost Principles for Federal Award (Uniform Guidance) requires the grantee to monitor the activities of subrecipients to ensure the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and terms and conditions of the subaward. Additionally, when the County passes money through to subrecipients, the County must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward. Condition and context – During our testing in the prior fiscal year audit, we selected five subrecipients from a population of 24 subrecipients for testing and the County was unable to provide us with documentation of their risk assessment and the County did not obtain the single audit reports of the subrecipients as part of their monitoring procedures for all five. Management did obtain the California Department of Social Services management decision letters for two out of the five subrecipients tested. Given the finding was reported in May 2024, 11 months after the year ended June 30, 2023, management has not cleared the finding. Questioned costs – None Cause – The County does not have the proper training regarding compliance Uniform Guidance for subrecipients. Effect – The County was not in compliance with federal award subrecipient monitoring requirements. Continued noncompliance could result in sanctions by the federal awarding agency, including withholding future funding. Repeat finding – Yes, prior year 2022-003 Recommendation – The County should establish policies and procedures to ensure risk assessment is documented. The County should also obtain the single audit reports for their subrecipients and issue management decision letters as part of their monitoring. Views of responsible officials – The County (Human Services Agency) categorized five providers, all FFAs as subrecipients that received Title IV-E funding. These providers are clearly identified in the FY 2021/22 Schedule of Expenditures of Federal Awards (SEFA) as mandated by 2 CFR 200.332. The County (Human Services Agency) concurs that there is no documented process for completing and documenting a risk assessment, obtaining copies of the single audit reports for each FFA, group homes, and STRTPs subrecipient, and issuing management decision letters as part of a documented monitoring policy and procedure. The County (Human Services Agency) relies on CDSS to perform certain licensing and oversight functions as the single state agency for Title IV-E funds. The County (Human Services Agency) is responsible for and does review these audits and their findings; however, we concur that we did not sufficiently document our process or our follow-ups to ensure compliance.

Finding 2023-012 – Lack of Internal Controls and Noncompliance with Subrecipient Monitoring Over Federal Grant – Coronavirus State and Local Fiscal Recovery Funds PASS-THROUGH GRANTOR: Direct Grant FEDERAL AGENCY: U.S. Department of Treasury ASSISTANCE LISTING: 21.027 FEDERAL PROGRAM NAME: Coronavirus State and Local Fiscal Recovery Funds FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Subrecipient Monitoring QUESTIONED COSTS: $-0- Condition: The County does not have a subrecipient monitoring policy, and not all subrecipient agreements comprised of the following information: • Subrecipient Authorized Representative and program contact information • Subrecipient Employee Identification Number (EIN) and DUNS number • Federal Award Identification Number (FAIN) • Name of Federal Awarding Agency • Contact information for the official at the Federal Awarding Agency • Catalog of Assistance Listing (AL) number and name • Federal award date • Provide close out terms and conditions Further, subrecipient and beneficiary agreements approved by the Board of County Commissioners state that subrecipient or beneficiary shall provide monthly performance reports until all Coronavirus State and Local Fiscal Recovery Funds awarded hereunder have been expended. Through the observation of records, it was determined that monthly performance reports were not submitted each month by entities receiving Coronavirus State and Local Fiscal Recovery Funds. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal expenditures are made in accordance with compliance requirements. Effect of Condition: This condition resulted in noncompliance with Federal grant requirements. Recommendation: OSAI recommends the County gain an understanding of the requirements for this program and implement internal controls to ensure compliance with these requirements. OSAI also recommends that entities receiving ARPA funding submit monthly progress reports as stated under the reporting section of the agreements signed by the Board of County Commissioners. Management Response: Chairman of the Board of County Commissioners: The Board of County Commissioners will take measures to ensure future compliance with all requirements of federal grants. Criteria: 2 CFR § 200.332 Requirements for Pass-Through Entities states in part: All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award. (5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part. (6) Appropriate terms and conditions concerning closeout of the subaward.

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2022-010 Condition: For 3 out of 3 selections, the Federal award identification number (FAIN) and the subrecipient's unique entity identifier (UEI) were not disclosed on the subaward. For 3 out of 3 selections, there was no evidence that the prior year Single Audit Report was reviewed. Criteria: In accordance with 2 CFR §200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (c) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance related to procedures required for subrecipient monitoring. Effect: MOHS was not in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls for the program and prepare and maintain a written plan to perform risk assessments on potential subrecipients. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2022-010 Condition: For 3 out of 3 selections, the Federal award identification number (FAIN) and the subrecipient's unique entity identifier (UEI) were not disclosed on the subaward. For 3 out of 3 selections, there was no evidence that the prior year Single Audit Report was reviewed. Criteria: In accordance with 2 CFR §200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (c) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance related to procedures required for subrecipient monitoring. Effect: MOHS was not in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls for the program and prepare and maintain a written plan to perform risk assessments on potential subrecipients. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2022-010 Condition: For 3 out of 3 selections, the Federal award identification number (FAIN) and the subrecipient's unique entity identifier (UEI) were not disclosed on the subaward. For 3 out of 3 selections, there was no evidence that the prior year Single Audit Report was reviewed. Criteria: In accordance with 2 CFR §200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (c) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance related to procedures required for subrecipient monitoring. Effect: MOHS was not in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls for the program and prepare and maintain a written plan to perform risk assessments on potential subrecipients. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2022-010 Condition: For 3 out of 3 selections, the Federal award identification number (FAIN) and the subrecipient's unique entity identifier (UEI) were not disclosed on the subaward. For 3 out of 3 selections, there was no evidence that the prior year Single Audit Report was reviewed. Criteria: In accordance with 2 CFR §200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (c) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance related to procedures required for subrecipient monitoring. Effect: MOHS was not in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls for the program and prepare and maintain a written plan to perform risk assessments on potential subrecipients. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2022-010 Condition: For 3 out of 3 selections, the Federal award identification number (FAIN) and the subrecipient's unique entity identifier (UEI) were not disclosed on the subaward. For 3 out of 3 selections, there was no evidence that the prior year Single Audit Report was reviewed. Criteria: In accordance with 2 CFR §200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (c) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance related to procedures required for subrecipient monitoring. Effect: MOHS was not in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls for the program and prepare and maintain a written plan to perform risk assessments on potential subrecipients. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2022-010 Condition: For 3 out of 3 selections, the Federal award identification number (FAIN) and the subrecipient's unique entity identifier (UEI) were not disclosed on the subaward. For 3 out of 3 selections, there was no evidence that the prior year Single Audit Report was reviewed. Criteria: In accordance with 2 CFR §200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (c) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance related to procedures required for subrecipient monitoring. Effect: MOHS was not in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls for the program and prepare and maintain a written plan to perform risk assessments on potential subrecipients. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2022-010 Condition: For 3 out of 3 selections, the Federal award identification number (FAIN) and the subrecipient's unique entity identifier (UEI) were not disclosed on the subaward. For 3 out of 3 selections, there was no evidence that the prior year Single Audit Report was reviewed. Criteria: In accordance with 2 CFR §200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (c) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance related to procedures required for subrecipient monitoring. Effect: MOHS was not in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls for the program and prepare and maintain a written plan to perform risk assessments on potential subrecipients. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2022-010 Condition: For 3 out of 3 selections, the Federal award identification number (FAIN) and the subrecipient's unique entity identifier (UEI) were not disclosed on the subaward. For 3 out of 3 selections, there was no evidence that the prior year Single Audit Report was reviewed. Criteria: In accordance with 2 CFR §200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (c) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance related to procedures required for subrecipient monitoring. Effect: MOHS was not in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls for the program and prepare and maintain a written plan to perform risk assessments on potential subrecipients. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated

U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2022-010 Condition: For 3 out of 3 selections, the Federal award identification number (FAIN) and the subrecipient's unique entity identifier (UEI) were not disclosed on the subaward. For 3 out of 3 selections, there was no evidence that the prior year Single Audit Report was reviewed. Criteria: In accordance with 2 CFR §200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (c) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance related to procedures required for subrecipient monitoring. Effect: MOHS was not in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls for the program and prepare and maintain a written plan to perform risk assessments on potential subrecipients. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated

U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Condition: For 1 out of 1 selection, management was unable to provide evidence that subrecipient monitoring was performed to ensure compliance with accounting requirements. For 1 out of 1 selection, we were unable to verify the subrecipient 's active registration on SAM.gov. For 1 out of 1 selection, there was no evidence that the prior year Single Audit Report was reviewed. Criteria: In accordance with 2 CFR 200.303: Internal Control, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier. (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the Federal award. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) the results of previous audits including whether or not the subrecipient receives a Single Audit d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (f) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Baltimore City Health Department (BCHD) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD was not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.