Findings Citing § 200.332

FINDING 2024-003 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Subrecipient Monitoring Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): SLFRP1096 Compliance Requirement: Subrecipient Monitoring Audit Finding: Material Weakness INDIANA STATE BOARD OF ACCOUNTS 19 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Condition and Context Subrecipients associated with the City's Non-profit, Affordable Housing, and Homeless Initiatives activities funded by the COVID-19 - Coronavirus State and Local Fiscal Recovery Funds were required to submit reports on program activities either quarterly or monthly. The City did not have adequate internal controls in place designed to ensure that these reports were reviewed. Responsibility for reviewing these reports rested primarily with one employee. For two of three subrecipients tested, we were not able to determine that there was a second employee involved that would ensure that the reports submitted by the subrecipients were reviewed by the City. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states: "All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and include the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward notification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; INDIANA STATE BOARD OF ACCOUNTS 20 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the passthrough entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the passthrough entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports. (4) (i) An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the passthrough entity must determine the appropriate rate in collaboration with the subrecipient, which is either: (A) The negotiated indirect cost rate between the pass-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass through entity is not required to collect information justifying this rate, but may elect to do so; (B) The de minimis indirect cost rate. (ii) The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). INDIANA STATE BOARD OF ACCOUNTS 21 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and (6) Appropriate terms and conditions concerning closeout of the subaward. . . . (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. INDIANA STATE BOARD OF ACCOUNTS 22 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program related matters; and (2) Performing on-site reviews of the subrecipient's program operations. (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 of this part and in program regulations." Cause A system of internal controls to include oversite and review of the quarterly or monthly reports prepared by the subrecipients was not in place. One individual was primarily responsible for reviewing the subrecipient reports. Effect Not having procedures in place for oversite and review of the monitoring reports could lead to noncompliance with the requirements for subrecipient monitoring. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the City. INDIANA STATE BOARD OF ACCOUNTS 23 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the City establish a proper system of internal controls to include oversite and review to ensure that the subrecipient report reviews are reviewed/approved by a second party. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Federal Program – American Rescue Plan Technical Assistance Investment Program – Assistance Listing No. 10.234 – Award No. 2023-70504-40441 – Program Year 2024 – U.S. Department of Agriculture Criteria or specific requirement – Subrecipient Monitoring, 2 CFR 200.332(b), (c) and (e) Condition – The pass-through entity is responsible for identifying the award and applicable requirements to the subrecipient at the time of the subaward providing information described in 2 CFR section 200.332 to ensure the subrecipient uses the federal award in accordance with federal statues, regulations, and the terms and conditions of the award. The pass-through entity is responsible for evaluating each subrecipient’s risk of noncompliance for purposes of determining appropriate subrecipient monitoring. The pass-through entity is responsible for monitoring the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Cause – While the organization did perform certain monitoring procedures, the organization did not have sufficient controls in place to ensure agreements with subrecipients were in compliance with requirements as well as to ensure appropriate monitoring of the subrecipients’ use of funding in accordance with 2 CFR section 200.332. Effect – The organization failed to have agreements with subrecipients that were inclusive of all applicable requirements outlined within 2 CFR section 200.332. The organization did not have sufficient procedures to appropriately monitor the subrecipients’ use of funds within the reporting period. Questioned costs – N/A Context – Out of a population of 8 subrecipients, 2 subrecipients were selected for testing. For the 2 subrecipients, the agreement with the subrecipient was missing information that is required to be communicated with the subrecipient to ensure compliance with federal requirements. Additionally, for the 2 subrecipients, audit reports were not obtained by the pass-through entity during the reporting period to ensure proper use of funding received and proper monitoring of the subaward. Our sample was not and was not intended to be statistically valid. Identification as a repeat finding, if applicable – N/A Recommendation – The organization should ensure agreements with subrecipients include all information required to be communicated to the subrecipient for the subaward. The organization should put controls in place to ensure that monitoring activities are tailored to this risk of each subrecipient and appropriately followed in alignment with what is required. Views of Responsible Officials and Planned Corrective Actions – Management agrees with finding. Management plans to develop a subrecipient monitoring policy aligned with 2 CFR 200.331-333. Management will also standardize agreement templates to include all required clauses for federal award subrecipient agreements, implement a subrecipient risk assessment tool to determine monitoring frequency and risk level identification, and assign staff for annual subrecipient desk reviews or site visits based on risk levels.

Assistance Listing Number: 93.193 Name of Federal Program: COVID-19 Urban Indian Health Services Name of Federal Agency: Department of Health and Human Services Award Period: January 1, 2024 – December 31, 2024 Criteria or Specific Requirement: Per 2 CFR Part 200, non-federal entities receiving federal awards must establish and maintain written policies and procedures addressing areas including, but not limited to: procurement (§200.317–§200.327); travel costs (§200.475); methods for avoiding duplication of costs (§200.403); subrecipient monitoring (§200.332); cash management and allowable costs (§200.302, §200.305). Condition: The organization has not implemented all policies and procedures required under the Uniform Guidance. Specifically, certain written policies and procedures required by 2 CFR Part 200, such as cash management, allowability of costs, equipment management, conflict of interest, procurement, travel, compensation, and fringe benefits, were either incomplete, not formally documented, or not in place during the audit period. Cause: The Council has not detailed its policies to conform with the requirements of the Uniform Guidance. Effect or Potential Effect: Without documented and implemented policies and procedures, the organization increases the risk of noncompliance with federal regulations, inconsistent application of requirements, unallowable costs being charged to federal awards, and potential questioned costs or sanctions from funding agencies. Repeat Finding: No Recommendation: Management should develop, formally adopt, and implement all required Uniform Guidance policies and procedures. Policies should be documented, communicated to relevant staff, and periodically reviewed to ensure ongoing compliance. Views of Responsible Officials: Management agrees with the finding and revise its policies and procedures to meet the criteria of the Uniform Guidance.

Assistance Listing Number: 93.193 Name of Federal Program: COVID-19 Urban Indian Health Services Name of Federal Agency: Department of Health and Human Services Award Period: January 1, 2024 – December 31, 2024 Criteria or Specific Requirement: Per 2 CFR Part 200, non-federal entities receiving federal awards must establish and maintain written policies and procedures addressing areas including, but not limited to: procurement (§200.317–§200.327); travel costs (§200.475); methods for avoiding duplication of costs (§200.403); subrecipient monitoring (§200.332); cash management and allowable costs (§200.302, §200.305). Condition: The organization has not implemented all policies and procedures required under the Uniform Guidance. Specifically, certain written policies and procedures required by 2 CFR Part 200, such as cash management, allowability of costs, equipment management, conflict of interest, procurement, travel, compensation, and fringe benefits, were either incomplete, not formally documented, or not in place during the audit period. Cause: The Council has not detailed its policies to conform with the requirements of the Uniform Guidance. Effect or Potential Effect: Without documented and implemented policies and procedures, the organization increases the risk of noncompliance with federal regulations, inconsistent application of requirements, unallowable costs being charged to federal awards, and potential questioned costs or sanctions from funding agencies. Repeat Finding: No Recommendation: Management should develop, formally adopt, and implement all required Uniform Guidance policies and procedures. Policies should be documented, communicated to relevant staff, and periodically reviewed to ensure ongoing compliance. Views of Responsible Officials: Management agrees with the finding and revise its policies and procedures to meet the criteria of the Uniform Guidance.

Finding 2024-001: Subrecipient Monitoring Federal Agency: U.S. Department of Housing and Urban Development Program Name: COVID 19 – HOME Investment Partnerships Program and HOME Investment Partnerships Program (HOME) - ALN 14.239; Award Identification Number: MC420501 Criteria of Specific Requirement: Per 2 CFR 200.332, a pass-through entity must monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Condition: During our testing of subrecipient monitoring, we noted that the City did not perform required monitoring procedures during the year. Questioned Costs: Unknown Cause: The City did not have adequate internal controls in place to ensure compliance with subrecipient monitoring requirements, and staffing turnover contributed to the lack of oversight. Effect: The City was not in compliance with subrecipient monitoring requirements. Identification as a Repeat Finding: This is not a repeat finding from the prior audit. Recommendation: We recommend the City implement controls to ensure compliance with subrecipient monitoring, documenting monitoring activities performed and following up on any identified deficiencies in a timely manner. Views of Responsible Officials and Planned Corrective Actions: Management agrees; see separate corrective action plan.

Finding 2024-001: Subrecipient Monitoring Federal Agency: U.S. Department of Housing and Urban Development Program Name: COVID 19 – HOME Investment Partnerships Program and HOME Investment Partnerships Program (HOME) - ALN 14.239; Award Identification Number: MC420501 Criteria of Specific Requirement: Per 2 CFR 200.332, a pass-through entity must monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Condition: During our testing of subrecipient monitoring, we noted that the City did not perform required monitoring procedures during the year. Questioned Costs: Unknown Cause: The City did not have adequate internal controls in place to ensure compliance with subrecipient monitoring requirements, and staffing turnover contributed to the lack of oversight. Effect: The City was not in compliance with subrecipient monitoring requirements. Identification as a Repeat Finding: This is not a repeat finding from the prior audit. Recommendation: We recommend the City implement controls to ensure compliance with subrecipient monitoring, documenting monitoring activities performed and following up on any identified deficiencies in a timely manner. Views of Responsible Officials and Planned Corrective Actions: Management agrees; see separate corrective action plan.

2024-001: Subrecipient Monitoring – Low Income Home Energy Assistance Program Federal Program: Low Income Home Energy Assistance/COVID-19 – Low Income Home Energy Assistance– American Rescue Plan Act Assistance Listing No.: 93.568 Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: None Federal Award Identification Number: 2401MELIEA/2501MELIEA/2401MELIEI/COVID-19 2101MEE5C6 Repeat Finding: This is not a repeat finding Criteria – CFR 200.332 states that pass-through entities must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Pass-through entities must also monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward and that subaward performance goals are achieved. MaineHousing performs annual quality assurance reviews over subrecipients for the Low Income Home Energy Assistance (LIHEAP) Program to ensure source documentation for determining benefits is accurate. In addition, MaineHousing performs annual fiscal monitoring reviews for subrecipients participating in the LIHEAP Program. Condition – During 2024, for two subrecipients, MaineHousing did not perform annual quality assurance reviews. For one high-risk subrecipient, MaineHousing did not formally document their fiscal monitoring review. Questioned costs – None. Cause – MaineHousing did not perform annual quality assurance reviews for two subrecipients due to staff turnover in the program. The annual fiscal monitoring review was not formally documented for one high-risk subrecipient as the subrecipient did not have an annual audit performed for the fiscal year. Effect or potential effect – There is a risk that LIHEAP benefits may not be properly calculated and beneficiaries may not have provided proper support in their request for benefits. Context – The sample of subrecipients was a statistically valid sample. Recommendation – MaineHousing should enhance controls to ensure that all subrecipients undergo required quality assurance reviews annually. If fiscal monitoring reviews are not applicable to certain subrecipients, management should document what steps were taken to supplant the monitoring reviews to ensure that the subrecipient was appropriately monitored and reviewed. Views of responsible officials – Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the Summary Schedule of Prior Audit Findings.

2024-001: Subrecipient Monitoring – Low Income Home Energy Assistance Program Federal Program: Low Income Home Energy Assistance/COVID-19 – Low Income Home Energy Assistance– American Rescue Plan Act Assistance Listing No.: 93.568 Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: None Federal Award Identification Number: 2401MELIEA/2501MELIEA/2401MELIEI/COVID-19 2101MEE5C6 Repeat Finding: This is not a repeat finding Criteria – CFR 200.332 states that pass-through entities must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Pass-through entities must also monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward and that subaward performance goals are achieved. MaineHousing performs annual quality assurance reviews over subrecipients for the Low Income Home Energy Assistance (LIHEAP) Program to ensure source documentation for determining benefits is accurate. In addition, MaineHousing performs annual fiscal monitoring reviews for subrecipients participating in the LIHEAP Program. Condition – During 2024, for two subrecipients, MaineHousing did not perform annual quality assurance reviews. For one high-risk subrecipient, MaineHousing did not formally document their fiscal monitoring review. Questioned costs – None. Cause – MaineHousing did not perform annual quality assurance reviews for two subrecipients due to staff turnover in the program. The annual fiscal monitoring review was not formally documented for one high-risk subrecipient as the subrecipient did not have an annual audit performed for the fiscal year. Effect or potential effect – There is a risk that LIHEAP benefits may not be properly calculated and beneficiaries may not have provided proper support in their request for benefits. Context – The sample of subrecipients was a statistically valid sample. Recommendation – MaineHousing should enhance controls to ensure that all subrecipients undergo required quality assurance reviews annually. If fiscal monitoring reviews are not applicable to certain subrecipients, management should document what steps were taken to supplant the monitoring reviews to ensure that the subrecipient was appropriately monitored and reviewed. Views of responsible officials – Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the Summary Schedule of Prior Audit Findings.

REFERENCE NUMBER 2024-002 Subrecipient Monitoring FEDERAL AGENCY Department of Transportation FEDERAL PROGRAM Formula Grants for Rural Areas and Tribal Transit Program ALN 20.509 IDENTIFICATION AS A REPEAT FINDING No QUESTIONED COSTS None EVALUATION OF FINDING Audit finding disclosed that are required to be reported in accordance with Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). CRITERIA The Uniform Guidance at 2 CFR section 200.332(c) requires ECCOG as the pass-through entity to assess the subrecipient's fraud risk and risk of noncompliance to determine the appropriate level of subrecipient monitoring. The Uniform Guidance at 2 CFR 332(e) requires the pass-through entity to review financial and performance reports and ensure the subrecipient takes appropriate corrective action. Finally, the Uniform Guidance at 2 CFR 332(f) requires the pass-through to perform additional monitoring based on its risk analysis. CONDITION ECCOG did not perform a formal risk assessment of its subrecipients. ECCOG did not document the required level of subrecipient monitoring. ECCOG did not review financial reports. One entity had a Single Audit for the year-ended December 31, 2023. ECCOG did input the subrecipient's statistics into the Colorado Department of Transportation's COTRAMS system. CONTEXT ECCOG had three subrecipients, two of which were material. This finding occurred for all three subrecipients. CAUSE ECCOG performed an informal analysis of the entities' risks. In addition, during the years-ended December 31, 2023 and 2024 reimbursement of subrecipient costs was being resolved with the Colorado Department of Transportation (CDOT). Certain 2023 costs were not reimbursed until 2024. CDOT did not agree to pay the subrecipient costs for the period March, 2024 to December 2024 until January 2025. In 2025, these entities are no longer subrecipients of ECCOG. The two significant subrecipients are now subrecipients of CDOT. EFFECT OR POTENTIAL EFFECT Failure to adequately perform and document the risk assessments on its subrecipients could result in the inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. RECOMMENDATION As noted above, ECCOG no longer has any subrecipients. ECCOG should document the necessary processes for subrecipient monitoring in its grant management policies. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTION See ECCOG’s corrective action plan on page 16.

2024-002 Finding – Federal Award Type: Subrecipient Monitoring – Non-Compliance and Significant Deficiency in Internal Control Over Compliance. (Partial repeat of finding 2023-001) Identification of Federal Program: AL Number: 81.086 Conservation Research and Development Program Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. In accordance with 2 CFR section 200.332, a pass-through entity must clearly identify to the subrecipient the award as a subaward by providing the required federal information related to the award, all requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the provisions of contracts and grants agreements. The pass-through entity must evaluate risk of non-compliance of each subrecipient, monitoring the subrecipient and ensuring accountability of for-profit subrecipients. Condition / Context: Forth Mobility Fund passed through $1,578,580 in funding to subrecipients under Assistance Listing 81.086. During our audit, we noted that Forth Mobility Fund had made improvements to subrecipient monitoring in 2024 by establishing a subrecipient monitoring policy and evaluating for risk of non-compliance for subrecipients prior to engaging in a subcontract on a prospective basis. It was noted that within subaward contracts, required federal contract information was provided and if the subrecipient is subject to 2 CFR Subpart F, the audit for this entity was obtained and reviewed for applicable audit findings. However, while monitoring has improved, as Forth Mobility Fund is having regular meetings to ensure tasks are being completed timely and providing technical assistance when needed, there is no formal documentation of this. Further, while a risk assessment is being made for new subrecipients, past subrecipients have not been evaluated and there is no methodical execution of the results of the risk assessment. Cause: Procedures were not in place to ensure that Forth Mobility Fund is maintaining proper subrecipient monitoring for each federal subrecipient. Effect: Failure to maintain sufficient subrecipient monitoring may result in the wrongful use of federal funds and non‐compliance with the provisions of applicable requirements of the federal award. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding the contracting and monitoring of subrecipients that are in line with Uniform Guidance requirements, as well as establish organizational controls to ensure that such policies and procedures are prescriptive and being followed. Management’s Response: We agree with the auditor's comments, and effective October 31, 2024, we established procedures for monitoring subrecipients, including obtaining and reviewing their annual audits. We will strengthen these procedures by establishing a monitoring plan based on risk assessment for each subrecipient and formally documenting all monitoring activities by November 30, 2025

FINDING 2024-002 Significant Deficiency in Internal Controls Over Compliance, Noncompliance – Subrecipient Monitoring Federal Agency: U.S. Department of Agriculture Pass through Grantor: Not Applicable – Direct Award Federal Program: Soil and Water Conservation Assistance Listing Number: 10.902 Federal Award Identification Number: NR243A750023C002, NR243A750023C003 Criteria: Per 2 CFR Part 200, Subpart D, 200.332(c), the pass-through entity ("PTE") must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Further, in accordance with 2 CFR, Subpart D, Section 200.332(e), the PTE must monitor the activities of the subrecipient including ensuring that the subrecipient takes corrective action on findings. Lastly, per 2 CFR, Subpart D, Section 200.332(g), the PTE must verify that the subrecipient is audited as required by Subpart D. Condition/Context: Through Subrecipient Monitoring testing, we identified 2 subrecipients, both of which were selected for testing. The subrecipients expended $96,462 of federal award funding passed through to them from Ichauway for the year ended December 31, 2024. For both subrecipients, we determined that management did not monitor the subrecipients to ensure the subrecipient took corrective action on any findings nor did management verify that the subrecipient was audited as required by Subpart D. Cause: Management has not updated their subrecipient monitoring procedures to ensure it aligns with federal requirements. Effect: Without formal procedures or documented communications to verify that subrecipients are aware of, have completed, and have addressed any deficiencies identified in required audits, there is a risk that audit findings or compliance issues at the subrecipient level may go undetected or unaddressed. This could result in noncompliance with federal subrecipient monitoring requirements, potentially exposing Ichauway to reputational risk, questioned costs, or other adverse consequences in the event of a review or audit. Questioned Costs: None. Recommendation: Management should develop and implement formal procedures for subrecipient monitoring. This should include documented communications to verify that subrecipients are aware of audit requirements, have completed required audits, and have addressed any identified deficiencies in a timely manner. Views of Responsible Officials: See Corrective Action Plan.

FINDING 2024-002 Significant Deficiency in Internal Controls Over Compliance, Noncompliance – Subrecipient Monitoring Federal Agency: U.S. Department of Agriculture Pass through Grantor: Not Applicable – Direct Award Federal Program: Soil and Water Conservation Assistance Listing Number: 10.902 Federal Award Identification Number: NR243A750023C002, NR243A750023C003 Criteria: Per 2 CFR Part 200, Subpart D, 200.332(c), the pass-through entity ("PTE") must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Further, in accordance with 2 CFR, Subpart D, Section 200.332(e), the PTE must monitor the activities of the subrecipient including ensuring that the subrecipient takes corrective action on findings. Lastly, per 2 CFR, Subpart D, Section 200.332(g), the PTE must verify that the subrecipient is audited as required by Subpart D. Condition/Context: Through Subrecipient Monitoring testing, we identified 2 subrecipients, both of which were selected for testing. The subrecipients expended $96,462 of federal award funding passed through to them from Ichauway for the year ended December 31, 2024. For both subrecipients, we determined that management did not monitor the subrecipients to ensure the subrecipient took corrective action on any findings nor did management verify that the subrecipient was audited as required by Subpart D. Cause: Management has not updated their subrecipient monitoring procedures to ensure it aligns with federal requirements. Effect: Without formal procedures or documented communications to verify that subrecipients are aware of, have completed, and have addressed any deficiencies identified in required audits, there is a risk that audit findings or compliance issues at the subrecipient level may go undetected or unaddressed. This could result in noncompliance with federal subrecipient monitoring requirements, potentially exposing Ichauway to reputational risk, questioned costs, or other adverse consequences in the event of a review or audit. Questioned Costs: None. Recommendation: Management should develop and implement formal procedures for subrecipient monitoring. This should include documented communications to verify that subrecipients are aware of audit requirements, have completed required audits, and have addressed any identified deficiencies in a timely manner. Views of Responsible Officials: See Corrective Action Plan.

Community Health Workers for Public Health Response & Resilient AL #93.495 Subrecipient Monitoring Condition: The Allegheny County Health Department did not communicate to three subrecipients randomly selected for testing all of the information required to be communicated about the subawards. It appears that the Health Department does not have a process in place to communicate such information. The Health Department did not determine whether the three subrecipients we randomly selected for testing were required to obtain single audits and did not request or review such audits. We were also informed that the Health Department did not determine whether any of the subrecipients involved in the administration of the program required single audits and did not request or review such audits from any of the subrecipients. Criteria: The Uniform Guidance indicates that all pass-through entities must verify that every subrecipient is audited as required when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the applicable threshold (2 CFR 200.332(f)) and consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records (2 CFR 200.332(g)). Cause: This subrecipient monitoring was also a prior 2023 finding. The Health Department developed the corrective action plan for the prior finding on September 20, 2024, however, this grant ended on August 30, 2024 and the Health Department did not have the time to implement any of the corrective action plans for this program. In addition, the Health Department does not have proper internal controls in place to ensure they are complying with all audit requirements. Effect: The County was not in compliance with the terms of the federal grant program. Questioned Costs: None Recommendation: The Health Department should maintain lists of the subrecipients utilized for each federal program and use checklists to help ensure that the required subrecipient monitoring activities are performed for each subrecipient to ensure compliance with federal requirements. Management Response: Management agrees with the finding, see attached Corrective Action Plan.

Targeted Airshed Grant Program- AL# 66.956 Subrecipient Monitoring Condition: The Allegheny County Health Department did not communicate to Pittsburgh Regional Transit (PRT) all of the information required to be communicated about the subaward. It appears that the Health Department does not have a process in place to communicate such information. The Health Department also did not determine whether PRT was required to obtain a single audit and did not request or review such an audit. Consequently, the Health Department has no knowledge of any subrecipient single audit findings that may impact the federal award. Criteria: The Uniform Guidance indicates that all pass-through entities must verify that every subrecipient is audited as required when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the applicable threshold (2 CFR 200.332(f)) and consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records (2 CFR 200.332(g)). Cause: The Health Department was not attentive to the audit requirements. Effect: The County was not in compliance with the terms of the federal grant program. Questioned Costs: None Recommendation: The Health Department should maintain lists of the subrecipients utilized for each federal program and use checklists to help ensure that the required subrecipient monitoring activities are performed for each subrecipient to ensure compliance with federal program requirements. Management Response: Management agrees with the finding, see attached Corrective Action Plan.

Noncompliance with Subrecipient Monitoring Requirements and Material Weakness in Internal Control over Subrecipient Monitoring Assistance Listing Number: 21.027 Name of Federal Program or Cluster: COVID-19: Coronavirus State and Local Fiscal Recovery Funds Name of Federal Agency: Department of Treasury Name of Pass-Through Entities: State of Wisconsin Department of Administration Subrecipient Monitoring 2 CFR§200.332 requirements for pass-through entities: The Code of Federal Regulations (CFR) Section 200.332(e) requires a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. 2 CFR§200.303 requires the Organization to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The organization did not perform subrecipient monitoring procedures as listed in the criteria above for the subrecipient of the COVID-19: Coronavirus State and Local Fiscal Recovery Funds. In addition, the Organization’s internal controls over subrecipient monitoring did not prevent or detect noncompliance with subrecipient monitoring requirements. The Organization did, however, confirm with SAM.gov that the subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal Funds; included the required information in the subaward agreement, and performed the required risk assessment. The Organization has policies and procedures related to subrecipient monitoring in its fiscal procedures manual. However, management did not monitor to ensure that the requirements listed in its policies and procedures manual as well as the Uniform Guidance are being followed. Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Recommendation: We recommend that Organization management monitor their compliance with their subrecipient monitoring procedures to ensure that the required subrecipient monitoring is occurring. No WRTP has reviewed the organization’s fiscal policy manual including all subsections regarding monitoring responsibilities. Additional training has been provided and completed by management and staff. Management has reviewed all monitoring with the subrecipient in good faith efforts.

Noncompliance with Subrecipient Monitoring Requirements and Material Weakness in Internal Control over Subrecipient Monitoring Assistance Listing Number: 21.027 Name of Federal Program or Cluster: COVID-19: Coronavirus State and Local Fiscal Recovery Funds Name of Federal Agency: Department of Treasury Name of Pass-Through Entities: State of Wisconsin Department of Administration Subrecipient Monitoring 2 CFR§200.332 requirements for pass-through entities: The Code of Federal Regulations (CFR) Section 200.332(e) requires a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. 2 CFR§200.303 requires the Organization to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The organization did not perform subrecipient monitoring procedures as listed in the criteria above for the subrecipient of the COVID-19: Coronavirus State and Local Fiscal Recovery Funds. In addition, the Organization’s internal controls over subrecipient monitoring did not prevent or detect noncompliance with subrecipient monitoring requirements. The Organization did, however, confirm with SAM.gov that the subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal Funds; included the required information in the subaward agreement, and performed the required risk assessment. The Organization has policies and procedures related to subrecipient monitoring in its fiscal procedures manual. However, management did not monitor to ensure that the requirements listed in its policies and procedures manual as well as the Uniform Guidance are being followed. Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Recommendation: We recommend that Organization management monitor their compliance with their subrecipient monitoring procedures to ensure that the required subrecipient monitoring is occurring. No WRTP has reviewed the organization’s fiscal policy manual including all subsections regarding monitoring responsibilities. Additional training has been provided and completed by management and staff. Management has reviewed all monitoring with the subrecipient in good faith efforts.

Noncompliance with Subrecipient Monitoring Requirements and Material Weakness in Internal Control over Subrecipient Monitoring Assistance Listing Number: 21.027 Name of Federal Program or Cluster: COVID-19: Coronavirus State and Local Fiscal Recovery Funds Name of Federal Agency: Department of Treasury Name of Pass-Through Entities: State of Wisconsin Department of Administration Subrecipient Monitoring 2 CFR§200.332 requirements for pass-through entities: The Code of Federal Regulations (CFR) Section 200.332(e) requires a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. 2 CFR§200.303 requires the Organization to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The organization did not perform subrecipient monitoring procedures as listed in the criteria above for the subrecipient of the COVID-19: Coronavirus State and Local Fiscal Recovery Funds. In addition, the Organization’s internal controls over subrecipient monitoring did not prevent or detect noncompliance with subrecipient monitoring requirements. The Organization did, however, confirm with SAM.gov that the subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal Funds; included the required information in the subaward agreement, and performed the required risk assessment. The Organization has policies and procedures related to subrecipient monitoring in its fiscal procedures manual. However, management did not monitor to ensure that the requirements listed in its policies and procedures manual as well as the Uniform Guidance are being followed. Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Recommendation: We recommend that Organization management monitor their compliance with their subrecipient monitoring procedures to ensure that the required subrecipient monitoring is occurring. No WRTP has reviewed the organization’s fiscal policy manual including all subsections regarding monitoring responsibilities. Additional training has been provided and completed by management and staff. Management has reviewed all monitoring with the subrecipient in good faith efforts.

2024-001: Subrecipient Monitoring Criteria: The Code of Federal Regulations 2 CFR 200.332 states that all pass-through entities (PTE) must: Identify the Award and Applicable Requirements - Clearly identify to the subrecipient: (1) the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.331(a)(1); (2)all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.331(a)(3)). Evaluate Risk - Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). Monitor - Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: (1) Reviewing financial and programmatic (performance and special reports) required by the PTE. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Condition: The Organization did not clearly communicate the required federal award information and applicable requirements to the subrecipients. The Organization did not evaluate the risk of non-compliance of the subrecipients in order to identify the appropriate monitoring procedures. Cause: The Organization has not implemented policies or procedures, to the degree necessary, to ensure that federal award monitoring compliance requirements are being met. Effect: The Organization did not perform adequate monitoring procedures on the subrecipients. Without communication of required information, subrecipients may overspend award amounts or incur unallowable expenses towards the grant. Questioned Costs: N/A Statistical Sampling: Statistical sampling was not used in making sample selections. Recommendation: We recommend that management of the Organization implement policies, procedures, and internal controls to evaluate the subrecipient risk of noncompliance to ensure subrecipients are being appropriately monitored in compliance with federal regulations. Views of Responsible Officials: Management agrees with this finding and their response is included in the corrective action plan.

2024-005 Corporation for National and Community Service Federal Financial Assistance Listing #94.012, 22BIICA001 10/1/2022 – 9/30/2025, 23BIACA001 10/1/2023 – 9/30/2026, 23BIFNY001 10/1/2023 – 9/30/2026 Americorps September 11th National Day of Service and Remembrance Grants Subrecipient Monitoring Material Weakness in Internal Controls over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. 2 CFR 200.332 identifies the requirements for all pass-through entities surrounding subrecipient monitoring and management. Condition: We noted the following during testing; a) Subawards did not contain minimum required elements in accordance with 2 CFR 200.332(b) b) The organization did not consider all suggested elements when evaluating subgrantee’s fraud risk and risk of noncompliance with subaward in accordance with 2 CFR 200.332(c) c) Documentation could not be provided to substantiate whether suspension and debarment was considered prior to awarding subgrant d) The organization required the subgrantee to complete performance reports, however, did not require completion of a financial report in accordance with 2 CFR 200.332(e)(1) e) The organization did not considered whether subgrantee was required to be audited and therefore did not review whether subgrantee had deficiencies reported over the federal program in accordance with 2 CFR 200.332(e)(2) through 2 CFR 200.332(e)(4) Cause: Management was not familiar with all subrecipient monitoring requirements as published under 2 CFR 200.332. The organization has not adopted a subrecipient monitoring policy. Effect: Without full understanding of subrecipient monitoring requirements under 2 CFR 200.332, demonstrating that the program complies with laws, regulations, and other compliance requirements is difficult. Questioned Costs: None reported. Context/Sampling: Four out of seventeen subrecipients were reviewed for testing. Repeat Finding from Prior Year: No. Recommendation: We recommend management to review subrecipient monitoring requirements as published under 2 CFR 200.332 and adopt a subrecipient monitoring policy. Views of Responsible Officials: Management is in agreement.

Criteria or Specific Requirement: Per 2 CFR 200.332(b), Pass-through entities are responsible for identifying all the information in the subaward agreement to the subrecipients to provide reasonable assurance that subrecipient used the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Condition: The sole subaward issued under the federal program lacked key information identifying the recipient as a subrecipient of federal funding. Questioned Costs: None Context: There was only one subrecipient and subaward agreement lacking the key information outlined in 2 CFR 200.332(b). This subrecipient was started by former SFP employees and contractors and was only later split off as a separate legal entity. The intermingled nature of the original relationship of the subrecipient’s projects lead to the lack of formalized information in the subaward. Cause: Lack of adequate knowledge about the information required to be included in subaward agreements, per Uniform Guidance requirements. Effect: A lack of clear identification of federal funding in a subaward could lead to a subrecipient misunderstanding the nature of the funding sources it receives and the corresponding single audit requirements. Repeat Finding: No Recommendation: CLA recommends amending existing subaward agreements to include the award information required by CFR 200.332(b) and to verify all future subawards agreements include all necessary information prior to issuance. Views of Responsible Officials: There is no disagreement with the audit finding.

Subrecipient monitoring was direct and material to the Coronavirus State and Local Fiscal Recovery Funds program. The County passed funding to sixteen subrecipients and five subrecipients were selected for testing. Based upon the subrecipients selected for testing, subrecipient agreements were executed but did not include all required information under CFR § 200.332. In addition, the County does not have a formal process to monitor expenditures incurred by subrecipients. Reimbursement requests are submitted by subrecipients but supporting documentation was not consistently provided by subrecipient to enable the County to effectively monitor subrecipient expenditures.

Finding 2024-002 – Subrecipient Monitoring (Material Weakness) Program Information: 11.307 Economic Adjustment Assistance Criteria: Per 2 CFR § 200.332, pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information at the time of issuance and upon modification. Required elements include federal award identification; all requirements of the subaward including the federal statutes, regulations and terms and conditions; indirect cost rate; access to records; and closeout terms and conditions. Condition: The Organization awarded 13 awards to subrecipients and did not include the information required by 2 CFR § 200.332 in the subaward agreement. Cause/Effect: The pass-through entity did not have a standardized process or checklist to ensure all required subaward elements were included in the agreements. Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance and misuse of federal funds. Questioned costs: None Repeat findings: No similar findings noted in the prior year. Recommendation: We recommend that the pass-through entity implement a standardized subaward template and checklist aligned with 2 CFR § 200.332. Staff should be trained on Uniform Guidance requirements to ensure all subawards include the necessary elements. Views of responsible officials: Management agrees with the finding and the auditors’ recommendation. See Corrective Action Plan at the end of the report.

FINDING 2024-002 Subrecipient (Noncompliance, Significant Deficiency) Federal Program Information: Education Stabilization Fund (ALN 84.425U) Criteria: Per 2 CFR § 200.332, pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information at the time of issuance and upon modification. Required elements include federal award identification; all requirements of the subaward including the federal statutes, regulations and terms and conditions; indirect cost rate; access to records; and closeout terms and conditions. Condition: The Organization awarded 39 awards to subrecipients and did not include the information required by 2 CFR § 200.332 in the subaward agreement. Cause: The Organization did not have a standardized process or checklist to ensure all required subaward elements were included in the agreement. Effect or Potential Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance and misuse of federal funds. The Organization was not in compliance with the subrecipient requirements outlined in the agreement and in 2CFR200.332. Prior Year Finding: Reported as 2023-002 in the prior year. Recommendation: We recommend that the Organization update subaward agreements to include all federal provisions required to be communicated by the grant and also 2 CFR § 200.332. Views of Responsible Officials: Management agrees with the finding and the auditors’ recommendation. See Corrective Action Plan at the end of the report.

Federal Program(s): Enhanced Mobility of Seniors and Individuals with Disabilities (ALN 20.513) Agencies: U.S. Department of Transportation – Federal Transit Administration Criteria - 2 CFR §200.510: Auditee must prepare an accurate SEFA including ALN, program name, award number, award year, pass-through number, and total expenditures. 2 CFR §200.332: Pass-through entities must identify the ALN in all subaward documents. 2 CFR §200.303: Auditees must establish and maintain effective internal controls over federal awards. Condition - During our audit of ENVIDA’s federal programs, we identified an internal control deficiency affecting the accuracy of the Schedule of Expenditures of Federal Awards (SEFA). Context - The issue stems from the Envida's need to formalize documented procedures and adequate review over the SEFA preparation process, as well as the need to implement controls for verifying federal award information received from pass-through entities. Specifically, ENVIDA’s SEFA included initial misstatements, including erroneous reporting of $61,576 in required matched funds as federal expenditures (which they were not), the inclusion of $79,225 in OnDemand expenditures that were not federally funded (incorrect information from passthrough entity), and a $45,403 posting error that misclassified expenditures between grant years. These errors resulted in a material overstatement of the SEFA federal expenditures as originally prepared. Management corrected these errors during the audit process. Cause - Due to lack of funding information provided in the contracts with a major passthrough entity, Envida is unable to verify accuracy of federal funding information contemporaneously. For 2024, incomplete or inaccurate information from pass-through entities, coupled with the absence of formalized internal controls to verify and document federal award details, led to initial errors in SEFA reporting. Contracts with the pass-through entity, Pikes Peak Area Council of Governments (PPACG), did not include the required Assistance Listing Numbers (ALNs), which contributed to the confusion and misreporting. These deficiencies are inconsistent with the requirements of 2 CFR §200.510(b), §200.303, and §200.332(a)(1), which collectively mandate accurate SEFA reporting, proper identification of federal awards, and internal controls over federal funding. Effect - SEFA initially overstated by 15.5% due to match and OnDemand errors. FY24 award overstated by 17.5%; FY25 award understated by 14.6% Potential audit coverage gaps and risk misassessment under 2 CFR §200.518. Recommendation - We recommend that ENVIDA establish and document clear procedures for the preparation of the Schedule of Expenditures of Federal Awards (SEFA) as well as for the proper classification of accounts receivable. In addition, ENVIDA should implement a supervisory review process to help ensure accuracy and compliance with federal requirements. To further strengthen controls, all subaward agreements should require written confirmation of the Assistance Listing Numbers (ALNs). Finally, ENVIDA should verify federal award information directly against official federal award notices prior to preparing the SEFA. Views of Responsible Official and Planned Corrective Action - Management has agreed with the finding and plans to revise the SEFA to reflect accurate federal expenditures. They will work with pass-through entities to ensure future subaward documentation includes all required federal award identifiers and will implement internal controls to prevent recurrence.

FINDING 2024-003 – CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS Federal Program: COVID-19 Coronavirus State and Local Fiscal Recovery Funds (ALN Number: 21.027) Federal Agency: Department of Treasury Federal Award Number (or Other Identifying Number): N/A Pass-Through Entity: State Budget Agency Subject – Subrecipient Monitoring – Internal Controls Audit Finding: Significant Deficiency Criteria: Federal regulations 2 CFR section 200.332 (b), (d), (f) and (g) requires the County to: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. Condition: An effective internal control system was not in place at the County to ensure compliance with requirements related to the grant agreement and the subrecipient monitoring compliance requirement. Questioned Cost: None. Context: During our subrecipient monitoring testing, we saw no formal, documented review of the two subrecipient's audit reports selected for testing. Management asserted they reviewed the reports, but there was no formal documented review of the reports noted. The audit reports sampled for testing contained no findings in the reports that would normally require the County to follow up on. We also noted the County does not have a process to assess the risk of each subrecipient. Effect: The failure to establish an effective internal control system placed the County at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the program. Cause: Management had not developed a system of internal control that would have ensured compliance with the grant agreement and the compliance requirements listed above for the full period under audit. Repeat Finding: Yes, this is repeat of finding 2023-004. Recommendation: We recommended that the County formally documents their review of the subrecipient audit reports and follow up actions taken on the audit reports as needed. Views of Responsible Officials: Management concurs with this finding. See the corrective action plan.

Criteria In accordance with 2 CFR § 200.332(a) of the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), pass-through entities are required to “clearly identify to the subrecipient” certain information and requirements at the time of subaward, including the Federal award identification, all compliance requirements, and any additional terms and conditions imposed by the pass-through entity. Condition During our audit of the airport improvement program grant awarded to the Town, we noted that the Town did not execute a formal subrecipient agreement with Fishers Island Ferry District, to whom federal funds were passed through during the audit period. Specifically, no written agreement was in place outlining the subrecipient’s responsibilities, applicable compliance requirements, or the terms and conditions of the award. Cause The Town did not have procedures in place to ensure that subrecipient agreements are issued for this program. Effect Without a formal subrecipient agreement, the entity increased the risk that the subrecipient may not fully understand or comply with federal award requirements. This could result in noncompliance with federal regulations, potential misuse of funds, and questioned costs. Additionally, the entity is not in full compliance with Uniform Guidance. Questioned Costs None Recommendation We recommend that the Town develop and implement procedures to ensure that formal written subrecipient agreements are executed prior to the disbursement of federal funds. These agreements should contain all elements required by 2 CFR § 200.332(a), including the identification of the federal award, applicable compliance requirements, and any additional terms and conditions. Views of Responsible Officials The Town agrees with this finding. The absence of subrecipient agreements for the airport improvement program was an oversight. Procedures have since been put in place to ensure that formal written subrecipient agreements are executed prior to the disbursement of federal funds.

Criteria: Per 2 CFR 200.332, pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward, and monitor subrecipient activities to provide reasonable assurance that the subaward is used for authorized purposes and in compliance with applicable requirements. Condition: The Organization did not consistently document and retain required monitoring procedures and assessments performed. Cause: The Organization had not developed policies and procedures to ensure compliance with subrecipient risk assessment and monitoring requirements. Effect: The Organization did not comply with 2 CFR 200.332. The lack of effective processes and documentation increases the risk of noncompliance by subrecipients, potential misuse of Federal funds, and questioned costs that could adversely affect current and future Federal funding. Questioned Costs: $0 Recommendation: We recommend the Organization strengthen its internal control framework over subrecipients by developing and implementing written policies and procedures for consistently performing and documenting risk assessments prior to making subawards, establishing clear monitoring protocols such as periodic report reviews, site visits, and follow-up on identified issues, and maintaining evidence of all monitoring activities performed. These steps will help ensure compliance with 2 CFR 200.332, reduce the risk of subrecipient noncompliance, and provide assurance that Federal funds are used for their intended purposes. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. The Organization hired a new Executive Director in the fall of 2024 and has discussed the matter with the Department of Agriculture and legal counsel to ensure compliance requirements are followed.

Finding number 2024-005, material weakness in internal controls over compliance – subrecipient monitoring Federal Agency: U.S. Department of Justice Federal Program: Justice Reinvestment Initiative, ALN 16.827 Criteria: 2 CFR 200.332(a)(1) requires pass-through entities to clearly identify the federal award to the subrecipient, including the FAIN and ALN, in the subaward documents. 2 CFR 200.332(b)-(d) requires pass-through entities to evaluate each subrecipient’s risk of noncompliance to determine appropriate monitoring and to verify that subrecipients expending $750,000 or more are audited as required by the Uniform Guidance. Condition: During our review of subrecipient agreements, we noted that the agreements did not include the Federal Award Identification Number (FAIN) and the Assistance Listing Number (ALN) as required. Additionally, the pass-through entity did not adequately document its risk assessment of subrecipients or verify whether subrecipients were subject to the Single Audit and, if so, whether the required audit was completed and reviewed. Cause: Inadequate procedures to ensure that all required information was included in subrecipient agreements. Inadequate procedures were not followed to perform and/or document subrecipient risk assessments and audit verifications. Effect: Failure to include all required information in subrecipient agreements increases the risk that subrecipients may not be aware of or comply with federal requirements, which could result in noncompliance with federal statutes, regulations and the terms and conditions of the award. This deficiency may also impair the pass-through entity’s ability to properly monitor subrecipient activities and fulfill its responsibilities under the Uniform Guidance. Such omissions may result in audit findings, questioned costs and potential enforcement actions by federal agencies. Questioned Costs: None Recommendation: We recommend that management implement procedures to ensure that all subrecipient agreements include the information required by 2 CFR 200.332. This should include a standardized checklist or template for subaward agreements and periodic reviews to verify compliance. We further recommend the entity implement and document procedures to (1) perform and retain evidence of subrecipient risk assessments and (2) verify and document whether subrecipients are subject to the Single Audit and, if so, obtain and review the audit reports for findings related to the federal program Views of Responsible Officials: Management concurs with this finding. See Corrective Action Plan.

Condition: During our review of subrecipient agreements, we noted that several agreements did not include the assistance listing title and number required by 2 CFR 200.332(b)(1). Criteria: Per 2 CFR 200.332(b)(1), pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and must include specified information in the subaward agreement. Required elements include, among others, the Federal award identification (e.g., Assistance Listing number, award name, Federal agency), period of performance and indirect cost rate. Cause: The Organization has not established a formal process to ensure that all required elements of 2 CFR §200.332 are included in subrecipient agreements. Effect: Failure to include required elements in subrecipient agreements increases the risk that subrecipients are not fully aware of their responsibilities under Federal awards, which could result in noncompliance with Federal requirements. In addition, the Organization is not in compliance with Uniform Guidance requirements for pass-through entities. Questioned Costs: None determined Recommendation: We recommend that the Organization update its subrecipient agreement templates and contract review procedures to ensure that all required elements under 2 CFR §200.332 are included in each agreement. A compliance checklist should be developed and used during the drafting and execution of agreements to verify completeness. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding; see corrective action plan.

Significant deficiency in internal controls over compliance related to subrecipient monitoring. Federal Agency: Department of Labor Program Titles: Workforce Innovation and Opportunity Act Dislocated Worker Program Assistance Listing Number: 17.278 Award Numbers: 24A60CP000141-01-01 Award Periods: April 1, 2024 through September 30, 2025 Criteria Internal controls requirements contained in Title 2 U.S. Code of Federal Regulations (CFR) 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Subpart D requires a pass-through entity to adopt compliance policies to ensure sub-recipients comply with requirements under the award, and evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of such agreements for the purposes of determining appropriate subrecipient monitoring. Condition/Context for Evaluation The Organization does not have a formal subrecipient monitoring policy to implement Subrecipient Monitoring procedures as required by 2 CFR Part 200.332. For the one subrecipient selected for testing, the Organization could not produce documentation of the required subrecipient risk assessment and the subrecipient agreement was missing certain required elements. Questioned Costs None noted Cause The Organization does not have a formal subrecipient monitoring policy that includes retention of a documented subrecipient risk assessment, as well as, use of a standard subaward agreement template including all required subaward agreement elements. Effect Subrecipient Monitoring procedures may not be properly determined without completion of a documented subrecipient risk assessment. In addition, the subaward agreement may not include all subaward terms as required by 200.332(b). Repeat Finding Not Applicable. Recommendation We recommend that management develop and formalize a subrecipient monitoring policy in accordance with 2 CFR Part 200, including use of a documented subrecipient risk assessment, as well as, creation of a Federal subaward agreement template which includes all require elements. Views of Responsible Officials Management agrees that even though subrecipient risk was discussed and considered, the subrecipient risk assessment was not documented in accordance with 2 CFR Part 200. In addition, management agrees that the underlying subaward agreement did not include all elements required by the same Part.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS Ref. No. Internal Control over Compliance Findings Questioned Costs: $ -- 2024-001 Missing Signatures - Significant Deficiency Federal Agency: U.S. Department of Housing and Urban Development (HUD) Assistance Listing No.: 14.157; 14.239 Program: Supportive Housing for the Elderly; HOME Investment Parternships Program Criteria: The Uniform Guidance (2 CFR §200.332 - Internal controls) requires the Company to establish, document, and maintain effective internal controls that provide reasonable assurance of compliance with the Department of Housing and Urban Development (HUD) requirements. In order to verify the eligibility of applicants, the property management company’s policy is to complete the “Tenant Income Certification” (TIC) and “Owner’s Certification of Compliance with HUD’s Tenant Eligibility and Rent Procedures” (HUD-50059) form, with signatures from both the property manager and applicant. Condition: During our testing over eligibility, we discovered: • Eight (8) out of 15 samples did not have a property manager signature on the TIC form. • Four (4) out of 15 samples did not have a property manager signature on the HUD-50059 form. Cause: Certain tenant documentation was lost by the prior management company. The new property manager reperformed intake procedures and recreated the TIC and HUD-50059 forms but did not sign the TICs, citing lack of involvement in the original intake process. Effect: Incomplete documentation weakens the audit trail, diminishing confidence in eligibility determinations and potentially exposing the Project to risks such as noncompliance with program requirements and potential errors and disallowance in rent subsidies paid by HUD. Identification as a Repeat Finding, if applicable: Not applicable. Recommendation The Company should consider reevaluating their established procedures and controls currently in place to ensure full compliance with regard to eligibility and proper maintenance of tenant information, including policies for handling missing files during management transitions to ensure compliance with HUD requirements. Views of Responsible Officials and Planned Corrective Action The Company agrees with the finding and the recommendation. See Part V Corrective Action Plan.

2024-004—Subrecipients Awards and Monitoring Type of Finding (F) Significant Deficiency in Internal Control Over Compliance of Federal Awards (G) Instance of Noncompliance related to Federal Awards Funding Agency U.S. Department of Agriculture (“USDA”) Program Partnerships for Climate-Smart Commodities; Award: USDA/NR243A750004G005 (AL 10.937); Period: 11/02/2023 -11/01/2028 Questioned Costs None identified Statement of Condition The Subaward agreement needs to be clear of the type of agreement with grant number, Assistance Listing number and clear programing and financial expectations. Pass-through entities are to provide reasonable assurance that the costs of goods and services charged to federal awards are allowable and charged in accordance with the applicable regulations. During our test work over controls over sub-recipient monitoring, we noted Quivira did not have a financial monitoring tool to require the sub-recipients to provide the primary recipient with a copy of their audit report and the sub-recipient's response to any audit findings, when applicable. Note: Quivira did ask for backup documentation for all expenses Invoices and a programmatic report and documented meeting discussions about sub-recipients. The primary recipient should also follow-up on the audit findings to determine whether the sub-recipient has satisfactorily resolved audit findings. This follow-up should be performed on a timely basis. Criteria 2 CFR §200.332 requires Pass-through-Entities to: issue subawards with complete federal award identification; assess subrecipient risk; monitor programmatic and financial performance; and verify audit requirements and review reports/findings; as well as issue follow up corrective actions as applicable. Some of the specific requirements are as follows: Federal award identification including the AL #, subawards amount, type of agreement (subawards versus contract, etc.) Evaluate each subrecipient fraud risk and risk of non-compliance with the federal awards Monitor the financial and performance reports Verify if the sub-recipient is audited, if required and if they have any findings related to the subaward Effect Without complete and accurate monitoring of sub-recipient expenditures of federal funds, Quivira cannot ensure the costs of goods and services charged to federal awards are allowable and charged in accordance with the applicable regulations. When the entity does not receive and review these audit reports, it may not have complete information about weaknesses identified by the independent auditors. Cause Quivira considered the Independent Contractor agreement and the requests for reimbursement of backup documentation sufficient. Recommendation Quivira should ensure it properly monitors sub-recipients according to the requirements required by the CFR 200 identified under “Criteria”. Views of Responsible Officials and Planned Corrective Action Management agrees with the recommendation. Quivira Coalition will: Action Step Detail Date Responsible Party Update its subrecipient and contractor agreement templates to include information outlined in 2 CFR § 200.332, including more specific federal award identification. 10/31/25 Operations Director Add a clause to the subrecipient and contractor agreement templates to include a requirement to report any significant developments to Quivira Coalition. 10/31/25 Operations Director Build a procedure for evaluating a subrecipient’s fraud risk and risk of non-compliance with the federal awards (as outlined in 2 CFR § 200.332 (c)) during the grant application phase or before engaging in agreements & work with subrecipient. It will continue to follow-up annually with the recipients on fraud risk and risk of non-compliance until the end of the federal award period. 10/31/25 Operations Director; CRI Director & Grants Manager Monitor sub-recipients as required by 2 CFR 200.332(e) 1/31/2026 Operations Director If a subrecipient has significant development during the course of monitoring, institute a tailored monitoring plan as outlined in 2 CFR § 200.332 (e) & (f) and resolve any findings listed as its responsibility under 2 CFR § 200.332 (e). 10/31/25 Operations Director; CRI Director & Grants Manager

Assistance Listing Numbers: 10.001, 10.200, 10.215, 10.307, 10.310, 10.311, 10.443 and 10.912 Name of Federal Program or Cluster: Research and Development Cluster Name of Federal Agency: Department of Agriculture Federal Award Identification Numbers: 58-5090-2-037 2022-38624-38368 2021-38640-34714 A0242501X443G026 2022-38640-37486 2023-51300-40959 2021-68012-35917 2019-68012-29852 2020-68012-31934 2021-49400-35592 NR225F48XXXXG006 Direct Award Periods: August 1, 2022 through July 31, 2027, September 1, 2023 through February 28, 2025, September 29, 2022 through September 30, 2027, September 27 2024 through September 26, 2027 and September 27, 2022 through June 30, 2026 Name of Pass-through Entities and Award Periods: Michigan State University-September 1, 2022 through August 31, 2025; Regents of the University of Minnesota-March 1, 2022 through February 28, 2025, April 1, 2023 through March 31, 2025, and September 1, 2020 through August 31, 2025; Board of Regents of the University of Wisconsin System-January 1, 2022 through December 31, 2026 and September 1, 2018 through August 31, 2024. Criteria or Specific Requirement: In accordance with 2 CFR § 200.331(a) (now 2 CFR § 200.332), a passthrough entity must make a case-by-case determination whether each agreement it makes for the disbursement of Federal funds casts the party receiving the funds in the role of a subrecipient or a contractor. This determination must be based on the substance of the relationship and not the form of the agreement. Condition: During the audit, we noted that the Organization has not established or implemented a formal process to determine whether entities receiving federal funds are subrecipients or contractors. There was no documentation or consistent methodology in place to support classification decisions for entities engaged under federal awards. Cause: The Organization has not developed or adopted policies and procedures to comply with the requirements under Uniform Guidance for distinguishing between subrecipients and contractors. Effect or Potential Effect: Without a formal and documented determination process, there is a risk that entities may be misclassified, leading to inappropriate application of monitoring procedures. For example, entities functioning as subrecipients may not be subject to required subrecipient monitoring, potentially resulting in noncompliance with federal regulations and increased risk of misuse of federal funds. Repeat Finding: No Recommendation: The Organization should develop and implement written policies and procedures to ensure proper determination and documentation of subrecipient versus contractor relationships in accordance with Uniform Guidance. Staff involved in federal program administration should be trained on how to apply these criteria consistently. Views of Responsible Officials: Management agrees with the finding and will implement and train on written policies and procedures to document the determination of subrecipient versus contractor.

Assistance Listing Numbers: 10.001, 10.200, 10.215, 10.307, 10.310, 10.311, 10.443 and 10.912 Name of Federal Program or Cluster: Research and Development Cluster Name of Federal Agency: Department of Agriculture Federal Award Identification Numbers: 58-5090-2-037 2022-38624-38368 2021-38640-34714 A0242501X443G026 2022-38640-37486 2023-51300-40959 2021-68012-35917 2019-68012-29852 2020-68012-31934 2021-49400-35592 NR225F48XXXXG006 Direct Award Periods: August 1, 2022 through July 31, 2027, September 1, 2023 through February 28, 2025, September 29, 2022 through September 30, 2027, September 27 2024 through September 26, 2027 and September 27, 2022 through June 30, 2026 Name of Pass-through Entities and Award Periods: Michigan State University-September 1, 2022 through August 31, 2025; Regents of the University of Minnesota-March 1, 2022 through February 28, 2025, April 1, 2023 through March 31, 2025, and September 1, 2020 through August 31, 2025; Board of Regents of the University of Wisconsin System-January 1, 2022 through December 31, 2026 and September 1, 2018 through August 31, 2024. Criteria or Specific Requirement: 2 CFR section 200.332 state pass-through entities are responsible for ensuring proper oversight of subrecipients to ensure compliance with federal requirements. Specifically:  § 200.332(a) requires subaward agreements to include specific information such as the Federal award identification, CFDA/Assistance Listing number, subaward period of performance, indirect cost rate, and applicable terms and conditions.  § 200.332(f) requires pass-through entities to verify that subrecipients that expend $750,000 or more in federal awards during their fiscal year have met audit requirements under 2 CFR part 200, subpart F.  § 200.332(d)(3) requires pass-through entities to review subrecipient audit reports, identify findings related to their federal awards, and ensure corrective actions are taken, including issuing management decisions if needed. Condition: During our audit of subrecipient monitoring controls, we noted the following deficiencies:  One out of four subrecipients sampled, the Organization did have documentation that verified a single audit was not required. In another instance of the four sampled, only the financial statement audit was obtained. It indicated there were separate reports for yellow book and single audit.  There were no documented procedures or evidence showing that the Organization assessed whether subrecipient audit findings were relevant to its own federal awards, nor that any follow-up or management decisions were issued.  Subaward agreements reviewed were missing several elements required by 2 CFR § 200.332(a), including the Assistance Listing number (formerly CFDA), that the award is for research and development, and closeout terms required by the Uniform Guidance. Cause: The Organization has not implemented adequate internal controls, policies, and procedures to ensure compliance with all subrecipient monitoring and subaward agreement requirements under Uniform Guidance. Effect or Potential Effect: These deficiencies increase the risk of noncompliance with federal program requirements, including the potential for unallowable costs, failure to identify material findings affecting the federal program, and weakened enforcement of subrecipient accountability. Additionally, noncompliant subaward agreements may result in ambiguity or disputes related to federal requirements, allowable costs, and required reporting. Repeat Finding: This is a repeat of Findings 2023-002 and 2023-006. Recommendation: We recommend that the Organization:  Establish and document a formal process to verify whether each subrecipient is subject to the Uniform Guidance single audit requirement and obtain the applicable reports annually.  Implement procedures to review subrecipient audit findings and determine whether they pertain to the Organization’s federal award(s), and issue management decisions when necessary.  Develop a standardized subaward agreement template that incorporates all required elements outlined in 2 CFR § 200.332(a), and ensure staff are trained in its use.  Periodically review subrecipient files to verify compliance with monitoring and documentation requirements. Views of Responsible Officials: Management agrees with the finding and will implement subrecipient monitoring procedures.

2024-004 - Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Control over Compliance (Subrecipient Monitoring) Programs. Environmental and Scientific Partnerships and Programs; U.S. Department of State; ALN Number 19.017; Award Number SAQMIP23CA0021 Criteria. Under 2 CFR Part 200.332(b), a pass-through entity must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information required per the Uniform Guidance. Condition. During subrecipient monitoring testing, the ALN number and award number were not included in the four subrecipient agreements subjected to testing. Additionally, the Organization does not have a policies/procedures in place to evaluate and address subrecipient's fraud risk and risk of noncompliance. Cause. The Organization does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. Although certain subrecipient monitoring activities were performed, the Organization did not comply with all the federal requirements for subrecipient monitoring for pass-through entities. Questioned Costs. None Recommendation. We recommend that the Organization adopts additional policies and procedures related to subrecipient monitoring to ensure compliance with Uniform Guidance. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.

Condition: During our review of the Head Start grant subrecipient monitoring procedures, the Organization was unable to provide documentation to support that monitoring activities were performed for one of the three subrecipients tested during the audit period. Criteria: In accordance with the Uniform Guidance (2 CFR §200.332(d)), pass-through entities are required to monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes and in compliance with applicable laws, regulations, and the terms and conditions of the subaward. Cause: The Organization did not provide documentation to demonstrate that subrecipient monitoring was performed. As a result, it is possible that the required monitoring activities were not conducted during the audit period, or, if they were performed, they were not adequately documented or retained in accordance with federal grant requirements. Effect: Failure to conduct subrecipient monitoring increases the risk that subrecipients may not be complying with federal program requirements, potentially leading to misuse of federal funds, lack of program quality assurance, or uncorrected deficiencies in service delivery. Recommendation: We recommend that the Organization ensure all required subrecipient monitoring activities are performed in accordance with federal guidelines. Additionally, all monitoring procedures—including risk assessments, site visits, performance reviews, and follow-up actions—should be clearly documented and retained to demonstrate compliance with grant requirements.

Criteria: Subrecipient Monitoring - Non-profit entities must follow the requirements for pass-through entities set out at 2 CFR part 200.332. Condition: Lack of documentation of subrecipient monitoring including whether the subrecipient is disqualified. Also, there was no indication of notification of the federal award identification number and amount of federal funds to the subrecipients. Cause: Due to no previous single audit requirement, the Organization has not established a policy of documenting subrecipient monitoring performed or the communication of the federal award identification number and amount of federal funds to subrecipients. Effect: The Organization does not have adequate documentation evidencing subrecipient monitoring procedures were performed or that all required information relating to federal awards was provided to subrecipients. Context: A sample of three disbursements totaling $113,418 were tested from a population of eight transactions totaling $353,835. Questioned costs: No known or likely questioned cost in excess of $25,000. Repeat Finding: No Recommendation: We recommend the Organization establish a formal methodology for documenting subrecipient monitoring and adhere to its policies for communicating federal award identification in accordance with 2 CFR 200.332. Views of responsible officials of the auditee: The Organization concurs with the finding and will implement the following: Develop additional policies and procedures that require documentation of subrecipient monitoring for each subrecipient Ensure all federal subrecipient contracts to include federal award identification number and the amount of federal funds awarded to each subrecipient Distribute policies and procedures and contract templates to all applicable finance and programmatic staff Train staff on the new policies and procedures

2024-001 Improve Controls and Documentation Over Subrecipient Monitoring Federal Program Information Federal Agency: Department of Health and Human Services Award Name(s): Child Care and Development Block Grant Assistance Listing Number(s): 93.575 Award Year: 2022 Compliance Requirement: Subrecipient Monitoring Federal Agency: Department of Health and Human Services Award Name(s): Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.391 Award Year: 2022 Compliance Requirement: Subrecipient Monitoring Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requires that a pass-through entity must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information as required in 2 CFR 200.332(b). Condition and Context During our audit, we tested a sample of one subrecipient under the Child Care and Development Block Grant in order to determine if the subrecipient agreements contained all required elements per 2 CFR 200.332(b) and ensure sufficient subrecipient monitoring procedures were performed. As a result of our testing, it was identified that the agreement tested did not contain the subrecipient’s unique entity identifier, federal award identification number, federal award date, assistance listing title, assistance listing number, dollar amount available under each federal award and assistance listing number at the time of disbursement, and approved indirect cost rate. While assistance listing number 93.391 was not tested as a major federal program in 2024, we have carried forward the finding from the prior year and applied it to this program as it has not yet been resolved. SECTION III - FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (CONTINUED) 2024-001 Improve Controls and Documentation Over Subrecipient Monitoring (Continued) Cause The Organization did not have adequate controls in place to ensure all required elements were included in subrecipient agreements. Effect or Potential Effect Due to the weakness in internal controls and compliance finding noted above, the Organization did not comply with the requirements of the Uniform Guidance regarding communication to subrecipients all the specified elements in 2 CFR 200.332. No questioned costs are reported as this requirement is administrative in nature. Recommendation The Organization should address the weakness noted above and update its subrecipient agreements, policies, and procedures to ensure that all required elements are present to comply with the Uniform Guidance. Views of Responsible Official Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes, federal award identification, subrecipient name, subrecipient’s DUNS number, federal award identification number (FAIN), federal award date, subaward start and end date, amount of federal funds obligated, total amount of federal award, federal award project description, name of federal awarding agency, Assistance Listing (ALN) number and name, identification of whether the award is R&D and indirect cost rate for federal award. Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal control should include procedures to ensure required information is communicated prior to the issuance of the subaward. Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient. Per 2 CFR 200.332(d) through (f), pass-through entities must monitor the activities of the subrecipient, which includes reviewing financial reports required by the pass-through entity. Condition: During our testing, we noted subrecipients tested had required information omitted from the sub agreements to the subrecipients including Assistance Listing (CFDA) title and number, subrecipient’s DUNS number, Federal Award Identification Number (FAIN), identification of whether the award is research and development, and indirect cost rate for federal award. Subrecipients tested did not have evidence of the County’s evaluation of the risk of noncompliance by the subrecipients, nor was there evidence of monitoring of annual audits for the subrecipients. Internal checklists that aid in compliance were missing for certain subrecipients. Reporting requirements from the subrecipients to the County were also not met. Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient. Questioned costs: None. Context: Five out of the five subrecipients did not include required information in subaward agreements issued to subrecipients and lacked evidence of both the evaluation of risk of noncompliance of the subrecipient and monitoring of annual audits for the subrecipients. Five of the five subrecipients were missing an internal checklist that is signed by the County Manager. Cause: Lack of sufficient controls in place to ensure that subrecipient agreements contain all required information and are monitored appropriately. Effect: Failure to communicate required information and to adequately monitor the subrecipients could result in subrecipients not properly administering the federal programs in accordance with federal regulations. Repeat Finding: Yes, repeat of prior year finding 2023-004. Recommendation: CLA recommends that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient. Views of responsible officials: There is no disagreement with the audit finding.

Finding No: 2024.001 Type: Significant Deficiency - Internal Control: Subrecipient Monitoring Condition: We were not able to substantiate evidence of monitoring grants to others. Criteria: Under 2 CFR 200.332, pass-through entities are required to monitor the activities of subrecipients as necessary to ensure that federal funds are used for authorized purposes in compliance with statutes, regulations, and terms and conditions of the award. This includes evaluating risk of noncompliance, conducting reviews (desk or on-site), following up on deficiencies, and ensuring timely corrective action, as well as resolving audit findings specific to the subaward. Internal control over compliance requirement related to subrecipient monitoring was not evidenced. Amount: not applicable Cause: The nonprofit did not implement sufficient monitoring processes over its subrecipients. Effect or Potential Effect: Failure to monitor subrecipients increases the risk of misused federal funds, nonachievement of performance goals, or uncorrected compliance issues. This can potentially result in questioned costs, the need for repayment of grant funds, reputational damage, and jeopardized future grant eligibility. Repeat Audit Finding: No Recommendations: Establish and implement a risk-based subrecipient monitoring plan that includes documented risk assessments, regular desk and/or on-site reviews, timely followup and resolution of deficiencies, and maintenance of supporting documentation for all monitoring activities. Provide training to staff on subrecipient monitoring requirements and ensure formal procedures comply with 2 CFR 200.332.

Finding 2024-002 – Subrecipient Monitoring US Department of Health and Human Services - Passed through the Pennsylvania Department of Human Services – Foster Care Title IV-E (ALN 93.658) US Department of Health and Human Services - Passed through the Pennsylvania Department of Aging – Aging Cluster (ALNs 93.044, 93.045, and 93.053) Grant Number 4100089721 Condition: The County has internal controls in place to monitor subrecipients of Foster Care Title IV-E and aging funding, however, the policies do not incorporate all required federal compliance requirements. For Aging, the County did not conduct the annual risk assessment prior to the disbursement of funds. The County did not ensure that all Foster Care Title IV-E and aging subrecipients were notified via contract or letter of the subaward ALN and amount that was paid during the year. Additionally, the County only request audits from subrecipients if the county passes over $150,000 federal dollars to the subrecipient. As part of the monitoring process, the County obtained and reviewed annual audit reports for a portion of, but not all of, the subrecipients in a timely manner in order to ensure the subrecipients complied with the Foster Care Title IV-E and Aging requirements. Criteria: In accordance with the federal compliance requirements all pass through entities must ensure that every subaward is clearly identified to the subrecipient and includes specific information as discussed at 2 CFR 200.332(b). Additionally, 2 CFR 200.332(e) and 200.332(g) requires the pass through entity to resolve audit finding specifically related to the subaward and to verify that a subrecipient is audited as required by subpart f of this requirement. Finally, 2 CFR 200.332 (c) requires that the County evaluate all subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate monitoring. Cause: Procedures are in place over subrecipient monitoring, however the procedures to ensure that subrecipients are notified of the requirements listed in 2 CFR 200.332(b) are not adequate. The County also only requires audits and follows up on any deficiencies for subrecipients that they pass through more than $150,000 in federal funding, which is not adequate in accordance with 2 CFR 200.332(e) and 200.332(g). Finally, the county did not perform a timely annual risk assessment for Aging subrecipients in accordance with 2 CFR 200.332 (c). Effect: Subrecipients may have been unaware of the federal nature of their funding, relevant compliance requirements, and the need to prepare for single audit submission as required under federal regulations. Additionally, incomplete monitoring of subrecipient audits may result in noncompliance with federal program requirements and increase the risk of misuse or mismanagement of federal funds. Repeat Finding: This is not a repeat finding Questioned Costs: Unknown Recommendation: We recommend that procedures be implemented to ensure all subrecipients are notified of subaward requirements as outlined in 2 CFR 200.332(b) and the County implement a process to ensure all subrecipients audits are reviewed and deficiencies be followed up on. We also recommend that the County perform annual risk assessments for all subrecipients. Management Response: See corrective action plan.

2024SA-003 Insufficient Subrecipient Monitoring Federal Agency/Passthrough Agency: US Department of Health and Human Services Program: SAMHSA Grant Depression Screening in School based Health Centers Federal Award Number: 43382006L Assistance Listing Number: 93.243 Material Weakness Material Noncompliance – Financial Management Criteria: 2 CFR 200.332 states the recipient should monitor the activities of the subrecipient as necessary to ensure that the subawards are used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR section 200.332 (d) through (f)), in addition to procedures identified as necessary based upon the evaluation of the subrecipient risk or specifically required by the terms and conditions of the award. Condition: The Health Department gave $100,000 to the Community Foundation of East Central IL to help fund new TASK programs at 4 local school districts. Our inquiry regarding subrecipient monitoring determined that no subrecipient monitoring was taking place. Context: From reviews of the County and Health Department’s internal control and accounting procedures along with inquiries made, it was indicated that the Health Department has not gained an adequate understanding of all of the compliance requirements related to federal awards and has not developed necessary internal controls to ensure compliance, including but not limited to subrecipient monitoring. Effect: Potential for misappropriation of funds by the subrecipient due to lack of monitoring. Questioned Costs: None. Cause: There is a systematic problem throughout the County regarding a lack of adequate knowledge of compliance requirements related to federal awards, a lack of documentation of risk assessments being completed, and a continued disregard for establishing and documenting effective internal controls, in particular there is an absence of secondary reviews and monitoring. Repeated Finding: No Recommendation: Review the federal guidelines and requirements related to management of federal awards. Establish and document a plan to ensure compliance with each requirement. In this instance, establish necessary procedures to monitor the subrecipient’s compliance with the federal guidelines. Management’s Response: The Health Department will establish procedurs for subrecipient monitoring.

Criteria In accordance with 2 CFR § 200.332(a) of the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), pass-through entities are required to “clearly identify to the subrecipient” certain information and requirements at the time of subaward, including the Federal award identification, all compliance requirements, and any additional terms and conditions imposed by the pass-through entity. Condition During our audit of the airport improvement program grant awarded to the Town, we noted that the Town did not execute a formal subrecipient agreement with Fishers Island Ferry District, to whom federal funds were passed through during the audit period. Specifically, no written agreement was in place outlining the subrecipient’s responsibilities, applicable compliance requirements, or the terms and conditions of the award. Cause The Town did not have procedures in place to ensure that subrecipient agreements are issued for this program. Effect Without a formal subrecipient agreement, the entity increased the risk that the subrecipient may not fully understand or comply with federal award requirements. This could result in noncompliance with federal regulations, potential misuse of funds, and questioned costs. Additionally, the entity is not in full compliance with Uniform Guidance. Questioned Costs None Recommendation We recommend that the Town develop and implement procedures to ensure that formal written subrecipient agreements are executed prior to the disbursement of federal funds. These agreements should contain all elements required by 2 CFR § 200.332(a), including the identification of the federal award, applicable compliance requirements, and any additional terms and conditions. Views of Responsible Officials The Town agrees with this finding. The absence of subrecipient agreements for the airport improvement program was an oversight. Procedures have since been put in place to ensure that formal written subrecipient agreements are executed prior to the disbursement of federal funds.

Federal Grantor: U.S. Department of Treasury Pass-through Grantor: n/a Assistance Listing No.: 21.027 Program Title: COVID-19 Coronavirus State and Local Fiscal Recovery Funds Award Year: 2024 Compliance Requirement: Subrecipient Monitoring Known Questioned Costs: n/a Criteria: Part 1 of the Compliance and Reporting Guidance, issued by the U.S. Department of the Treasury, states that "SLFRF recipients that are pass-through entities as described under 2 CFR 200.1 are required to manage and monitor their recipients to ensure compliance with requirements of the SLFRF award pursuant to 2 CFR 200.332 regarding requirements for pass-through entities." Additionally, it is stated that pass-through entities are required to clearly identify to the subrecipient any and all compliance requirements for use of SLFRF funds. Condition: The County requires potential recipients of SLFRF funds to complete an application, which clearly identifies any and all compliance requirements for the use of the SLFRF funds. It also advises potential recipients to retain documentation of all uses of the funds and produce those documents to the County upon request. The County awarded SLFRF funds to two subrecipients. For one of the two subrecipients, the County did not ask the subrecipient to produce any documentation of the use of the funds and, therefore, did not perform their duty as a pass-through entity to manage and monitor their recipients to ensure compliance. Additionally, the County did not properly ascertain that any subrecipients expected to be audited as required by the Uniform Guidance, under subpart F, met this requirement (2 CFR 200.331(f)). This verification performed as part of the required monitoring under 2 CFR 200.331(d)(2) is required to ensure that the subrecipient takes timely and appropriate action on deficiencies detected through audits. Cause: Oversight. Effect: The County, as a pass-through entity, is required to manage and monitor their recipients to ensure compliance with requirements of the SLFRF. By failing to manage and monitor one of their subrecipients, the County is in violation of their responsibility as a pass-through entity. Recommendation: We recommend that the County implement procedures for monitoring the spending of SLFRF funds by subrecipients during, and upon completion of their projects to ensure compliance. Management's Response: The County has created a filing system for recipients of SLFRF funds and a calendar set to send reminder notices to get receipts and other information from recipients. The reminders will be set in 3 month increments from the time funds are awarded to recipient. Implementation will begin January 1, 2026 with reminder notices set in calendar.

Finding 2024-002 – Subrecipient Monitoring Federal Agency: Department of Treasury Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds – ALN #21.027 Condition: As part of the monitoring process, the County did not obtain and review the annual audit reports of subrecipients. Criteria: Per 2 CFR Section 200.332 Requirements for pass-through entities, a pass-through entity must: (g) Verify that a subrecipient is audited as required by subpart F of 200.332. In addition, a pass through entity must resolve subrecipient audit findings specifically related to the subaward. Cause: The County does not have procedures in place to adequately review the subrecipient audits received. Effect: Failure to obtain and review subrecipient audit reports increases the risk that subrecipient noncompliance, internal control deficiencies, or questioned costs remain unidentified and unaddressed, which may result in unallowable costs being charged to the federal awards. Repeat Finding: No Recommendation: The County should update written policies and procedures to require timely obtaining and documented review of subrecipient audit reports including documented evaluation of findings relevant to the PTE’s awards and assessment of subrecipient risk. Questioned Costs: Unknown Views of Responsible Official and Planned Corrective Action: Management agrees with the finding. See separate correction action plan.

2024-003 – Subrecipient Monitoring Program: ALN# 47.070 = Computer and Information Science and Engineering Grant #: 2216614, 2122756, Grant Period: Year Ended December 31, 2024 Government Agency: National Science Foundation Criteria: Per 2 CFR 200.331–200.332, pass-through entities must: • Evaluate each subrecipient’s risk of noncompliance to determine appropriate monitoring. • Monitor subrecipient activities to ensure compliance with Federal statutes, regulations, and program requirements, including reviewing financial and performance reports. • Verify subrecipients have audits as required under Subpart F. • Issue management decisions on subrecipient audit findings. • Maintain documentation of monitoring activities. Condition: During our testing of subrecipient monitoring, we noted that the Organization did not document required monitoring procedures for the subrecipients selected for testing. Specifically: • No documented risk assessments were performed prior to awarding funds. • The Organization did not obtain or review subrecipient Single Audit reports or written assurances of audit compliance. • Subrecipient agreements did not consistently include all required elements under 2 CFR 200.332(a). Informal monitoring was performed, but not to the level required by the Uniform Guidance. Cause: The Organization does not have adequate internal controls or documented procedures to ensure all required subrecipient monitoring tasks are consistently completed and retained. Personnel indicated that monitoring controls are informal and not centralized. Effect: Failure to perform required subrecipient monitoring increases the risk that Federal funds may be misused, unallowable, or spent in violation of program requirements without detection. Questioned Costs: No questioned costs identified. Context: This sample was not intended to be, and was not, a statistically valid sample. Repeat Finding: Yes Recommendation: We recommend that the Organization: • Develop and implement formalized subrecipient monitoring policies and procedures aligned with 2 CFR 200.332. • Perform and document risk assessments for all subrecipients. • Obtain and review Single Audit reports, as applicable, and issue written management decisions. • Conduct and document ongoing monitoring activities (e.g., financial/performance report reviews, site visits). • Maintain complete monitoring documentation in a centralized and accessible location. Views of Responsible Officials: See management corrective action plan attached.

Federal Program: Medical Assistance Program (U01) Criteria: 2 CFR 200.332(d) requires pass-through entities to monitor the activities of subrecipients to ensure compliance with federal statutes, regulations, and the terms and conditions of the subaward. Required monitoring activities include reviewing financial and performance reports, following up on deficiencies, and ensuring timely corrective action. Condition: The Organization did not maintain records of the monitoring procedures performed on subrecipients as required by Uniform Guidance. Cause: The Organization had a change over in leadership and key positions, during the transition the documentation of monitoring procedures and results was not maintained. Effect: There is an increased risk that subrecipients may not comply with federal requirements, which could result in unallowable costs, questioned costs, or other noncompliance with federal statutes and regulations. Questioned Costs: None. Context: This finding was noted for all subrecipients for the year ended December 31, 2024 with a total of $1,838,933 paid to subrecipients. Repeat Finding: No. Recommendation: We recommend the organization maintain copies of all monitoring records and results of the site visits, to ensure all required subrecipient monitoring activities are performed and properly documented in accordance with Uniform Guidance.

Finding 2024-001: Subrecipient Monitoring Federal Program: Assistance Listing #21.027 - Coronavirus State and Local Recovery Funds. Criteria: A pass-through entity must ensure that every subaward is clearly identified to a subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. (2 CFR 200.332(b)). Condition: Illuminate Colorado has issued subawards to subrecipients to carry out part of its Coronavirus State and Local Recovery Funds program. 2 out of 4 subrecipients were selected for testing. The subawards for these subrecipients were missing the following Federal award identification information:  Subrecipient's unique entity identifier.  Federal Award Identification Number (FAIN).  Federal Award Date.  Amount of Federal Funds Obligated in the subaward.  Total Amount of the Federal Award committed to the subrecipient by the pass-through entity.  Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA).  Name of the Federal agency and contact information for the awarding official of the passthrough entity. Item required in accordance with 2 CFR 200.332(b) (formerly 200.331(a)) of the Uniform Guidance.  Identification of whether the Federal award is for research and development. Questioned Costs: None. Cause and Effect: Illuminate Colorado has adding provisions in its financial policies and procedures to include the required information in its subawards to subrecipients of Federal funds. While some of the information required by 2 CFR 200.332(b) has been included in the subaward, the information noted above was not. As a result, Illuminate Colorado issued incomplete Federal award information to its subrecipients for this program. This may cause subrecipients to be unable to adhere to any specific compliance requirements, federal laws, regulations, and terms and conditions of the award resulting in noncompliance with all federal rules applicable to the program for which Illuminate Colorado is ultimately responsible. Recommendation: Properly identify subrecipients and ensure subawards include Federal award identification information. Illuminate Colorado can ensure all the required Federal award identification information through a subaward checklist and review by appropriate organization management. Management’s Response: Illuminate Colorado has developed a new process for properly identifying subrecipients and ensuring all required federal award identification information is included in each subaward prior to issuance. This process includes the use of an updated subaward checklist and management review prior to execution of subaward agreements.

Subrecipient Monitoring Federal Department – U.S. Department of Justice Pass-through Illinois Criminal Justice Information Authority Federal Award Identification Number and Year: 15JOVW-21-GG-00543-STOP and 2021 15JOVW-22-GG-00422-STOP and 2022 Violence Against Women Formula Grants, Federal Assistance Listing #16.588 County Department – State’s Attorney Office Finding 2024 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4)Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. CONDITION During the current audit period, the Cook County State’s Attorney Office (SAO) did not adequately comply with its subrecipient monitoring requirements as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding was an inadequate understanding of sub-recipient monitoring policies and best practices. While the Department believed at the time that they were in compliance with the applicable monitoring requirements, they now recognize that their efforts did not fully meet the necessary standards. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in the inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of two (2) subrecipients (of a population of 4 subrecipients), we noted the following:  For both subrecipients, we noted documentation was not maintained to support SAO’s evaluation of the subrecipients’ risk of noncompliance and the frequency of monitoring to be conducted by SAO based on the assessed risk.  We also noted for both subrecipients, no documentation was provided to verify whether the subrecipients were required to have a Single Audit conducted, including SAO’s review of the report, and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.332e(3).  The SAO utilized a “Subrecipient Monitoring Checklist” (Checklist) to conduct and document its monitoring of subrecipients. Based on review, we noted the Checklist does not include evidence of who completed the monitoring, the date the actual monitoring was performed nor the subrecipient personnel with whom the monitoring results were discussed during the site visit. Also, the Checklist appears to be inaccurately completed. Specifically, we noted the Checklist noted that the results include expected corrective actions and dates for resolution. However, there was no finding or issues noted in the formal letter submitted to the subrecipient(s) after the site visit(s). IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend SAO implement procedures to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance and review of the Single audit report, as required by Federal regulations. Also, we suggest that the Checklist be accurately prepared and updated to include evidence of who completed the monitoring, the date the actual monitoring was performed, and the subrecipient personnel with whom the monitoring results were discussed during the site visit. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 38-39.

Reporting Federal Department – U.S. Department of Treasury Pass-through Illinois Department of Human Services Federal Award Identification Number and Year: SLFRP4406 and 2021 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds, Federal Assistance Listing #21.027 County Department – Justice Advisory Council Finding 2024 – 003 CRITERIA As required by the grant agreement with the State of Illinois, Department of Human Services (IDHS), Exhibit B, Deliverables. 4. Reporting Requirements, states “i. Pursuant to Paragraph 13.1 and 13.2 Cook County will submit monthly, quarterly and final Periodic Financial Reports (PFRs) in the format prescribed by IDHS. The monthly, quarterly and final Periodic Financial Reports must be submitted no later than the 15th of each month for the preceding month or quarter by email. The final year-end report (July 1st - June 30th) will be due on or before July 15th or no more than 30 days following grant termination. ii. Pursuant to Paragraph 13.1 and 13.2 Cook County will submit quarterly and final Periodic Performance Reports (PPRs) in the format prescribed by IDHS. Quarterly and Final Periodic Performance Reports are due no later than the 15th of each month for the preceding quarter by email. Quarter 1 (July 1st - September 30th) due October 15th, Quarter 2 (October 1st- December 31st) due January 15th, Quarter 3 (January 1st- March 31st) due April 15th, and Quarter 4 (April 1st- June 30th) due July 15th). The final year-end report (July 1st -June 30th) will be due on or before July 15th or no more than 30 days following grant termination. Performance reports will include a detailed account of how Cook County is ensuring compliance with 2 CFR 200.332. iii. Annual Program Application Plan: Providers are required to submit an Annual Program Application/Plan each year. Annual Program Plans for Programs exempt from 30 ILCS 708 (GATA) or during a renewal year will be due in April/May of each year for the upcoming program year.” CONDITION During the current audit period, Cook County Justice Advisory Council (JAC) did not comply with the reporting requirements as outlined in its grant agreement. CAUSE Based on discussions with management, the March 2024 monthly financial finding occurred due to reconciling actual expenditures for the 5-month grant period close-out. The quarterly performance report finding occurred due to an adjusted 30 days reporting schedule allowed verbally by the grantor. EFFECT Failure to submit reports in a timely manner could impair the grantor agency’s ability to monitor program activities and could result in the loss of grant funding. QUESTIONED COSTS None. CONTEXT During our review, we noted the IDHS grant agreement ended on June 30, 2024, which represented seven months of required reporting to be submitted during the County’s fiscal year. As a result, we reviewed a total of eight reports submitted (three monthly financial (of a population of 7 monthly reports), one quarterly financial and one quarterly performance report (of a population of 2 quarterly financial and performance reports), one final financial and one final performance report, and one annual program application plan report), and noted 2 of the eight reports reviewed were submitted late. See Finding for Chart/ Table. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend JAC develop and implement procedures to ensure reports are submitted in a timely manner and in compliance with its grant agreement. A compliance calendar of all future grants reporting due dates should be maintained to assist with ensuring future compliance with reporting requirements. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 40-41.