Findings Citing § 200.332

(2025-032) Title: Internal control over Health Disparities program subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services Public Safety State Bureau: Maine Center for Disease Control & Prevention Emergency Medical Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information. • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. • monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. MeCDC has a memorandum of understanding in place with the Department of Public Safety’s Emergency Medical Services (EMS) Bureau to assist in administering the Health Disparities program. The Office of the State Auditor (OSA) tested 11 contracts or contract amendments issued by MeCDC and 3 contracts issued by EMS for compliance with: • award identification requirements and found: o 9 contract amendments issued by MeCDC did not include the name of the Federal agency issuing the award, the Federal award identification number, or the Federal award date; and o all 3 contracts issued by EMS did not include the Federal award identification number, the Federal award date, the assistance listing title and number, or the indirect cost rate for the Federal award. • subrecipient risk evaluation procedures and found through inquiry of program personnel at MeCDC and EMS that policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. As a result, subrecipient monitoring activities were the same for all subrecipients/contracts, regardless of risk. • subrecipient monitoring requirements and found that documentation could not be provided to support that: o follow-up occurred regarding late receipt of an incomplete financial report for 1 contract overseen by MeCDC; o an appropriate response was completed to previously identified inaccurate expense reporting for 1 contract overseen by MeCDC; o a required report was reviewed for 1 contract overseen by EMS; and o required reports were received or that appropriate action was taken in response for 2 contracts overseen by EMS. OSA determined that payments made to subrecipients for the aforementioned reporting deficiencies were allowable based upon subsequent reports and other monitoring procedures performed. OSA utilized a risk-based approach to select 2 contracts issued by MeCDC and selected a non-statistical random sample of all other contracts. Context: In fiscal year 2025, MeCDC provided $3.2 million from a total of $6.2 million and EMS provided $301,000 from a total of $449,000 to Health Disparities program subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Potential future questioned costs and disallowances Recommendation: We recommend that the Department implement policies and procedures: • to ensure that all required information is included in contracts and contract amendments; • that require evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed; and • implement policies and procedures to ensure all required subrecipient monitoring activities are performed. Corrective Action Plan: See F-19 Management’s Response: DHHS Response: The Department partially agrees with this finding. We agree with the recommendations that the Department implement policies and procedures to ensure all required information is included in contracts and that all required subrecipient monitoring is completed. The Department disagrees that we do not have subrecipient risk evaluation procedures. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. DHHS Contact: Eden Hale, Associate Director, Division of Population Health Equity, Maine CDC, 207-441-1090 DPS Response: The Department partially agrees with this finding. The Department of Public Safety acknowledges that EMS was missing policies and procedures around specific subrecipient monitoring activities and required contract language identifying the Federal Grant. However, the Department has these policies and procedures in place for the Contract/Grant Team which oversees the majority of the Federal Funding for the Department. The Department will ensure all Bureaus receive guidance, training, and policies and procedures. DPS Contact: Derek Gorneau, Assistant to the Commissioner, DPS, 207-530-3531 Auditor’s Concluding Remarks: DHHS: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. DPS: The Department asserts that policies and procedures are in place for the Contract/Grant Team, but did not demonstrate that these policies and procedures were adhered to in relation to contracts for the Health Disparities program. The finding remains as stated. (State Number: 25-1123-03)

(2025-036) Title: Internal control over PDG subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services Education State Bureau: Office of Child and Family Services Office of Teaching and Learning Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $128,333 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of subrecipients who received program funds during fiscal year 2025 and identified known questioned costs associated with 1 of those subrecipients based on various compliance attributes. Since circumstances are unique to each subrecipient, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information. • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. • monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. • ensure that the subrecipient takes corrective action on all Single Audit findings related to the subaward, other audit findings, site visits, and written notifications of adverse conditions which will impact the ability to meet milestones or the objectives of a subaward. Condition: The Every Student Succeeds Act/Preschool Development Grants (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Department of Health and Human Services’ (DHHS) Office of Child and Family Services (OCFS). DHHS has a memorandum of understanding in place with the Department of Education (DOE) to assist in administering PDG. OSA tested 2 contracts issued by OCFS and 2 contracts issued by DOE for compliance with: • award identification requirements, and found: o 2 contracts issued by OCFS did not include the Federal award identification number or the grant award number; and o 2 contracts issued by DOE did not include the Federal award identification number, the Federal award date, the assistance listing title and number, the name of Federal agency, the assistance listing title and number, identification of whether the Federal award is for research and development, or the indirect cost rate for the Federal award. • subrecipient risk evaluation procedures, and found through inquiry of program personnel at OCFS and DOE that policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. As a result, subrecipient monitoring activities were the same for all subrecipients/contracts regardless of risk. • subrecipient monitoring requirements, and found that OCFS did not identify an appropriate level of monitoring for 1 contract. Evidence of significant developments, including inability to meet performance goals, that impacted the subrecipient’s ability to meet the objectives of the subaward were present prior to quarterly reporting. OSA determined that payments made to this subrecipient for the aforementioned monitoring deficiencies were not allowable based upon subsequent financial reports and the results of other monitoring procedures performed during the fiscal year. Payments to the subrecipient were withheld after April 2025. OSA has questioned the full amount of program expenditures paid to this subrecipient during the fiscal year, totaling $128,333. OSA selected a non-statistical random sample of all PDG subrecipient contracts. Context: In fiscal year 2025, PDG expenditures totaled $11.5 million, of which approximately $910,000 was paid to OCFS subrecipients and $709,000 was paid to DOE subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Payments may be issued in error to subrecipients not in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. • Known questioned costs • Potential future questioned costs and disallowances Recommendation: We recommend that the Department enhance oversight and implement policies and procedures to ensure that: • all required information is included in contracts and contract amendments; • an evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring is performed; and • all required subrecipient monitoring activities are performed. Corrective Action Plan: See F-21 Management’s Response: The Departments partially agree with this finding. DHHS agrees that two contracts did not include the Federal award identification number or the grant award number. DOE agrees that two contracts did not include the Federal award identification number, the Federal award date, the assistance listing title and number, the indirect cost rate for the Federal award, name of Federal agency, assistance listing title and number, identification of whether the Federal award is for research and development, and the indirect cost rate for the federal award. The Departments disagree that subrecipient risk evaluation policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. DOE utilizes a risk assessment tool when developing monitoring of invoices associated with subrecipients. Contact: Tara Williams, Associate Director of Early Care & Education, OCFS, DHHS, 207-557-2342 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. DHHS’ existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. Furthermore, as noted in the Condition, OSA found that DHHS did not identify an appropriate level of monitoring for 1 contract. If DHHS had adequate controls in place over subrecipient risk evaluation requirements, appropriate subrecipient monitoring procedures would have been developed and performed in response to the subrecipient’s inability to meet the objectives of the subaward, including withholding payments to the subrecipient sooner. Additionally, the risk assessment tool that DOE refers to in Management’s Response only determines the frequency of invoicing (monthly or quarterly) and does not determine the level of subrecipient monitoring needed based on the subrecipient’s risk. The finding remains as stated. (State Number: 25-1122-04)

(2025-043) Title: Internal control over TANF subrecipient risk evaluation procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal regulations for the purpose of determining the appropriate level of subrecipient monitoring to be performed. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Department provided evidence to support that subrecipient monitoring procedures were performed; however, documentation that risk evaluation procedures performed corresponded to the appropriate level of monitoring activities could not be provided. Context: The Department provided $35.0 million from a total of $104.9 million to TANF subrecipients during fiscal year 2025. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-23 Management’s Response: The Department disagrees with this finding. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 25-1111-02)

(2025-047) Title: Internal control over TANF subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Department is required to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Office of the State Auditor (OSA) tested 9 contracts issued to Temporary Assistance for Needy Families (TANF) subrecipients and found that documentation could not be provided to support that: • required performance reports were received and that appropriate action was taken in response for 4 contracts; and • required reports were reviewed for 6 contracts. OSA determined that payments made to subrecipients for the aforementioned reporting deficiencies were allowable based upon subsequent reports and other monitoring procedures performed. OSA selected a non-statistical random sample. Context: The Department provided $35.0 million from a total of $104.9 million to TANF subrecipients during fiscal year 2025. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Potential future questioned costs and disallowances Recommendation: We recommend that the Department implement policies and procedures to ensure that all required reports are received from subrecipients and reviewed by program personnel, and that appropriate action is taken to address any deficiencies identified through subrecipient monitoring. Corrective Action Plan: See F-25 Management’s Response: The Department agrees with this finding. The Department will create a process to ensure the documentation of the review of sub-recipient performance reports. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-08)

(2025-054) Title: Internal control over CCDF subrecipient risk evaluation procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Child Care and Development Fund (CCDF) program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. The CCDF program contracts with subrecipients to administer the First 4 ME Pilot Project, a community-based, coordinated birth through kindergarten entry program which provides comprehensive, high-quality early child care and education to support a child’s school readiness. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal regulations for the purpose of determining the appropriate level of subrecipient monitoring to be performed. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Department provided evidence to support that subrecipient monitoring procedures were performed; however, documentation that risk evaluation procedures performed corresponded to the appropriate level of monitoring activities could not be provided. Context: The Department provided $2.8 million from a total of $45.1 million to CCDF subrecipients during fiscal year 2025. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure that subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-27 Management’s Response: The Department disagrees with this finding. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: John Feeney, Chief Operating Officer, OCFS, DHHS, 207-626-8614 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While the Office of the State Auditor acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 25-1114-05)

(2025-071) Title: Internal control over DG – PA program subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 2 CFR 200.521 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow up and ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. The Department must issue a management decision for audit findings that relate to Federal awards provided to the subrecipient within 6 months of acceptance of the audit report by the Federal Audit Clearinghouse (FAC). Condition: The Maine Emergency Management Agency (MEMA) administers the Disaster Grants – Public Assistance (DG – PA) program for the State. MEMA is required to verify and document that Single Audits have been completed in the FAC and issue a management decision for audit findings related to awards to subrecipients. The Office of the State Auditor (OSA) tested 4 DG – PA program subrecipients subject to Single Audit requirements and found that documentation of review for 2 subrecipients could not be provided. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department expended $160.5 million in DG – PA program funds, of which $154.6 million was provided to 27 subrecipients. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients not complying with Federal statutes, regulations, or the terms and conditions of subawards may not be implementing appropriate corrective action in response to audit findings. Recommendation: We recommend that the Department enhance policies and procedures to ensure that adequate documentation is maintained and that subrecipient audits are received, reviewed, and appropriate action is taken in response to audit findings. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. The Department will publish and implement an updated subrecipient monitoring procedure to require more extensive and narrative documentation of the single audit review process, including: - a list of subrecipients required to file a single audit report for a given audit year - whether or not an audit had been filed as of the review date - analysis of audit findings as relevant - summary of required actions per the subrecipient monitoring procedure, and/or updates on actions/communications since the prior review period as relevant Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-05)

2025-002 – Subrecipient Monitoring – Internal Control and Compliance over Subrecipient Monitoring (Material Weakness) Identification of the Federal Program: Assistance Listing Number: 21.027 Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: Department of Treasury Pass-Through Entity: N/A Federal Award Number and Award Year: N/A Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): C.F.R. § 200.332 prescribes that the pass-through entity must conduct monitoring activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Passthrough entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. 3. Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. 4. The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. The City’s Subrecipient Monitoring Policy and Procedures, effective April 17, 2024, requires departments to monitor subrecipients to ensure compliance with Uniform Guidance. The policy requires that prior to award, the department shall evaluate the subrecipient’s risk of noncompliance with the Uniform Guidance, and the terms and conditions of the subaward, which risk assessment shall be documented, 2 CFR § 200.332(b). The policy also states that the City shall monitor subrecipients on a quarterly basis (90 days) throughout the term of the agreement (department should establish a regular monitoring schedule and document all monitoring), to ensure all subrecipients comply with the Uniform Guidance, that the subaward is used for authorized purposes, and that the subaward performance goals are achieved, as follows 2 CFR § 200.332(d):  Reviewing subrecipient’s financial and performance reports.  Ensuring subrecipients provide timely reports and information, as required by the federal awards.  Following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies as detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings.  Issuing a management decision on Audit Findings, as required by 2 CFR § 200.521 (Management Decision). Condition: During the review of subrecipient monitoring records, we tested all two (2) existing subrecipients during the fiscal year ended June 30, 2025, and noted the following:  The fully executed subrecipient agreements were not provided. One subrecipient agreement was executed via internal resolution and email approval; another subrecipient’s agreement does not have sufficient identification and award details, omitting key funding terminology.  The documentation of the review of Financial and Performance Reports, the Pre-Award Risk Assessments, or the performance of the required subrecipient monitoring procedures were not provided. Cause: These conditions resulted from staffing capacity constraints, which led to subrecipient monitoring procedures not being performed consistently since the implementation of the City’s new Monitoring Policy on April 17, 2024. Additionally, formal documentation processes were not fully established, resulting in informal approvals and incomplete documentation of Pre-Award Risk Assessments. Effect or Potential Effect: The City’s insufficient monitoring of the necessary subrecipient activities resulted to internal control and compliance requirement finding. Questioned Costs: None. Context: See condition above for context of the finding. Identification as a Repeat Finding, If Applicable: Yes. See prior year finding 2024-003. Recommendation: We recommended the City to fully implement its Monitoring Policy by formalizing subrecipient agreements, strengthening internal controls, and establishing consistent processes for documenting Pre-Award Risk Assessments and Financial and Performance Reports. Views of Responsible Officials: Management concurs.

2025-002 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D”) Sponsoring Agency: Various – All R&D awards with subrecipients from 1 campus Award Name: Various - All R&D awards with subrecipients from 1 campus Award Number: Various Assistance Listing Title: Various – All R&D awards with subrecipients from 1 campus Assistance Listing Number: Various - All R&D awards with subrecipients from 1 campus Award Year: 2024-2025 Pass-through entity: All pass-through awards for 1 campuses with subrecipients Criteria 2 CFR 200.332(e) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(g) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Condition Through testing of subrecipient monitoring activities across four campuses, we identified that one campus does not have a documented process to determine whether subrecipients obtained a Uniform Guidance audit, as required, nor a process to follow up on audit findings or issue management decisions when applicable, in accordance with 2 CFR 200.233(e) and (g). While the campus performs a detailed pre-award risk assessment prior to executing subaward agreements — which includes review of available Uniform Guidance audit reports — ongoing monitoring procedures do not consistently include a review of the most recent Uniform Guidance audit report during the period of performance. Subaward agreements at this campus are generally limited to one year; however, when agreements are continued without a formal renewal or monetary amendment, a subsequent risk assessment is not required. As a result, updated Uniform Guidance audit reports are not consistently obtained or reviewed to determine whether (1) the subrecipient met audit requirements, (2) findings exist that impact the federal program, and (3) a management decision is required. Specifically, of 25 subawards tested at this campus, 9 did not have evidence that the most recent Uniform Guidance audit report was obtained and reviewed during the award period. In instances where audit reports were reviewed, documentation indicates the review was performed for risk assessment purposes rather than to satisfy the ongoing monitoring and management decision requirements under 2 CFR 200.232(e) and (g). Cause The campus’ monitoring procedures rely on subrecipients to communicate applicable audit findings rather than requiring the campus to independently obtain and review the most recent Uniform Guidance audit reports on an annual basis. Although review of Uniform Guidance reports is incorporated into the prescribed subrecipient risk assessment process, the risk assessment is not consistently required throughout the period of performance. As a result, procedures do not ensure that updated audit reports are obtained, evaluated, and documented in accordance with the requirements of 2 CFR 200.233(e) and (g). Effect As a result of not performing and documenting an annual review of subrecipients’ Uniform Guidance audit reports, the campus may not identify audit findings that impact its federal programs or ensure that appropriate follow-up and management decisions are issued within the required timeframe. This increases the risk of noncompliance with 2 CFR 200.233(e) and (g) and may result in unaddressed deficiencies or questioned costs related to federal awards. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the campus revise its subrecipient monitoring policies and procedures to require the timely review of subrecipients’ Uniform Guidance audit reports throughout the period of performance. Procedures should ensure that audit reports are reviewed at least annually to (1) determine whether the subrecipient met audit requirements, (2) identify findings that impact the campus’ federal programs, and (3) document follow-up actions and issuance of management decisions, as required by 2 CFR 200.233(e) and (g). Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings.

2025-004 – Subrecipient Monitoring: Lack of Supporting Documentation for Subrecipient Monitoring Activities Cluster: Not applicable Sponsoring Agency: United States Agency for International Development (USAID) Award Name: USAID Foreign Assistance for Programs Overseas Award Number: 7200AA19CA00018, 7200AA21LE00003 Assistance Listing Title: USAID Foreign Assistance for Programs Overseas Assistance Listing Number: ALN 98.001 Award Year: 2024-2025 Pass-through entity: Not applicable Compliance Requirement: Subrecipient Monitoring Criteria or Specific Requirement Under 2 CFR 200.332, pass-through entities are required to monitor subrecipients to ensure federal funds are used for authorized purposes, comply with award terms, and meet performance objectives. Required monitoring activities include reviewing financial and performance reports, ensuring corrective actions are taken, resolving audit findings, and issuing management decisions when applicable. Pass-through entities must also verify that subrecipients obtain audits in accordance with 2 CFR Part 200, Subpart F. Identified Condition For subrecipient monitoring testwork across two campuses, one campus was unable to provide evidence of subrecipient monitoring activities for the sample of nine (9) subrecipients selected for testwork. Specifically, formal supporting documentation of monitoring procedures conducted by the campus, such as reviews of subrecipient annual work plans, activity reports, performance indicator reporting, progress reports, technical reports, expenditure reports, and site visit reviews, were not available. Cause The grant awards for this program were terminated by the federal agency during February 2025. Following program termination, key program personnel separated from the campus, including the program investigators responsible for subrecipient monitoring activities. The campus did not have a formal document maintenance system in place to ensure the program investigators’ records were properly maintained by the campus. Consequently, supporting documentation related to subrecipient monitoring activities could not be located. Effect Lack of supporting documentation for subrecipient monitoring activities prevents the campus from demonstrating compliance with subrecipient monitoring requirements under the program. As a result, this increases the risk of deficiencies in subrecipient performance and/or the potential for unallowable expenditures. Questioned Costs None. Recommendation We recommend that the campus strengthen its record retention policies and access controls to ensure continuity and accessibility of supporting documentation and records in the event of employee turnover. Additionally, we also recommend that a formal process is established to ensure all required records and documentation are properly maintained when key personnel (program investigators and others) separate from the campus. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings.

2025-003: Accurate and Complete Schedule of Expenditures of Federal Awards (SEFA) Criteria or specific requirement: The Alliance must prepare a SEFA that is accurate and complete in accordance with 2 CFR 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). Condition and context: The Alliance did not prepare a SEFA that was accurate and complete in accordance with the Uniform Guidance, as the unadjusted totals for federal expenditures were not accurate and did not agree to underlying support. In addition, an immaterial amount of allowable expenses were included on the 2025 SEFA, that should have been included on the 2024 SEFA. Cause: The cause is due to limited internal controls related to the preparation and review of the SEFA. Effect or potential effect: Without adequate controls over this process, the Alliance may not identify all federal awards received and related compliance and reporting requirements applicable to each award. Questioned costs: None. Identification as a repeat finding, if applicable: This is a repeat finding. Recommendation: The Alliance must assign individuals who are experienced and knowledgeable in the compliance requirements of the Uniform Guidance to monitor all federal grants received to ensure that the Alliance has met the applicable compliance and reporting requirements of each federal award. Views of responsible officials: Refer to the Corrective Action Plan prepared by the Alliance in regard to this matter. 2025-004: Subrecipient Monitoring Identification of the federal program: Continuum of Care Program (AL # 14.267) Criteria or specific requirement: In accordance with Title 2 U.S. Code of Federal Regulations (CFR) Part 200.332, the Alliance must perform specific monitoring over subrecipients. The Alliance as the pass-through entity (PTE) is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.

Subrecipient Monitoring Program Name: Crime Victim Assistance (Assistance Listing 16.575) Federal Award Agency: Department of Justice Award Years: Federal Fiscal Years 2021, 2022, and 2023 Federal Award Numbers: 15POVC-21-GG-00615-ASSI, 15POVC-22-GG-00715-ASSI, and 15 POVC-23-GG-00433-ASSI Background The Crime Victim Assistance program provides financial support and various services and resources to crime victims, including crisis counseling, criminal justice support and advocacy, shelter, and therapy. The Judicial Branch provides grants to subrecipients to provide these services. Title 28 U.S Code of Federal Regulations (CFR) Part 94.118 provides that subrecipients shall contribute not less than 20% of the total cost of each project. Subrecipients shall derive these contributions from non-federal sources. Each subrecipient shall maintain records that clearly show the source and amount of the matching contributions.Criteria Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal control over federal awards that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 CFR Part 200.332(e) provides that the pass-through entity shall monitor subrecipient activities as necessary to ensure that they comply with federal statutes, regulations, and the terms and conditions of the subaward. Title 28 CFR Part 94.106 provides that the state administering agency shall conduct regular desk monitoring of all subrecipients as well as on-site monitoring of all subrecipients at least once every two years during the award period. The state shall maintain a copy of site visit results and other documents related to compliance. Title 2 CFR Part 200.306(b) provides that the pass-through entity must accept any cost sharing funds as part of the subrecipient’s contributions to a program when the funds are verifiable in the subrecipient’s records. Condition The Judicial Branch did not perform regular subrecipient desk reviews or site visits at least once every two years during the award period as required by federal regulations. The branch does not complete reviews until the award period ends. As a result, it did not promptly examine subrecipients’ underlying documentation such as invoices, timesheets, or support for expenditures or matching contributions. The branch’s monitoring process was limited to monthly reviews of budget-to-actual summaries. Context During the fiscal year ended June 30, 2025, the branch made $8,759,482 in reimbursements to 40 subrecipients.Questioned Costs $0Effect The Judicial Branch has limited assurance that subrecipients used federal funds for allowable activities and met the mandatory matching requirements. This could potentially lead to future disallowed costs and federal repayment obligations.Cause Due to a lack of adequate staffing, the Judicial Branch prioritized reviewing supporting documentation for prior award periods rather than the current period. Prior Audit Finding We have not previously reported this finding.Recommendation The Judicial Branch should strengthen internal controls to ensure it complies with federal subrecipient monitoring requirements for the Crime Victim Assistance program. Views of Responsible Officials “The Judicial Branch Office of Victim Services (OVS) agrees to strengthen its internal controls as described below to comply with federal subrecipient monitoring requirements for the Victims of Crime Act Assistance (VOCA) Program. In 2025, OVS performed site visits for four VOCA-funded programs and completed financial-desk reviews of monthly or quarterly financial reports for all programs. That year, OVS experienced personnel turnover in its three-employee Fiscal Services Unit, notably the separation from state service of a Program Manager and a Court Planner, who together performed OVS’ programmatic site visits of VOCA-funded programs. Also, there was a significant increase in workload resulting from OVS’ contributions to the 2024-2025 VOCA request-for-proposal process. In response, staff outside the unit contributed while managing other assigned duties, a Program Manager and Grants and Contract Specialist were hired to restore the unit to its three-employee configuration, the new employees received training on subrecipient monitoring policies and procedures, and a revised subrecipient site visit plan was developed and has begun being implemented. To strengthen internal controls, OVS has developed a revised site visit plan for the remaining VOCA-funded programs scheduled to receive site visits in 2025. April 15, 2026, is the anticipated date for OVS to complete the site visits. OVS has completed sending letters to the subrecipients operating the VOCA-funded programs. The letters request supporting documentation, which is programmatic and financial in nature, in accordance with OVS administrative policy and procedure. Also, the letters inform subrecipients that site visits will commence in accordance with a revised site visit plan.”

Subrecipient Monitoring Program Name: Temporary Assistance for Needy Families (TANF) (Assistance Listing 93.558) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Numbers: 2401CTTANF and 2501CTTANF Background The Department of Social Services (DSS) is the designated single state agency to administer Temporary Assistance for Needy Families (TANF) in accordance with Title 45 U.S. Code of Federal Regulations (CFR) Part 205.100. Connecticut administers certain aspects of TANF through several state agencies including the Department of Children and Families (DCF). DSS and DCF have a memorandum of understanding (MOU) which specifies each agency's responsibilities for administering programs in the TANF State Plan. DSS claims the state's use of federal TANF funds for home and community-based services provided to DCF's TANF-eligible clients. DCF enters into agreements with these subrecipients and pays them quarterly advances. DCF makes payments to Youth Service Bureaus claimed under the TANF program. Criteria Title 2 CFR Part 200.332(g) requires the pass-through entity to verify that subrecipients met their audit requirements for the fiscal year. Condition Our review of subrecipient monitoring over ten subrecipients that received $6,672,958 in TANF funds disclosed that DCF did not complete four annual fiscal reviews to ensure that subrecipients met their audit requirements for the fiscal year. Two of the ten subrecipients and two of the four exceptions were Youth Service Bureaus. Further review disclosed that DCF lacked procedures to perform annual reviews for Youth Service Bureau subrecipients. Context During the fiscal year ended June 30, 2025, DSS claimed $52,557,463 in DCF expenditures for various home and community-based services provided to 132 subrecipients, including $3,785,630 in expenditures for 102 Youth Service Bureau subrecipients. The sample was not statistically valid. Questioned Costs $0 Effect DSS and DCF have limited assurance that federal funds were used for allowable activities. Cause DCF experienced staffing limitations and competing priorities. DCF lacked management oversight over Youth Service Bureau subrecipients. Prior Audit Finding We previously reported this as finding 2024-024 and in two prior audits. Recommendation The Department of Children and Families should develop procedures to monitor payments to Youth Service Bureaus and strengthen internal controls to ensure compliance with the federal regulations for monitoring subrecipients of the Temporary Assistance for Needy Families program. As the lead agency for TANF, the Department of Social Services should strengthen procedures to ensure that supporting state agencies fulfill their responsibilities in their memorandum of understanding and comply with all federal TANF requirements. Views of Responsible Officials Response provided by the Department of Children and Families: “DCF agrees with this finding and will improve its internal review process to include Youth Services Bureaus and capture all subrecipients' federal single audits.” Response provided by the Department of Social Services: “The Department agrees with this finding. As the lead agency for TANF, DSS will strengthen procedures by requiring DCF to complete and share activities that verify subrecipients meet their audit requirements each fiscal year. DSS worked with an outside agency to review and enhance its subrecipient monitoring procedures. The outcome of this collaboration included training for DSS staff on subrecipient monitoring requirements, communicating expectations to subrecipients about monitoring expectations, a standardized data request, and the creation of a subrecipient monitoring toolkit to be utilized by DSS and its partners.”

Subrecipient Monitoring Program Name: Low-Income Home Energy Assistance Program (LIHEAP) (Assistance Listing 93.568) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2023, 2024, and 2025 Federal Award Numbers: 2301CTLIEA, 2301CTLIEE, 2401CTLIEA, 2401CTLIEI, 2501CTLIEA, and 2501CTLIEI Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.332 provides that the pass-through entity shall monitor subrecipient activities as necessary to ensure that they comply with federal statutes, regulations, and the subaward’s terms and conditions and ensure that they achieve performance goals and objectives. This includes a review of a pass-through entity’s required financial and performance reports. Condition Our review of subrecipient monitoring over nine Low-Income Home Energy Assistance Program (LIHEAP) subrecipients disclosed that the Department of Social Services (DSS) did not conduct annual fiscal reviews for one subrecipient. Context During the fiscal year ended June 30, 2025, DSS provided nine subrecipients with $75,417,156 of LIHEAP funds to administer the program. Questioned Costs $0 Effect DSS has limited assurance that federal funds were used for allowable activities. Cause Low staffing levels hindered the department. DSS lacks proper subrecipient monitoring procedures. Prior Audit Finding We previously reported this as finding 2024-022 and in one prior audit. Recommendation The Department of Social Services should strengthen internal controls to ensure it complies with federal subrecipient monitoring requirements for the Low-Income Home Energy Assistance Program. Views of Responsible Officials “The Department agrees with this finding and is in the process of hiring an additional staff member to assist with subrecipient monitoring. The LIHEAP unit is developing collaboration and cross-training by incorporating program liaisons to monitor portions of the financial requirements which coincide with program fuel slip monitoring reviews. The Department is creating a financial review tool to ensure consistency in the review of data to document in the financial report output.”

Subrecipient Monitoring Program Name: HIV Care Formula Grants (Ryan White HIV/AIDS Program Part B) (Assistance Listing 93.917) Federal Award Agency: United States Department of Health and Human Services Award Year: Federal Fiscal Year 2024 Federal Award Numbers: 5 X07HA00022-33-00 and 6 X07HA00022-34-01 Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.332(e) provides that the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subrecipient used the subaward for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward and ensure that they achieve performance goals. This includes reviewing financial and performance reports required by the pass-through entity. The Ryan White HIV/AIDS Program Part B Manual requires an annual on-site financial review of all subrecipients to ensure compliance with federal and state requirements and the terms and conditions of the department’s contract. Condition Our review of the Department of Public Health (DPH) monitoring procedures for six not-for-profit and one for-profit subrecipients disclosed that the department did not conduct annual on-site financial review visits for any of the six not-for-profit subrecipients. Context During the fiscal year ended June 30, 2024, DPH provided $4,262,325 to six not-for-profit subrecipients and $21,633,283 to a for-profit subrecipient for AIDS health care and support services. We selected all seven fiscal year 2024 subrecipients for review as DPH had not completed the monitoring site visits for fiscal year 2025 funds. During the fiscal year 2025, the department provided $13,216,793 to subrecipients. Questioned Costs $0 Effect DPH had reduced assurance that its subrecipients used federal funds for allowable activities. Cause The department did not complete the financial reviews for fiscal year 2024 because staff lacked proper training, which was necessary due to new federal compliance requirements and DPH’s recent implementation of new audit software. Prior Audit Finding We previously reported this as finding 2024-201 and in one prior audit. Recommendation The Department of Public Health should strengthen internal controls to ensure compliance with federal requirements for monitoring subrecipients of the Ryan White HIV/AIDS Program Part B. Views of Responsible Officials “We agree with this finding. With the implementation of the new auditing software, Management Assurance will create a comprehensive, trackable financial review program and will ensure the reviews are completed in accordance with Federal guidance. We anticipate having the software fully implemented and the financial review program operational by March 01, 2026; the financial reviewer will be trained on the software and the program requirements no later than May 01, 2026. The financial reviews will begin as soon as possible after the reviewer completes their training; we intend to have a completed financial review for all Ryan White regional leads by year-end 2026.”

Assistance Listing, Federal Agency, and Program Name - 93.855, 47.076 and 47.074 Federal Award Identification Number and Year - Research and Development Awards Pass through Entity - N/A Finding Type - Material weakness and material noncompliance with laws and regulations Repeat Finding - No Criteria - Per 2 CFR 200.332 (b) through (h), pass through entities must maintain documentation regarding initial and ongoing monitoring activities of the subrecipient to ensure that the subaward is used for authorized purposes and that performance goals are achieved. Condition - The University could not provide evidence of conducting a formal risk assessment of subrecipients, nor was there documentation showing that the subrecipient’s SAM.gov registration was reviewed or it's most recent Single Audit report. Additionally, the University did not document ongoing monitoring procedures or retain records. The University relied on information self reported by the subrecipient without independently validating or documenting the required monitoring steps. Questioned Costs - $191,442 Identification of How Questioned Costs Were Computed - Questioned costs reflect the amount of costs passed through to subrecipients under the grant in 2025 Context - The University did not follow its written policy in place over subrecipient monitoring. Cause and Effect - Failure to comply with the University's written subrecipient policy, can result in questioned costs. Recommendation - The University should ensure controls are in place to comply with the subrecipient monitoring policy on an ongoing basis. Views of Responsible Officials and Planned Corrective Actions - At the subrecipient proposal development stage, the University currently requires subrecipients to certify in writing that they are not excluded or disqualified from receiving Federal Funds, their audit status, and other compliance matters (in a Subrecipient Commitment Form or “SCF”). The University reviews such SCF, including independently obtaining and reviewing the most recent Single Audit report. If matters are noted, University staff performs additional reviews and follow up. The University will implement formal documentation requirements of such risk assessment procedures and debarment reviews for subrecipients will be added at the time a purchase requisition is initiated. Additionally, the University will add procedures to ensure that such risk assessments are reassessed annually.

Finding Reference 2025-04 Assistance Listing Number Transit Services Programs Cluster 20.513Enhanced Mobility of Seniors and Individuals with Disabilities 20.516Job Access and Reverse Commute Program 20.521 New Freedom Program Name of Federal Agency Department of Transportation Compliance Requirement Subrecipient Monitoring Type of Finding Significant Deficiency on Internal Control and Noncompliance Condition From a sample of nine (9) subrecipients, the auditors identified that for one (1) subrecipient, the Authority, did not perform subrecipient monitoring within the required three (3)-year cycle established in its State Management Plan, as of the audit period ended June 30, 2025. Although monitoring activities were scheduled for a subsequent period (2026), such actions occurred after the audit period and do not address the absence of compliance as of June 30, 2025. Criteria 2 CFR 200.332(d) requires pass-through entities to monitor the activities of subrecipients to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward. 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal control over Federal awards. FTA Circular 5010.1E (Chapter 5) states that federal oversight activities (e.g., inspections or reviews) do not relieve the recipient of its responsibility to manage and oversee federally funded projects. The Authority’s State Management Plan establishes a risk-based monitoring approach, including a three (3)- year monitoring cycle for subrecipients. Cause The Authority did not ensure that subrecipient monitoring procedures were performed and documented within the required three-year cycle for all subrecipients. Additionally, management relied on the FTA Triennial Review process as evidence of monitoring, which reflects a misinterpretation of federal requirements regarding the Authority’s responsibilities as a pass-through entity. Effect The failure to perform and document subrecipient monitoring within the established cycle increases the risk that noncompliance with federal requirements by subrecipients may not be identified in a timely manner. In addition, federal funds may not be used in accordance with applicable laws, regulations, and grant requirements. The Authority may be exposed to questioned costs, repayment obligations, or increased federal oversight. Questioned Costs None. Recommendation We recommend that the Authority: Ensure that subrecipient monitoring is performed and documented in accordance with its State Management Plan and within the established three-year cycle. Reinforce internal controls and training to clarify that federal reviews (e.g., FTA Triennial Review) do not replace the Authority’s monitoring responsibilities under 2 CFR 200. Views of Responsible Officials Refer to Management’s unaudited corrective action plan.

Reference Number: 2025-002 Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds Federal Assistance Listing Number: 21.027 Federal Agency: U.S. Department of Treasury Pass-Through Entity: N/A Federal Award Number and Year: Fiscal Year 2024-25 Name of Department with Finding: Department of Consumer and Business Affairs Name of Departments with No Findings: Chief Executive Office Aging and Disabilities Executive Office of the Board of Supervisors Department of Public Health Department of Economic Opportunity Internal Services Justice Care and Opportunities Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance; Instance of Noncompliance Criteria In accordance with Title 2 U.S. Code of Federal Regulations (CFR) § 200.332(c)(e)(f), all pass-through entities must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Condition During our audit of the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program, we selected twenty one (21) subrecipients with active contracts with the County during FY 2024-25. We noted that the Department of Consumer and Business Affairs (DCBA) did not perform subrecipient monitoring for four (4) contracts administered by the department, of which one (1) contract did not have a risk assessment performed during FY 2024-25. In addition, we selected two (2) subrecipients with total expenditures of $19,217,030 that were subjected to subrecipient monitoring compliance requirements; however, it was determined that the selected subrecipients were vendors and inadvertently included in the subrecipient population. In the SEFA, the passed through to subrecipients column for this grant was reduced by $19,217,030 to reflect this correction. This is a repeat finding of 2024-002 as it relates to the subrecipient monitoring portion of the Condition. Cause Due to limited resources, the department needed more time to complete risk assessment, monitor the CSLFRF subrecipients and document the reviews in accordance with subrecipient monitoring requirements. Effect Failure to document risk assessment and monitoring results is noncompliance with the subrecipient monitoring requirements 2 CFR § 200.332 (c)(e)(f). Questioned Costs Questioned costs were not determinable. Context Of the twenty one (21) subrecipients selected for testing, which totaled $192,086,158, from a population of ninety-seven (97) subrecipients with expenditures totaling $282,469,393, the department did not perform an annual risk assessment for one (1) subrecipient and they did not have documentary evidence supporting the monitoring of four (4) subrecipients with expenditures totaling $5,917,341. However, the department retained copies of the subrecipients’ single audit reports. The misclassification of vendors was corrected by removing them from the subrecipient expenditures, which decreased subrecipient expenditures from $301,686,423 to $282,469,393. DCBA had 7 subrecipients with total expenditures of $99,128,273 out of the total of 97 subrecipients with total expenditures of $282,469,393. The sample was not a statistically valid sample. Recommendation We recommend the County perform risk assessments and monitor the activities of its subrecipients as necessary to ensure that subawards are used for authorized purposes and maintain appropriate records for monitoring subrecipients in accordance with subrecipient monitoring requirements set forth in 2 CFR § 200.332 (c)(e)(f).

Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Section 811 - Project Rental Assistance Program Assistance Listing Number: 14.326 Federal Award Identification Number and Year: IL06RDD1201 - 2012; IL06RDD1301 - 2013; IL06RDD1901 - 2019 Pass-Through Agency: State of Illinois Pass-Through Number: IL902 Award Period: July 1, 2024 to June 30, 2025 Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-001 Failure to Adequately Monitor Subrecipients CONDITION The Illinois Housing Development Authority (Authority) did not follow its established policies and procedures for monitoring subrecipients of the Section 811 Project Rental Assistance (Section 811) program. The Authority has implemented procedures whereby program staff perform property inspections over subrecipient compliance with regulations applicable to the Section 811 program. The Authority’s policies require the subrecipient to have an inspection every three years. During our testing of the monitoring of subrecipients, we noted one of eight (13%) subrecipients (with expenditures of $319,404 during the year ended June 30, 2025) had not received an inspection within the required three-year period in accordance with Authority policy. The most recent inspection for this subrecipient was conducted in fiscal year 2019. This sample was not intended to be, and was not, a statistically valid sample. CRITERIA OR SPECIFIC REQUIREMENT According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include ensuring inspections are performed in a timely manner. CAUSE Authority management indicated there are three underlying causes for this audit finding: 1) Increased volume in required inspections - the annual volume of required inspections in fiscal year 2025 was 56% higher than the annual required inspections in fiscal year 2020 while staffing remained constant. 2) COVID-19 Waivers - In 2020, the Internal Revenue Service issued COVID-19 waivers that eliminated physical inspection requirements and allowed a calendar “reset” for Low Income Housing Tax Credit transactions until 2023. The result of the increased volume and calendar “reset” created a significant backlog of physical inspections due. 3) Inadequate controls – lack of quality control procedures to ensure the inspection reports were completed and filed appropriately. EFFECT Failure to adequately perform inspections of subrecipients may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. (Finding Code No. 2025-001) RECOMMENDATION We recommend the Authority improve its internal controls to ensure inspections are completed in accordance with established policies and procedures. AUTHORITY RESPONSE The Authority agrees with the finding. The Authority will implement additional internal controls, including quality control of completed inspection, documentation, and inspection scheduling. Additionally, the Authority recognizes that the volume of required annual inspections has increased beyond existing Full Time Equivalent (FTE) capacity; therefore, an RFP for the third-party inspection vendor has been issued to supplement internal resources and support timely completion of inspections.

Questioned Cost $ – Finding No. 2025-008: Subrecipient Monitoring (Material Weakness) State Agency: Office of Planning and Sustainable Development Federal Agency: Department of Commerce AL Number and Title: 11.419 – Coastal Zone Management Administration Awards Award Number and Award Year: NA22NOS4190022 2022 NA22NOS4190065 2022 NA23NOS4190139 2023 NA24NOSX419C0023 2024 Repeat Finding? No Condition During our audit, we tested a non-statistical sample of two subawards and found that the State did not communicate the following award information required under 2 CFR 200.332:  Subrecipient’s unique entity identifier;  Federal Award Date;  Subaward Period of Performance Start and End Date;  Subaward Budget Period Start and End Date;  Assistance Listing title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listing Number at the time of disbursement;  Identification of whether the Federal award is for research and development; and  Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with 200.414). Criteria 2 CFR Section 200.332(a) requires the State to clearly identify certain information to subrecipients at the time of the subaward, including the information specified above. Effect By not including the required information in the subaward, the State may not be providing the appropriate level of monitoring over its subrecipients. Cause and View of Responsible Officials Program personnel incorrectly classified subawards as vendor contracts. Recommendation We recommend that the management strengthen internal controls over subaward identification and monitoring subrecipients to ensure subrecipient monitoring requirements are met.

2025-004 SUBRECIPIENT MONITORING – WOIA (REPEATED) Funding agency: U.S. Department of Labor Title: Workforce Investment Act Cluster ALN Number: 17.258, 17.259, 17.278 Type of Finding: Significant Deficiency in Internal Control over Compliance; Other Non-compliance Compliance Area: Subrecipient Monitoring Award Year: Program Year 2023-2024 Question Costs: None Condition During prior year audit testing, we noted that the Department had been behind on performing monitoring controls such as quarterly desk reviews, annual on-site evaluations, and remote reviewing and testing of cost documentation. The Department had not completed fiscal or programmatic monitoring relating to Program Year 2023-2024 activity for any of its subrecipients. Due to staffing vacancies at the beginning of the fiscal year, as of January 2024, the Department had fallen approximately 2 years behind. By the beginning of fiscal year 2025, they had just completed Program Year 2022-2023 monitoring, and were thus out of compliance for a portion of the current year under audit. During the fiscal year, the Department made significant progress towards corrective action in compliance and controls over compliance for Subrecipient Monitoring over the WIOA program. Fiscal and programmatic monitoring for Program Year 2024 was substantially complete around June of 2025. We also noted that risk assessments are now being performed by the Department, rather than as selfassessments by the subrecipients. As a result of these improvements, we have lowered the type of finding from a Material Weakness to a Significant Deficiency in internal control over compliance, and from Material Non-Compliance to Other Non-Compliance. Criteria §200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the passthrough entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 Management Decision. Effect The lack of internal controls over this compliance requirement provides an opportunity for federal grant noncompliance at the subrecipient level. For monitoring controls to be wholly effective, they must be performed timely. Potential costs outside the scope of work as well as overall effective project management at the subrecipient level. There is higher risk of material misstatement, fraud, noncompliance, or errors. Cause The Department had previously not established internal controls and procedures over financial grant management to ensure compliance with applicable compliance requirements. The Department had experienced staffing turnover during prior years. These causes have since been rectified

Program: Block Grants for Community Mental Health Services Federal Financial Assistance Listing Number: 93.958 Federal Grantor: U.S. Department of Health and Human Services Pass Through: California Department of Health Care Services Award No. and Year: 68-0317191 and 2024 Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance and Instance of Noncompliance Criteria: In accordance with Title 2 U.S. Code of Federal Regulations (CFR) 200.332, pass-through entities must comply with the following: • 2 CFR Part 200.332(a), Requirements for Pass-Through Entities, states that all passthrough entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information as well as all the requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations, and the terms and conditions of the award. Condition: The following information was not provided at the time of the subaward for three (3) out of five (5) subawards selected for testing from the HCA’s Block Grants for Community Mental Health Services program • Federal Award Identification Number (FAIN) • Federal award date of award to recipient by the Federal Agency • Identification of whether or not the award is R&D • Indirect cost rate for the Federal award (including if the de-minimus rate is charged) Cause: The HCA’s procedures did not consistently ensure that the required award information and applicable requirements were communicated to the subrecipients at the time of subaward. Effect: The County’s control policies were not consistently followed which require compliance with the Subrecipient Monitoring requirements as found in 2 CFR 200.332. Questioned Costs: No questioned costs were identified as a result of our audit procedures. Context/Sampling: A nonstatistical sample of three (3) of five (5) subrecipients were sampled. The condition noted above was identified during our procedures related to subrecipient monitoring. Repeat Finding from Prior Years: No. Recommendation: We recommend that the County adhere to their policies and procedures in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements. Views of Responsible Officials: See separately issued Corrective Action Plan.

Program: Homeland Security Grant Program Federal Financial Assistance Listing Number: 97.067 Federal Grantor: U.S. Department of Homeland Security Pass-Through Entity: California Governor’s Office of Emergency Services Award No. and Year: Multiple Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: Title 2 of the U.S. Code of Federal Regulations (CFR), Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.332, requires that pass-through entities: • Evaluate the risk of noncompliance with a subaward to determine the appropriate monitoring. • Verify every subrecipient is audited as required by Uniform Guidance, issue management decisions for audit findings, as applicable, and ensure the subrecipient take timely corrective action on all audit findings, as applicable. • Verify whether the subrecipient is suspended, debarred, or otherwise excluded before entering into a covered transaction. Condition: For two (2) out of two (2) subrecipients selected for testing, the subrecipient risk assessments were not performed by the department and the subrecipient was not checked for suspension or debarment prior to entering into the agreement. For one (1) out of two (2) subrecipients selected for testing, evidence could not be provided to verify the County reviewed the subrecipient’s single audit report to ensure timely corrective action was taken on audit findings, as applicable. Cause: Internal controls were not in place to ensure compliance with subrecipient monitoring requirements. Effect: Ineffective controls over this area of compliance could result in noncompliance occurring for a subrecipient and not being detected. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of two (2) subrecipients out of a population of two (2) was selected for testing. Repeat Finding from Prior Years: No Recommendation: We recommend the department enhance internal controls to ensure compliance with subrecipient monitoring requirements Views of Responsible Officials: See separately issued Corrective Action Plan.

U.S. DEPARTMENT OF HOMELAND SECURITY Finding Number 2025-048 Assistance Listing Number and Title 97.067 – Homeland Security Grant Program (HSGP) Compliance Requirement Subrecipient Monitoring State Entity Florida Division of Emergency Management (FDEM) Federal Grant/Contract Number and Grant Year EMW-2021-SS-00056 (2021) Statistically Valid Sample No Finding Type Noncompliance and Significant Deficiency Finding The FDEM did not always evaluate subrecipient risk to determine the appropriate subrecipient monitoring or conduct subrecipient monitoring. Criteria 2 CFR 200.332 – Requirements for pass-through entities – All pass-through entities must evaluate each subrecipient’s fraud risk and risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals and objectives are achieved. Condition According to FDEM management, subrecipients with subawards funded by the HSGP grant that closed on August 31, 2025, were to be monitored during the 2024-25 fiscal year. According to FDEM, 63 subrecipients with subawards totaling approximately $31.5 million in HSGP funds were monitored during the 2024 25 fiscal year. However, our inquiries of FDEM management and examination of FDEM monitoring records for 7 selected subrecipients disclosed that the FDEM neither evaluated fraud risk or the risk of noncompliance for 2 of the 7 subrecipients nor conducted required monitoring. Cause According to FDEM management, required risk assessment and monitoring activities were not completed due to an administrative oversight. Effect Absent an evaluation of each subrecipient’s fraud risk and risk of noncompliance, and monitoring of all subrecipients based on the results of the risk assessment, the FDEM cannot ensure that subawards are used for authorized purposes in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals and objectives are achieved. Recommendation We recommend that FDEM management enhance controls to ensure that subrecipient monitoring is performed based on an assessment of each subrecipient’s risk in accordance with Federal regulations. State Entity Response We concur. The risk assessment and monitoring activities did not occur for the 2 subrecipients identified. We will enhance internal controls to ensure monitoring is consistently performed and documented.

Condition We selected a non-statistical sample of three subrecipients and noted that the Department did not perform site-visits for two subrecipients as required by the Department’s policy and procedures. Criteria Pursuant to 2 CFR 200.332(d), pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Effect Failure to monitor subrecipients increases the risk that noncompliance at the subrecipient level goes undetected. Cause and View of Responsible Officials Although the Department has established policies and procedures in place over the application process and determination of assistance amount, there was a lack of diligence in complying with the policies and procedures. Recommendation We recommend that program management ensure that program personnel are familiar with all grant requirements, including those specified under the Criteria section above. Additionally, we recommend that the Department diligently comply with its policies and procedures.

Condition We selected a non-statistical sample of three subrecipients and noted that in each case, the Department did not perform required during-the-award monitoring of its subrecipients. In addition, the Department did not verify that that subrecipients were audited if required by 2 CFR Part 200, Subpart F. Criteria Pursuant to 2 CFR 200.332(d), pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pursuant to 2 CFR 200.332(f), pass through entities must verify that subrecipients expected to be audited as required by 2 CFR Part 200, Subpart F, met this requirement. Effect Failure to monitor subrecipient activities or verify that subrecipients have completed their required Single Audits increases the risk that noncompliance at the subrecipient level goes undetected. Cause and View of Responsible Officials The issue occurred during a period of staff transition, during which roles were assumed without the benefit of documented procedures, formal training, or established prior practices. Recommendation We recommend that the Department establish formal written policies and procedures to ensure that the required during-the-award monitoring is performed and the required subrecipient Single Audit reports are obtained and reviewed, including appropriate follow up on any relevant audit findings.

Finding 2025-001 Subrecipients Federal Agency: United States Department of Justice Federal Program: Edward Bryne Memorial Justice Assistance Grant Program Assistance Listing Number: 16.738 Award Identification Number: 2019-YA-BX-K002 Criteria or Specific Requirement: CFR § 200.332, "Requirements for pass-through entities", requires pass-through entities to evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: During our audit, we noted that the pre-award risk assessment was not performed until November 2024, subsequent to the subaward being signed with the subawardee. Based on our discussions with management, the process for performing pre-award risk assessment for subrecipients and determining and documenting the appropriate level of ongoing monitoring for subrecipients was implemented in November 2024. We also noted that the Association did not perform the FFATA (Federal Funding Accountability and Transparency Act) reporting requirements. Cause: During 2025, the Association's finance department turned over significantly, resulting in oversight of the compliance requirement. Effect or Potential Effect: The Association could inadvertently engage in relationships with subrecipients of higher risk without the appropriate level of oversight (i.e. monitoring) to ensure subrecipients are expending funds in accordance with the provisions and terms of the subaward. Questioned Costs: None noted. Context: Our audit procedures in this area consisted of substantive testwork over a sample of subrecipient expenditures that were selected based on a defined threshold. We consider our sample to be representative of the populations, and thus, is a statistically valid sample. The issue is deemed to be systemic. Identification as a Repeat Finding, if Applicable: 2024-001 Recommendation: We recommend that the Association strictly adhere to its current subaward policy and ensure the risk assessment procedures over all of its subrecipients are performed and documented prior to engagement. Based on these risk assessments, the Association should assign a risk level to each, and then determine the monitoring tools to apply based on these risk levels.

Finding Number - 2025-006 Late vendor credits Agency Department of Health & Human Services Federal Program Medicaid Cluster ALN 93.778 Compliance Requirement Cost Principles Type of Finding Internal Control over Compliance / Compliance Category Other Criteria In accordance with the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 2 CFR §200.305(b)(1) requires that pass-through entities ensure payments to subrecipients are made in a timely manner, generally within a reasonable period after receipt of a valid request for payment. Federal guidance and established administrative practice interpret a reasonable period for purposes of cash management compliance to mean no later than 30 calendar days following receipt of a proper payment request, unless the pass-through entity reasonably determines the request to be improper. This requirement applies regardless of whether the federal award operates on a reimbursement basis and is intended to ensure compliance with federal cash management standards and minimize the time between disbursement of funds and federal reimbursement. Criteria – (continued) For Medicaid program (Assistance Listing 93.778), CMS regulations further require that expenditures claimed for Federal Financial Participation (FFP) be based on actual, incurred, and properly documented costs in accordance with 42 CFR §433.32 and applicable CMS financial management guidance. CMS oversight emphasizes timely payment and proper cash management practices to ensure that expenditures are valid and that federal funds are drawn only for allowable and properly incurred costs. Additionally, 2 CFR §200.332(a) requires pass-through entities to monitor subrecipients and ensure compliance with applicable federal requirements, including adherence to cash management provisions. Condition During testing of subrecipient disbursements, it was noted that six (6) payments included in the sample of 178 were made more than 30 calendar days after the pass-through entity received a valid request for payment from the subrecipient. The delays ranged from 46 to 150 days beyond the regulatory requirement. Item No. Check Date (Voucher id) Invoice Date Audited Amount 1 1/24/2025 00536685 12/4/2024 $ 1,458 2 5/23/2025 00553562 12/23/2024 $ (1,321,563) 3 5/23/2025 00553519 12/23/2024 $ 2,111 4 5/23/2025 00553562 4/1/2025 $ (220,261) 5 7/23/2024 00515301 6/7/2024 $ 5,876 6 7/23/2024 00515303 6/7/2024 $ 8,911 Also, we identified two (2) instances in which vendor credits related to previously issued invoices were not applied to the corresponding invoices until approximately one (1) to three (3) months after the original drawdown was requested. Item No. Invoice number Invoice date Credit amount Drawdown not including credit Date credit return Days 1 RF VITAL 25-003 12/27/2024 $ (1,321,563) 1/13/2025 6/3/2025 -141 2 RF VITAL 25-006 4/10/2025 $ (220,261) 4/28/2025 6/3/2025 -36 Cause The delays in payment were primarily attributable to internal cash management and administrative practices, including the practice of awaiting the receipt of federal funds or internal approvals prior to issuing payment to the subrecipient. These practices were not aligned with the timing requirements established under Uniform Guidance. Management indicated that the Program waits until sufficient positive fund balances are available before processing the return of outstanding credits. As a result, certain credit balances may remain pending until adequate funds are available to complete the reimbursement. This practice may delay the timely return of funds in accordance with applicable requirements. Effect Failure to remit payment to subrecipients within the required 30-day timeframe. Continued noncompliance may increase the risk of: a) Audit findings under the Uniform Guidance, b) Increased federal oversight, c) Potential questioned costs, and d) Strained financial operations for subrecipients due to delayed reimbursement. The delayed application of credits resulted in temporary overstatements of expenditures used to support Federal drawdowns. Although the credits were eventually applied, the timing difference may result in noncompliance with cash management requirements under 2 CFR §200.305, as Federal funds may have been drawn in excess of immediate cash needs. Questioned Costs None Perspective Information This finding was identified during the audit of the Medicaid program (Assistance Listing 93.778) for the fiscal year ended 2025. The payments tested related to expenditures incurred and invoiced by a state agency acting as a subrecipient under an interagency agreement. Although both the pass-through entity and the subrecipient are agencies within the same state government, federal regulations treat them as distinct entities for purposes of cash management compliance. Prior Year Audit Finding This is not a prior year finding Recommendation It is recommended that the pass-through entity strengthens internal controls over subrecipient payments to ensure that all valid requests for payment are processed and paid within the 30-calendar-day timeframe required by 2 CFR §200.305(b)(1). Management should also ensure that payment procedures are not contingent upon the timing of federal drawdowns and that any delays are adequately documented and communicated to the subrecipient. We recommend that management strengthen internal controls over the drawdown process by implementing a formal review procedure to verify that all outstanding vendor credits have been identified and applied prior to submitting a Federal draw request. Views of Responsible Officials and Planned Corrective Actions The PRDH’s management agrees with this finding. Please refer to the corrective action on pages 57-60.

Finding Number: 2025-012 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Allowable Cost/Cost Principles Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(b), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward. The following is a partial listing of the information a pass-through entity must provide when available: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient’s unique entity identifier (UEI). Condition and Context: ALA reviewed five broadband infrastructure projects totaling $39,789,080, from a total of 20 broadband infrastructure projects totaling $127,227,854, and noted the grant awards had been issued to internet service providers (ISPs) with a unique entity identifier; however, the ISP was not always the entity that would construct and own the broadband network. Several of these ISPs were wholly owned subsidiaries of electric cooperatives, which have a different unique entity identifier. ALA reviewed 247 invoices associated with 15 reimbursement requests and noted 173 invoices totaling $10,793,988 in which the expenses submitted for reimbursement were incurred and paid by the electric cooperative instead of the ISP. ALA also noted 6 instances totaling $3,364,595 in which the reimbursement payments related to these invoices were made to the electric cooperative instead of the ISP. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Arkansas State Broadband Office (ASBO) did not execute the grant agreements with the party that would have ownership of the broadband network when the project was complete. Effect: Failure to ensure grant agreements are executed with the appropriate subrecipient could lead to the submission of expenses and payments that are improper. Recommendation: ALA staff recommend the Agency ensure the subrecipient in the grant agreement is the party that will construct and own the broadband network when it is complete. Doing so will ensure the subrecipient is able to submit and be reimbursed for expenses incurred and place the liability for completion of the project with the appropriate party. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation regarding the execution of subaward agreements with ISP entities that are wholly owned subsidiaries of electric cooperatives and the related affiliate payment structure. Subaward agreements were executed with legally distinct ISP entities holding unique entity identifiers (UEIs) and responsible for performance under the Capital Projects Fund (CPF) award. In certain instances, affiliated parent entities processed invoice payments as part of established intercompany accounting practices. These arrangements reflected corporate structure and operational efficiencies rather than an intent to shift accountability or bypass program requirements. ASBO notes that no questioned costs were identified and that project deliverables were completed in accordance with the terms of the award. The ISP entities remained responsible for reporting, certification, and compliance under the executed agreements. ASBO recognizes, however, that clearer documentation of intercompany payment flows would strengthen audit traceability and reduce ambiguity regarding which legal entity incurred and paid specific costs. To enhance documentation clarity, ASBO will require subrecipients with affiliated entities to maintain documented intercompany reconciliations where applicable and will update subaward templates to further clarify entity-level responsibility for payment, ownership, and record retention. Internal review procedures will also be reinforced to ensure alignment between invoicing practices and designated subrecipient entities. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding Number: 2025-014 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Matching, Level of Effort, and Earmarking Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(b)(2), a pass-through entity must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes all requirements of the subaward, including requirements imposed by federal statutes, regulations, and the terms and conditions of the federal award. Arkansas State Broadband Office (ASBO) procedures also require any special conditions to be disclosed in the grant agreement. Condition and Context: Federal guidelines do not require cost sharing or matching funds; however, ASBO procedures require a minimum match of 25%. The specific amount of matching required above can vary with each project. A proposed matching amount is submitted by each applicant for a project and evaluated as part of the award process. ASBO did not include the final required matching amount in the grant agreement. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: ASBO management did not include required matching amounts in the grant agreement. Effect: Failure to include all significant terms in the grant agreement could result in a subrecipient’s noncompliance due to lack of knowledge and understanding of required responsibilities. Recommendation: ALA staff recommend the Agency include all significant terms (including required matching amounts) in the grant agreement. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation regarding the inclusion of required matching amounts in the executed grant agreements. The Capital Projects Fund (CPF) program does not require cost sharing or matching funds under federal guidance. However, the Arkansas State Broadband Office (ASBO) incorporated a minimum match expectation as part of its state-level program design and evaluation process. Proposed match commitments were submitted by applicants and evaluated during the award process. ASBO recognizes that the final required match amount was not expressly stated in the executed grant agreement. While match expectations were documented during application review and award evaluation, ASBO agrees that explicitly including the finalized match requirement in the executed agreement would provide greater clarity and reduce ambiguity. ASBO notes that no questioned costs were identified in connection with this finding. ASBO will update its grant agreement templates to ensure that any state-imposed matching requirements are explicitly incorporated into the final executed agreement. This enhancement will ensure alignment between program evaluation criteria and formal award documentation going forward. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding Number: 2025-016 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Subrecipient Monitoring Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(e), a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. As outlined in the Uniform Guidance at 2 CFR Part 200, Subpart E regarding Cost Principles, allowable costs must meet the following criteria: (1) be necessary, reasonable, and allocable for the performance of the federal award, (2) be accorded consistent treatment as either a direct cost or indirect cost, and (3) be adequately documented. Condition and Context: The broadband infrastructure grants are for the construction and deployment of broadband infrastructure projects designed to deliver, upon project completion, service that reliably meets or exceeds symmetrical download and upload speeds of 100 Mbps. When construction and deployment are completed, the subrecipient notifies the Arkansas State Broadband Office (ASBO) in writing. ASBO has contracted with a third-party vendor to perform a technical close-out, which involves field visits and the issuance of a letter to confirm the work has been completed in accordance with the grant agreement. ALA reviewed 5 of 20 projects and noted that 1 project reviewed was not properly closed out. The project was completed in October 2024, and a technical close-out letter was issued in December 2024. In October 2025, the subrecipient requested permission to perform equipment upgrades to the network, and the third-party contractor rescinded the close-out letter, allowing additional expenses of $2,096,990 to be submitted for reimbursement. As indicated in the technical close-out letter issued in December 2024, these upgrades were not necessary for completion of the network in accordance with the grant agreement. Once the network has been completed, any further costs incurred are considered maintenance costs and are the responsibility of the subrecipient. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $2,096,990 Cause: ASBO management did not ensure that only expenses necessary for performance of the federal award were included as allowable costs. Effect: Failure to properly close-out grants in compliance with Agency procedures could result in reimbursement of expenses that are unallowable. Recommendation: ALA staff recommend the Agency follow close-out procedures and ensure maintenance expenses incurred after the completion of the project are not included as allowable costs. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation regarding the sequencing of the technical close-out letter and subsequent expenditures for one project. ASBO respectfully clarifies that a Technical Close-Out Letter reflects that the primary network infrastructure has been constructed and service capability established. It does not necessarily signify final project completion for all eligible cost components under the grant agreement. Project completion for reporting purposes occurs upon final reporting to the U.S. Department of the Treasury. In October 2025, the subrecipient requested approval to perform additional network equipment upgrades using remaining grant funds. ASBO obtained written confirmation from the U.S. Department of the Treasury Senior Federal Program Officer that the identified OLT upgrade constituted an eligible network component necessary to deliver service and was not maintenance. No additional grant funds were awarded for this work; the proposal involved remaining grant balances. It should be noted that as of the date of audit review, no expenses had been incurred related to the proposed upgrade. As such, ASBO does not concur that the identified $2,096,990 represents ongoing maintenance costs or unallowable expenditures. In fact, all reimbursements to date include eligible network build-out costs incurred prior to “technical closeout” but financially processed after that date, or fiber-to-the-home (FTTH) drops. FTTH drops have been an allowable expense in the Arkansas CPF Program following technical closeout yet prior to reporting the project complete to U.S. Treasury. The misclassification of these costs as maintenance appears to stem from an assumption that they were related to the proposed network upgrade, when in actuality, they were not. To avoid ambiguity in future projects, ASBO will formalize procedures clarifying the distinction between technical close-out, formal project completion, and eligible use of remaining funds. Any Treasury-approved scope clarifications or post-close-out adjustments will be formally documented prior to reimbursement to ensure alignment between technical certification and financial reporting. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding Number: 2025-017 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Subrecipient Monitoring Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(e), a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. Condition and Context: Arkansas State Broadband Office (ASBO) procedures require subrecipients to maintain an irrevocable standby letter of credit equal to 100% of the grant award amount disbursed. The irrevocable standby letter of credit must be accompanied by an opinion letter from the subrecipient’s legal counsel stating the letter of credit and its proceeds will not be subject to a Chapter 11 bankruptcy proceeding. The letter of credit must remain in place until the project is completed. In lieu of a letter of credit, the subrecipient may furnish a performance bond in an amount equal to the grant award. ALA reviewed 5 of 20 projects to determine if the letter of credit or performance bond for the appropriate amount was properly maintained by the subrecipient. ALA noted that a letter of credit was not maintained for the required amount for 1 of the 5 projects reviewed. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: ASBO management did not adequately monitor subrecipients to ensure compliance with letter of credit requirements. Effect: Failure to properly monitor subrecipients could result in noncompliance with federal laws and regulations. Recommendation: ALA staff recommend the Agency ensure subrecipients maintain a letter of credit in accordance with ASBO requirements. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation that, for one project reviewed, the required irrevocable standby letter of credit was not maintained at the full amount required under ASBO procedures. ASBO recognizes that ongoing monitoring of letter of credit requirements is an important safeguard to ensure subrecipient compliance and protect program funds. No questioned costs were identified in connection with this matter. ASBO has implemented enhanced monitoring procedures to verify and document that required letters of credit or performance bonds are maintained at the appropriate level throughout the project period. This includes periodic verification and documented review to ensure continued compliance with program requirements. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding 2025-005: CDBG Subrecipient Monitoring At Metro Government’s Office of Housing and Community Development (“OHCD”) Needs Improvement Federal Program: ALN 14.218 Community Development Block/Entitlement Grants Name of Federal Agency: U.S. Department of Housing and Urban Development Award Identification Number and Year: B-21-MC-21-0008, B-22-MC-21-0008, B-20-MC-21-0008, B-18-MC-0008, B-23-MC-21-0008, and B-24-MC-211-008 Name of pass-through entity: N/A COVID Identification: No Amount of Questioned Costs: N/A Compliance Requirement: Subrecipient monitoring Criteria:The Metro Government Subrecipient Management Policy Manual states, “Title 2 CFR 200.332 requires all pass-through entities to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations and the terms and conditions of the subaward to determine the appropriate monitoring needed to ensure Federal funds are used properly. Passthrough entities are not required to complete a risk assessment on contractors. Metro agencies must complete risk assessments on all subrecipients no less than annually.” 2 CFR 200.332(c) states, “Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a pass-through entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also received Federal awards directly from the Federal agency).” Condition: During FY 2025, a total of $9,780,961 in CDBG funds were distributed to 21 subrecipients by Metro Government. Monitoring these subrecipients was conducted by two offices. The Office of Social Services (“OSS”) monitored 11 subrecipients totaling $5,306,082. The Office of Housing and Community Development (“OHCD”) was responsible for monitoring 10 subrecipients totaling $4,474,879. OSS is responsible for monitoring the subrecipients that have subawards for CDBG operating and service projects. OSS completes the following procedures when monitoring their subrecipients: completing a risk assessment spreadsheet, maintaining a historic log documenting the dates of when each subrecipient was monitored, and desk reviews and/or site visits. High risk subrecipients are monitored more frequently compared to those assessed at a lower risk. Subrecipients are required to be monitored at least once every three years. The OHCD is responsible for monitoring subrecipients that have subawards for CDBG capital projects. OHCD conducts informal, undocumented risk assessments of subrecipients. No site visits were conducted in fiscal year 2025. Effect: The OHCD did not adequately monitor its subrecipients during fiscal year 2025. Cause: The OHCD did not have a designated individual responsible for subrecipient monitoring during fiscal year 2025. Recommendation: We recommend the OHCD adopt the procedures and documentation practices established by OSS. Specifically, this includes conducting site visits, assessing each subrecipient’s risk of noncompliance, performing desk reviews and site visits, and maintaining comprehensive documentation of risk assessment and monitoring activities.

Finding #2025-001: #84.048 -Career and Technical Education - Basic Grants to States Federal Grantor Agency: U.S. Department of Education Compliance Requirement: Subrecipient Monitoring Condition: During our audit procedures, we noted that the District does not have formal, written procedures governing subrecipient monitoring. Although the District reviews supporting documentation—such as invoices—submitted by subrecipient schools prior to submitting claims to the Department of Public Instruction (DPI), these practices are not documented in an established policy or procedure. Criteria: Uniform Guidance (2 CFR 200.331–200.332) requires pass-through entities to establish and implement written procedures for monitoring subrecipients to ensure compliance with federal program requirements and achievement of performance goals. Cause: The District has not developed or implemented formal written policies and procedures for subrecipient monitoring. Effect: In the absence of formalized procedures, the District’s monitoring practices may be applied inconsistently, increasing the risk of unallowable costs, noncompliance with federal requirements, or misunderstandings between the District and its subrecipients. This could lead to questioned costs or administrative issues during oversight by DPI or other regulatory bodies. Recommendation: We recommend that the District develop and adopt formal written procedures outlining its subrecipient monitoring activities. These procedures should clearly describe monitoring responsibilities, required documentation, review steps, communication expectations, and follow-up actions. Implementing a formalized process will help ensure consistent oversight and compliance with federal regulations. Grantee Response: The District will develop and implement written procedures that outline the required monitoring steps, documentation standards, communication protocols, and follow-up expectations for subrecipient oversight. These procedures will align with the requirements of Uniform Guidance and DPI expectations.

Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Home Investment Partnerships Program Assistance Listing Number: 14.239 Federal Award Identification Number and Year: M24-MC-51-0001, 2024 Award Period: 10/1/2023 to 9/30/2033 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control, Other Matter Criteria or Specific Requirement: Internal Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintaineffective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and theterms and conditions of the Federal award. These internal controls should comply with guidance in“Standards for Internal Control in the Federal Government” issued by the Comptroller General of theUnited States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: 2 CFR §200.332(a) - Requirements for Pass-Through Entities states, in part, that all passthrough entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward: (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated in the subaward; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; (xiii) Identification of whether the Federal award is for research and development; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with § 200.414). Condition: The City did not furnish the information below to subrecipients at the time the subawards were issued: a. Federal Award Identification Number (FAIN) b. Subaward Budget Period Start and End Date c. Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA) d. Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity e. Assistance Listings title and number f. the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement g. Identification of whether the Federal award is for research and development. Questioned Costs: None Context: The City failed to include the required information as noted above in the subrecipient agreements. Cause: The City failed to include all required information in the subrecipient agreements. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about program-specific regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in subrecipients’ Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Repeat Finding: No Recommendation: The City should review and enhance its internal controls and procedures to ensure that all required information is included in subawards at the time of issuance and maintained in subsequent modifications. Views of Responsible Officials: There is no disagreement with the audit finding and the City will undertake additional training for departments in FY 2026, to include providing departments with a grants responsibility checklist.

2025-004-Subrecipient Monitoring Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Assistance Listing Number: 21.027 Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance (Modified Opinion) Criteria: Per 2 CFR sections 200.332(d) through (f), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves the performance goals. Per 2 CFR section 200.502(a), the determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs which is generally expenditure/expense transactions associated with awards. Condition: During our testing over subrecipient monitoring, the County was unable to provide subrecipient monitoring support. Questioned Costs: None Context: We selected a sample of 7 subrecipients as part of our testing over Subrecipient Monitoring. Of the 7 subrecipients selected, the County was unable to provide adequate support for the subrecipients selected. Cause: The County has policies that require departments to conduct subrecipient monitoring to ensure compliance with grant requirements. However, the policy does not include documentation of these monitoring activities, such as site visits, financial reviews, or performance evaluations. This lack of documentation results in an inability to verify that subrecipient monitoring is being performed effectively and consistently. Effect: Without proper oversight, subrecipients may fail to achieve program goals and objectives, leading to poor performance and outcomes for the funded programs. Repeat Finding: Yes Recommendation: We recommend that the County implement procedures to ensure that federal guidance is followed related to subrecipient monitoring and provide training on these procedures, including maintaining documentation of the review performed by the County. View of Responsible Officials: There is no disagreement with the audit finding.

2025-001 Subrecipient Monitoring Program Information Federal Organization U.S Department of Health and Human Services Assistance Listing Number 93.912 Rural Health Care Services Outreach, Rural Health Network Development, and Small Health Care Provider Quality Improvement Award Numbers GA1RH33517, G28RH46280 Criteria [X] Compliance Finding [ ] Significant Deficiency [X] Material Weakness Title 2 U.S. Code of Federal Regulations (CFR) 200.332 requires that passthrough entities monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. Pass-through entities must review financial and performance reports, to ensure the goals and objectives of the awards are achieved and are required to verify that subrecipients are audited as required by Uniform Guidance, when applicable. Condition During our testing of subrecipient monitoring, we noted that the Network does not have any documented policies and procedures regarding the monitoring of subrecipients. Monitoring activities performed were not sufficient to ensure subrecipient compliance with federal statutes, regulations, and the terms and conditions of the subawards. This finding appears to be a systemic problem. Cause Management does not have a documented policy for monitoring its subrecipients and ensuring the requirements for pass-through entities are met. Effect Without a documented policy to monitor subrecipients, there is an increased risk that noncompliance or performance issues at subrecipients may not be timely identified, addressed, or documented. This may result in the Network being noncompliant with Uniform Guidance and could result in questioned costs and adversely impact the Network’s federal funding. Questioned Costs None noted. Context In a sample of 2 out of 7 subrecipients, we noted that the Network’s monitoring procedures were limited to the review and approval of expenditures based on subrecipient invoice submissions and quarterly performance reports provided by the subrecipients. Recommendation We recommend that the Network develop and implement formal written policies for monitoring subrecipients. These policies should specify both financial and programmatic monitoring procedures, including annual risk assessments for all subrecipients. Based on the assessed level of risk, the Network should perform additional monitoring activities as appropriate, such as trainings, site visits, or enhanced oversight. In addition, we recommend that the Network establish procedures to track, document, and follow up on all monitoring activities, including audit findings and related corrective actions. Views of responsible officials and planned corrective action Management agrees with 2025-001 Subrecipient Monitoring on the schedule of findings and questioned costs. KCHN did not consistently perform and/or document required subrecipient monitoring activities.

Finding Number: 2025-002 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2024 – June 30, 2025 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City has not implemented the designed controls and procedures to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated and level of monitoring is determined. • Appropriate monitoring and review of the subrecipient based on their risk of noncompliance. • Ensure that subrecipients are not suspended or debarred prior to entering into a contract with the City. Cause The City does not have formal written policies, procedures, and internal controls in place to ensure that all required subrecipient monitoring procedures are performed.Proper perspective During our audit, we noted that four of the four subrecipients selected for testing did not have a completed risk assessment to determine their risk of noncompliance. As such, we were unable to determine that the proper level of monitoring was completed throughout the fiscal year over the contracted subrecipient. Additionally, there was no evidence that the City ensured the subrecipient was not suspended or debarred from working under a federal engagement prior to entering into the contract. Possible asserted effect Lack of effective controls over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2024-003 Recommendation We recommend the City establish a checklist or formal documentation to assess each subrecipient and their risk of non compliance prior to entering into a formal contract. The City should then use this risk assessment to determine the level of monitoring that is required throughout the term of the contract. Views of responsible officials and corrective actions The City has established a Risk Assessment tool that rates each HOPWA subrecipient across nine factors: 1) award amount, 2) timeliness of reporting, 3) timeliness of invoicing, 4) quality of reporting, 5) program complexity, 6) staff capacity, 7) staff turnover, 8) management changes, and 9) grantee history. The City will use this tool to determine the appropriate level and frequency of monitoring for each subrecipient.

Finding Number: 2025-005 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2024–June 30, 2025 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have effective controls in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated and level of monitoring is determined. • Verification and review that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. • All required elements of the subrecipient contracts are included during execution. Cause The City’s lack of effective internal controls which caused the following noncompliance and control exceptions.Proper perspective During the audit, we noted that six of the nine subrecipient selections did not contain all the required elements of the contract. Additionally, for nine of the nine selections, the City did not complete a risk assessment or conclude on the subrecipient's risk of noncompliance. We also noted that for two of the subrecipients that required a single audit, there was no evidence to support the nature and extent of the City's review of those audit reports. Therefore, we were unable to determine, based on the subrecipient's risk assessment and single audit reports, the proper level of monitoring procedures to be performed. Possible asserted effect Lack of effective controls over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding Yes, 2024-009 Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining and reviewing the documentation. The City should then conclude on and document the subrecipient’s risk of noncompliance based on the checklist to ensure the proper level of monitoring occurs throughout the year. Views of responsible officials and corrective actions The city already established a well-designed internal control manual of policies and procedures over the ARPA grant's full cycle grant management, as well as various templates to evaluate the subrecipients' risks and monitoring their performances. In FY26, the city will implement its internal control by conducting timely subrecipient monitoring activities with signed documents

Finding No. 2025-043 Federal Awarding Agency: USDOC Impact: Significant Deficiency, Noncompliance AL Number and Title: 11.438 PCSRT Federal Award Number: NA24NMFX438G0056 Applicable Compliance Requirement: Subrecipient Monitoring Condition: A review of six FY 25 PCSRT subrecipients’ subaward agreements found that one did not include an accurate unique entity identifier (UEI) that matched the subrecipient’s name. Context: All federal award recipients are required to have a UEI. DFG enters into awards with subrecipients using a subaward agreement. The subaward agreement lists the federal requirements that pertain to the subaward and must identify the subrecipient’s UEI. The audit reviewed six subaward agreements, and found that one contained an incorrect UEI. Cause: The finding was caused by human error. In preparing the subaward agreement, staff copied and pasted the UEI from a different subrecipient’s information. Supervisory review procedures were insufficient to detect and correct the error. Criteria: Title 2 CFR 200.332 requires pass-through entities to ensure that every subaward includes the required information at the time of the subaward. Required information includes the subrecipient’s name, which must match the name associated with the subrecipient’s UEI. Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal controls over federal awards that provide reasonable assurance that the State is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Effect: Not providing the correct UEI number hampers subaward reporting and may limit federal oversight of the PCSRT program. Questioned Costs: None Recommendation: DFG’s Commercial Fisheries Division director should strengthen supervisory review procedures to ensure federally required information is accurately identified in PCSRT subaward agreements. Views of Responsible Officials: ADFG disagrees with this finding. During the audit, it was noted that the UEI listed in the subaward agreement contained a copy-and-paste error. This discrepancy was promptly corrected once identified. Under 2 CFR 170, the official compliance requirement for subaward reporting is the Federal Funding Accountability and Transparency Act (FFATA) submission through SAM.gov. In this case:  The correct UEI was verified in SAM.gov.  The FFATA report contained the correct UEI and was submitted timely.  The correct subrecipient was paid, and supporting documentation confirmed the subrecipient’ s identity. These facts demonstrate that the federal reporting requirement was met and that the error was limited to the internal agreement. The issue did not result in improper payments, misreporting to federal systems, or a breakdown in internal controls. This was an isolated clerical error that was promptly corrected during the audit. It does not represent a significant deficiency or material weakness. This seems more appropriately categorized as a minor observation or management comment regarding document review processes. Auditor’s Concluding Remarks: Management’s response did not persuade the auditor to revise the finding. DFG management asserts the unique entity identifier number incorrectly recorded in the subaward agreement was correctly reported to sam.gov. However, the reporting of the subaward to sam.gov is a reporting requirement. DFG management is responsible for complying with federalsubrecipient monitoring requirements. We reaffirm the finding.

Finding No. 2025-031 Prior Audit Finding: 2024-037 Federal Awarding Agency: USDHS Impact: Material Weakness, Material Noncompliance AL Number and Title: 97.036 Disaster Grants 97.036 Disaster Grants – COVID-19 Federal Award Number: 4533DRAKP00000001, 4730DRAKP00000001 Applicable Compliance Requirement: Subrecipient Monitoring Condition: A review of 21 FY 25 Disaster Grants subrecipient obligating award documents (OAD) found that three did not include an accurate unique entity identifier (UEI) that matched the subrecipient’s name and one did not provide a UEI. Context: DMVA enters into awards with subrecipients using the OAD as the subgrant agreement. The subrecipient’s name and UEI are recorded on the OAD. An assurances and agreement form accompanies the OAD that includes additional federal requirements not included in the OAD. Subrecipients sign the OAD and the assurances and agreement forms certifying and agreeing to the federal requirements. According to DHSEM management, due to the high number of State disasters and a lack of staff resources, contractors were hired to help evaluate applicant eligibility, make subawards, conduct risk assessments, and monitor accordingly. The audit reviewed a random sample of 20 of 100 subrecipient OADs and one judgmentally selected OAD, including assurances and agreement forms, and found two OADs for one subrecipient in which the subrecipient’s name did not match the name associated with the UEI number provided; one OAD reported a UEI number that did not match the name and address when verified with the federal reporting website; and one OAD did not include a UEI number. Cause: According to DHSEM management, due to competing priorities and inadequate supervisory review procedures, DHSEM staff and contractors did not ensure subrecipient’s OADs included a UEI number or an accurate UEI number. Criteria: Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal control over the federal award that provides reasonable assurance that the State is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the grant awards. Title 2 CFR 200.332 requires pass-through entities ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the required information at the time of the subaward. Required information includes the subrecipient’s name, which must match the name associated with the subrecipient’s UEI. Effect: Not providing the UEI number or correct UEI number hampers subaward reporting and may impact federal oversight of the Disaster Grants program. Questioned Costs: None Recommendation: DMVA’s DHSEM director should strengthen review procedures to adequately monitor contractors to ensure subrecipient information in award documents is accurate. Views of Responsible Officials: Management agrees with this finding.

Finding No. 2025-033 Federal Awarding Agency: USDHS Impact: Material Weakness, Material Noncompliance AL Number and Title: 97.036 Disaster Grants 97.036 Disaster Grants – COVID-19 Federal Award Number: 4533DRAKP00000001, 4730DRAKP00000001 Applicable Compliance Requirement: Subrecipient Monitoring Condition: DMVA staff did not document a risk assessment for two Disaster Grants subrecipients. Context: DMVA receives funding applications from state, local, tribal, and private not-for-profit entities once a disaster has been presidentially declared. Prior to entering into an agreement with an applicant, DHSEM staff perform a risk assessment of the applicant to determine the extent of subrecipient monitoring. DHSEM staff evaluate the applicant by completing a risk assessment checklist, and apply safeguards if the subrecipient is considered high risk. DHSEM staff also complete a payment request checklist, prior to making subrecipient payments to confirm that risk assessments have been performed. According to DHSEM management, due to the high number of State disasters and a lack of staff resources, contractors were hired to help evaluate applicant eligibility, make subawards, conduct risk assessments, and monitor accordingly. The audit reviewed a random sample of eight of 47 subrecipients. One of the eight subrecipients did not have a risk assessment. During allowable cost testing, one additional subrecipient was identified that did not have risk assessment performed. Cause: Due to competing priorities and inadequate supervisory review procedures, DHSEM staff and contractors did not consistently obtain risk assessments and DHSEM management did not adequately monitor contractors to ensure risk assessments were performed. Criteria: Title 2 CFR 200.303(a) requires the State to establish and maintain effective internal control over the federal award that provides reasonable assurance that the State is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the grant awards. Title 2 CFR 200.332(c) requires the State to assess each subrecipient’s risk of noncompliance to determine the appropriate subrecipient monitoring. Effect: The lack of risk assessments may lead to inadequate monitoring of subrecipients increasing the risk of unallowable use of federal funds. Questioned Costs: None Recommendation: DMVA’s DHSEM director should strengthen supervisory review procedures to adequately monitor contractors and ensure risk assessments are performed. Views of Responsible Officials: Management agrees with this finding.

FINDING 2025-015 Federal Program Information: Research and Development Cluster (various ALN #’s) Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): C. Cash Management - per 2 CFR Part 200.305(b)(3), when the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the federal agency or pass-through entity reasonably believes the request to be improper. M. Subrecipient Monitoring – per 2 CFR Part 200.332(e)(1), a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports. Additionally, in accordance with 2 CFR 200.332(g), a pass-through entity must verify that a subrecipient is audited as required by Subpart F of Part 200. Condition: The University’s procedures failed to minimize the time elapsing between the transfer of federal funds to the subrecipient and the disbursement of such funds for program purposes by the subrecipient. The University was unable to provide documentation evidencing appropriate, annual review of its subrecipients’ Single Audit reports. Cause: Administrative oversight and insufficient internal controls. Effect or Potential Effect: The University was not in compliance with the requirements for pass-through entities. Questioned Costs: None. Context: • For 3 of 23 subrecipient payments tested, the University was unable to provide documentation evidencing appropriate review by the principal investigator. • For 6 of 23 subrecipients payments tested, payment was not made within the required timeframe. • For 7 of 7 subrecipients tested, the University was unable to evidence its verification of whether an audit had been performed. Identification as a Repeat Finding: This is a repeat of prior year finding 2024-013. Recommendation We recommend that the University enhance subrecipient monitoring controls by implementing documented invoice review protocols and enforcing annual audit verification procedures for all subrecipients. Management should define responsibilities for these reviews, document oversight activities performed, and implement monitoring controls to ensure compliance with federal subrecipient monitoring requirements. Views of Responsible Officials: In response to the auditor’s recommendation to enhance internal controls and ensure timely review of invoice protocols and subrecipient monitoring, Howard University is implementing the following: • The University is currently piloting a new Supplier Invoice Portal, launched jointly by the Sponsored Programs Office and the Office of Procurement, to improve invoicing efficiency and compliance. Under this new process, subrecipients will be required to submit invoices electronically in accordance with the terms and conditions of their subawards. The portal will support a streamlined review and approval process, with invoices routed through an automated workflow to ensure timely review and disbursement. • To support completion of the University’s annual audit verification requirements for subrecipients, oversight will occur at multiple stages throughout the subaward lifecycle. This includes reviewing audit reports at the proposal development stage, during which subrecipients are required to complete a Subrecipient Commitment Form (implemented September 2025) prior to proposal submission. • At the award stage, refreshed due diligence will be conducted, including a re-review of the subrecipient’s Single Audit and/or financial statements. Finally, the Post Award Compliance team will perform an annual review of subrecipients’ audit reports and complete audit follow up procedures as necessary.

Reference Number: 2025-019 Prior Year Finding: 2024-014 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (4/1/2022 – 6/30/2025) 23A55AY000020 (4/2/2023 – 6/30/2026) 23A55AT000036 (7/1/2023 – 6/30/2026) 23A55AW000048 (7/1/2023 – 6/30/2026) 24A55AY000057 (4/1/2024 – 6/30/2027) 24A55AT000067 (7/1/2024 – 6/30/2027) 24A55AW000097 (7/1/2024 – 6/30/2027) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued to their subrecipients. Context: For six of six subawards selected for testing, the subaward agreement did not include the federal award date for when the Federal agency awarded the funds to the prime recipient. Cause: The Department’s procedures and internal controls were not sufficient to ensure that subawards included all required information in accordance with 2 CFR section 200.332. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program information and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. In its FY 2024 corrective action plan, the Department indicated that it had revised its documented internal controls and procedures to correct the prior year finding. We recommend that the Department revisit its procedures and controls and update as needed to ensure that the federal award date is included in all subaward agreements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-023 Prior Year Finding: 2024-018 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Aging and Independence Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2201MAOAPH (10/1/2021 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2201MAOANS (10/1/2021 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) 2301MAOAPH (10/1/2022 - 9/30/2025) 2301MAOASS (10/1/2022 - 9/30/2024) 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOACM (10/1/2023 - 9/30/2025) 2401MAOAHD (10/1/2023 - 9/30/2025) 2501MAOANS (10/1/2024 - 9/30/2026) 2501MAOASS (10/1/2024 - 9/30/2026) 2501MAOACM (10/1/2024 - 9/30/2026) 2501MAOAHD (10/1/2024 - 9/30/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Aging and Independence (Department) issued subawards that did not contain all required federal award information, and it failed to properly monitor subrecipients. Context: Exceptions were found for eight of eight subawards selected for testing. Subawards were missing one or more required federal award identification elements and were not properly monitored. Specifically, we noted the following: • 4 of 8 subawards were missing one or more required award identification elements including the Federal Award Date, the Federal Award Identification Number (FAIN), the name of the Federal agency, the Assistance Listing number (ALN) and the federal award title, the dollar amount made available under each ALN, and the federal award project description as required by the Federal Funding Accountability and Transparency Act (FFATA). • 2 of 8 subrecipients selected for testing were not properly monitored by the Department. The Department was unable to provide documentation that it had proper monitoring procedures in place nor that monitoring procedures were followed for these subrecipients. • For 1 of 8 subrecipients, the Department did not obtain a copy of the subrecipient’s annual single audit report. Therefore, the Department did not verify that its annual single audit had been conducted, nor did it issue a management decision on audit findings. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls were not sufficient to ensure that the Department provided all required federal information to subrecipients at the time of the subaward nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Auditors noted that the Department’s corrective action plan from the prior audit had not been completed. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should review and enhance internal controls and procedures to ensure that it includes all required information in the subaward agreements. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-027 Prior Year Finding: 2024-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000518 (8/1/2022 – 7/31/2027) 24NU51CK000343 (8/1/2024 – 7/31/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not properly monitor subrecipients and the Department omitted required federal award information from subawards. Context: Eight subawards issued to eight subrecipients were selected for testing. Specifically, we noted the following exceptions: • For eight of eight subrecipients selected for testing, the Department did not adequately monitor the subrecipients. It did not obtain a copy of the subrecipients’ annual single audit report. Therefore, the Department did not verify that the annual single audits had been conducted, nor did it issue a management decision on any audit findings. • For eight of eight subawards selected for testing, the Federal Award Identification Number (FAIN) was omitted from the subaward agreements. Cause: The Department’s procedures were not sufficient to ensure that subrecipients were properly monitored, nor that subawards included all required information. Internal controls did not detect or prevent the errors. The Department had not completed implementation of its corrective action plan from the prior year. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: None. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. We recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal program. The Department should review and enhance internal controls and procedures to ensure that it includes all required information in the subaward agreements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-035 Prior Year Finding: 2024-036 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI085778 (9/30/2021 – 9/29/2024) 5H79TI085778 (9/30/2022 – 9/29/2024) 6H79TI085778 (9/30/2023 – 9/30/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not properly monitor subrecipients and the Department omitted required federal award information from subawards. Context: Thirteen subawards issued to thirteen subrecipients were selected for testing. Specifically, we noted the following exceptions: • 1 of 13 subawards was missing the Federal Award Identification Number (FAIN). • For 2 of 13 subrecipients selected for testing, the Department did not adequately monitor the subrecipients. The Department did not obtain a copy of the subrecipients’ annual single audit report. Therefore, the Department did not verify that the annual single audits had been conducted, nor did it issue a management decision on audit findings. Cause: The Department had not yet fully implemented its corrective action plan from the prior year. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program requirements and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: None. Recommendation: We recommend the Department complete its corrective action plan from the prior year. The Department should verify that its internal controls and procedures are sufficient to ensure subrecipient monitoring is performed in compliance with the requirements of the federal program and that all required information is included in subaward agreements. Views of responsible officials: There is no disagreement with the finding.

Finding 2025-007: Pre-Award Risk Assessment for Sub-Recipient (Significant Deficiency) Federal Agency: National Institute of Health Federal Program: All of Us Research Program Assistance Listing Number: 93.368 Criteria: As stated in 2 CFR 200.331 part (b), all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures to prescribe to each individual subrecipient. Condition: During our testing performed over subrecipient expenditures, we were unable to obtain evidence that pre-award risk assessment procedures were performed over subrecipients, consistent with 2 CFR §200.332(b). As such, the Foundation did not adequately determine appropriate monitoring procedures over the sub-recipients. Cause: The Foundation does not have established internal controls or policies regarding subrecipients. Effect or Potential Effect: The Organization could inadvertently be engaged in relationships with subrecipients of higher risk without the appropriate level of oversight to ensure subrecipients are expending funds in accordance with the provisions and terms of the subaward. Questioned Costs: None noted as this compliance requirement is a administrative reporting requirement that does not impact cost eligibility. Context: Our audit procedures consisted of substantive testwork over a sample of subrecipients. We consider our sample to be representative of the population. The samples were made using statistical sampling and we believe the condition appeared to be systematic in nature. Identification as a Repeat Finding: Not a repeat finding. Recommendation: We recommend the Foundation formalize internal control procedures and policies with respect to sub-recipient pre-award risk assessment. The risk assessments should be conducted in order to establish appropriate monitoring procedures.

Subrecipient Monitoring Program Name: Crime Victim Assistance (Assistance Listing 16.575) Federal Award Agency: Department of Justice Award Years: Federal Fiscal Years 2021, 2022, and 2023 Federal Award Numbers: 15POVC-21-GG-00615-ASSI, 15POVC-22-GG-00715-ASSI, and 15 POVC-23-GG-00433-ASSI Background The Crime Victim Assistance program provides financial support and various services and resources to crime victims, including crisis counseling, criminal justice support and advocacy, shelter, and therapy. The Judicial Branch provides grants to subrecipients to provide these services. Title 28 U.S Code of Federal Regulations (CFR) Part 94.118 provides that subrecipients shall contribute not less than 20% of the total cost of each project. Subrecipients shall derive these contributions from non-federal sources. Each subrecipient shall maintain records that clearly show the source and amount of the matching contributions.Criteria Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal control over federal awards that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 CFR Part 200.332(e) provides that the pass-through entity shall monitor subrecipient activities as necessary to ensure that they comply with federal statutes, regulations, and the terms and conditions of the subaward. Title 28 CFR Part 94.106 provides that the state administering agency shall conduct regular desk monitoring of all subrecipients as well as on-site monitoring of all subrecipients at least once every two years during the award period. The state shall maintain a copy of site visit results and other documents related to compliance. Title 2 CFR Part 200.306(b) provides that the pass-through entity must accept any cost sharing funds as part of the subrecipient’s contributions to a program when the funds are verifiable in the subrecipient’s records. Condition The Judicial Branch did not perform regular subrecipient desk reviews or site visits at least once every two years during the award period as required by federal regulations. The branch does not complete reviews until the award period ends. As a result, it did not promptly examine subrecipients’ underlying documentation such as invoices, timesheets, or support for expenditures or matching contributions. The branch’s monitoring process was limited to monthly reviews of budget-to-actual summaries. Context During the fiscal year ended June 30, 2025, the branch made $8,759,482 in reimbursements to 40 subrecipients.Questioned Costs $0Effect The Judicial Branch has limited assurance that subrecipients used federal funds for allowable activities and met the mandatory matching requirements. This could potentially lead to future disallowed costs and federal repayment obligations.Cause Due to a lack of adequate staffing, the Judicial Branch prioritized reviewing supporting documentation for prior award periods rather than the current period. Prior Audit Finding We have not previously reported this finding.Recommendation The Judicial Branch should strengthen internal controls to ensure it complies with federal subrecipient monitoring requirements for the Crime Victim Assistance program. Views of Responsible Officials “The Judicial Branch Office of Victim Services (OVS) agrees to strengthen its internal controls as described below to comply with federal subrecipient monitoring requirements for the Victims of Crime Act Assistance (VOCA) Program. In 2025, OVS performed site visits for four VOCA-funded programs and completed financial-desk reviews of monthly or quarterly financial reports for all programs. That year, OVS experienced personnel turnover in its three-employee Fiscal Services Unit, notably the separation from state service of a Program Manager and a Court Planner, who together performed OVS’ programmatic site visits of VOCA-funded programs. Also, there was a significant increase in workload resulting from OVS’ contributions to the 2024-2025 VOCA request-for-proposal process. In response, staff outside the unit contributed while managing other assigned duties, a Program Manager and Grants and Contract Specialist were hired to restore the unit to its three-employee configuration, the new employees received training on subrecipient monitoring policies and procedures, and a revised subrecipient site visit plan was developed and has begun being implemented. To strengthen internal controls, OVS has developed a revised site visit plan for the remaining VOCA-funded programs scheduled to receive site visits in 2025. April 15, 2026, is the anticipated date for OVS to complete the site visits. OVS has completed sending letters to the subrecipients operating the VOCA-funded programs. The letters request supporting documentation, which is programmatic and financial in nature, in accordance with OVS administrative policy and procedure. Also, the letters inform subrecipients that site visits will commence in accordance with a revised site visit plan.”

Subrecipient Monitoring Program Name: Temporary Assistance for Needy Families (TANF) (Assistance Listing 93.558) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Numbers: 2401CTTANF and 2501CTTANF Background The Department of Social Services (DSS) is the designated single state agency to administer Temporary Assistance for Needy Families (TANF) in accordance with Title 45 U.S. Code of Federal Regulations (CFR) Part 205.100. Connecticut administers certain aspects of TANF through several state agencies including the Department of Children and Families (DCF). DSS and DCF have a memorandum of understanding (MOU) which specifies each agency's responsibilities for administering programs in the TANF State Plan. DSS claims the state's use of federal TANF funds for home and community-based services provided to DCF's TANF-eligible clients. DCF enters into agreements with these subrecipients and pays them quarterly advances. DCF makes payments to Youth Service Bureaus claimed under the TANF program. Criteria Title 2 CFR Part 200.332(g) requires the pass-through entity to verify that subrecipients met their audit requirements for the fiscal year. Condition Our review of subrecipient monitoring over ten subrecipients that received $6,672,958 in TANF funds disclosed that DCF did not complete four annual fiscal reviews to ensure that subrecipients met their audit requirements for the fiscal year. Two of the ten subrecipients and two of the four exceptions were Youth Service Bureaus. Further review disclosed that DCF lacked procedures to perform annual reviews for Youth Service Bureau subrecipients. Context During the fiscal year ended June 30, 2025, DSS claimed $52,557,463 in DCF expenditures for various home and community-based services provided to 132 subrecipients, including $3,785,630 in expenditures for 102 Youth Service Bureau subrecipients. The sample was not statistically valid. Questioned Costs $0 Effect DSS and DCF have limited assurance that federal funds were used for allowable activities. Cause DCF experienced staffing limitations and competing priorities. DCF lacked management oversight over Youth Service Bureau subrecipients. Prior Audit Finding We previously reported this as finding 2024-024 and in two prior audits. Recommendation The Department of Children and Families should develop procedures to monitor payments to Youth Service Bureaus and strengthen internal controls to ensure compliance with the federal regulations for monitoring subrecipients of the Temporary Assistance for Needy Families program. As the lead agency for TANF, the Department of Social Services should strengthen procedures to ensure that supporting state agencies fulfill their responsibilities in their memorandum of understanding and comply with all federal TANF requirements. Views of Responsible Officials Response provided by the Department of Children and Families: “DCF agrees with this finding and will improve its internal review process to include Youth Services Bureaus and capture all subrecipients' federal single audits.” Response provided by the Department of Social Services: “The Department agrees with this finding. As the lead agency for TANF, DSS will strengthen procedures by requiring DCF to complete and share activities that verify subrecipients meet their audit requirements each fiscal year. DSS worked with an outside agency to review and enhance its subrecipient monitoring procedures. The outcome of this collaboration included training for DSS staff on subrecipient monitoring requirements, communicating expectations to subrecipients about monitoring expectations, a standardized data request, and the creation of a subrecipient monitoring toolkit to be utilized by DSS and its partners.”

Subrecipient Monitoring Program Name: Low-Income Home Energy Assistance Program (LIHEAP) (Assistance Listing 93.568) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2023, 2024, and 2025 Federal Award Numbers: 2301CTLIEA, 2301CTLIEE, 2401CTLIEA, 2401CTLIEI, 2501CTLIEA, and 2501CTLIEI Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.332 provides that the pass-through entity shall monitor subrecipient activities as necessary to ensure that they comply with federal statutes, regulations, and the subaward’s terms and conditions and ensure that they achieve performance goals and objectives. This includes a review of a pass-through entity’s required financial and performance reports. Condition Our review of subrecipient monitoring over nine Low-Income Home Energy Assistance Program (LIHEAP) subrecipients disclosed that the Department of Social Services (DSS) did not conduct annual fiscal reviews for one subrecipient. Context During the fiscal year ended June 30, 2025, DSS provided nine subrecipients with $75,417,156 of LIHEAP funds to administer the program. Questioned Costs $0 Effect DSS has limited assurance that federal funds were used for allowable activities. Cause Low staffing levels hindered the department. DSS lacks proper subrecipient monitoring procedures. Prior Audit Finding We previously reported this as finding 2024-022 and in one prior audit. Recommendation The Department of Social Services should strengthen internal controls to ensure it complies with federal subrecipient monitoring requirements for the Low-Income Home Energy Assistance Program. Views of Responsible Officials “The Department agrees with this finding and is in the process of hiring an additional staff member to assist with subrecipient monitoring. The LIHEAP unit is developing collaboration and cross-training by incorporating program liaisons to monitor portions of the financial requirements which coincide with program fuel slip monitoring reviews. The Department is creating a financial review tool to ensure consistency in the review of data to document in the financial report output.”