Findings Citing § 200.332

Finding Reference 2024-004 Federal Agency: U.S. Department of Housing and Urban Development Pass-Through Agency: P.R. Department of Housing Program: Community Development Block Grant/State’s Program and Non-Entitlement Grants in Hawaii (Assistance Listing No. 14.228) Compliance Requirement: Reporting (L) Type of Finding: Significant Deficiency (SD), Instance of Noncompliance (NC) This finding is similar to prior-year finding 2023-004. Statement of Condition In our reporting test, we found that the Municipality did not submit the corresponding reports for the fiscal year ended on June 30, 2024. Criteria Based on the CDBG agreements, the Municipality must submit to the Department of Housing reports on records, collections, and disbursements of Program Income on an annual and quarterly basis. Including the progress of the projects developed with the CDBG program. In addition, the Municipality will submit all the reports required by the Agency. Failure to comply with this provision will be just cause for the Department to stop the fund requisition process. § 200.332 Requirements for pass-through entities. (1) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award. (2) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports. Cause of Condition The Municipality does not have the necessary personnel assigned to prepare and present reports in a timely manner. Effect of Condition The program is not in compliance with the reporting requirements as established in the contract agreement. Recommendation We recommend that the Municipality maintain constant monitoring to improve program controls. The reports must be presented as established in the agreement and guidelines of the Department of Housing. This will ensure compliance with the reporting requirements under the Community Development Block Grants/State’s Program and Non-entitlement Grant in Hawaii agreement. Questioned Cost None. Prior Year Finding Yes. This finding is similar to prior-year finding 2023-004. Views of Responsible Officials and Planned Corrective Action The Municipality appointed a person to work on all the required reports and instructed them on the deadlines that apply. We were able to submit all past reports on January 2025. And subsequently we are complying with the reporting requirements. Implementation Date: June 30, 2025 Responsible Person: Carmen I. López Interim Finance Director

Finding Reference 2024-004 Federal Agency: U.S. Department of Housing and Urban Development Pass-Through Agency: P.R. Department of Housing Program: Community Development Block Grant/State’s Program and Non-Entitlement Grants in Hawaii (Assistance Listing No. 14.228) Compliance Requirement: Reporting (L) Type of Finding: Significant Deficiency (SD), Instance of Noncompliance (NC) This finding is similar to prior-year finding 2023-004. Statement of Condition In our reporting test, we found that the Municipality did not submit the corresponding reports for the fiscal year ended on June 30, 2024. Criteria Based on the CDBG agreements, the Municipality must submit to the Department of Housing reports on records, collections, and disbursements of Program Income on an annual and quarterly basis. Including the progress of the projects developed with the CDBG program. In addition, the Municipality will submit all the reports required by the Agency. Failure to comply with this provision will be just cause for the Department to stop the fund requisition process. § 200.332 Requirements for pass-through entities. (1) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award. (2) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports. Cause of Condition The Municipality does not have the necessary personnel assigned to prepare and present reports in a timely manner. Effect of Condition The program is not in compliance with the reporting requirements as established in the contract agreement. Recommendation We recommend that the Municipality maintain constant monitoring to improve program controls. The reports must be presented as established in the agreement and guidelines of the Department of Housing. This will ensure compliance with the reporting requirements under the Community Development Block Grants/State’s Program and Non-entitlement Grant in Hawaii agreement. Questioned Cost None. Prior Year Finding Yes. This finding is similar to prior-year finding 2023-004. Views of Responsible Officials and Planned Corrective Action The Municipality appointed a person to work on all the required reports and instructed them on the deadlines that apply. We were able to submit all past reports on January 2025. And subsequently we are complying with the reporting requirements. Implementation Date: June 30, 2025 Responsible Person: Carmen I. López Interim Finance Director

Program: AL 97.036 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) – Subrecipient Monitoring Grant Number & Year: 4616-DR-NE, declared September 6, 2021; 4420-DR-NE, declared March 21, 2019; 4641-DR-NE, declared February 23, 2022; 4662-DR-NE, declared July 27, 2022; 4521-DR-NE, declared April 4, 2020 Federal Grantor Agency: U.S. Department of Homeland Security Criteria: 2 CFR § 200.332 (January 1, 2024) states, in relevant part, the following: All pass-through entities must: * * * * (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. 2 CFR § 200.501(b) (January 1, 2024) states, in relevant part, the following, “A non-Federal entity that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single audit conducted in accordance with § 200.514 . . . .” A good internal control plan includes procedures to ensure subrecipient audits are reviewed timely. Condition: The Agency did not ensure subrecipients obtained Single audits. A similar finding was noted in the prior audit. Repeat Finding: 2023-063 Questioned Costs: None Statistical Sample: No Context: We selected three subrecipients for testing that would have required a Single audit based on the amount of funds received from the Agency during the subrecipient’s previous fiscal year. One of the three subrecipients received $12,604,747 in disaster grant funds passed through the Agency during the subrecipient’s fiscal year 2023, but did not submit a Single audit and the Agency had not followed up with the subrecipient. Cause: Employee oversight. The subrecipient returned a certification stating that they did not require a Single audit, and the Agency failed to verify the certification was proper. Effect: Without adequate monitoring procedures, there is an increased risk that Federal awards could be used for unallowable costs. Recommendation: We recommend the Agency implement procedures to ensure subrecipient audits are obtained and reviewed timely. Management Response: Military (NEMA) agrees with the finding and has implemented the corrective action plan.

Program: AL 15.611 – Wildlife Restoration and Basic Hunter Education and Safety – Allowability & Subrecipient Monitoring Grant Number & Year: F22AF01344-00, July 1, 2022, through June 30, 2025 Federal Grantor Agency: U.S. Department of the Interior Criteria: For the Wildlife Restoration program, Title 50 CFR § 80.50(a)(6)(iii) (October 1, 2023) states, in part, “Grantees and subgrantees must follow the requirements at 2 CFR part 200 when acquiring equipment, goods, and services under an award[.]” 2 CFR § 200.332(d) (January 1, 2024) requires a pass-through entity to do the following: Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward[.] 2 CFR § 200.403 (January 1, 2024) requires costs to be necessary, reasonable, and adequately documented. 2 CFR § 200.430(i) (January 1, 2024) provides the following, in relevant part: (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities (for IHE, this per the IHE’s definition of IBS); * * * * (vii) Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (viii) Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: * * * * (C) The non-Federal entity’s system of internal controls includes processes to review after-the-fact interim charges made to a Federal award based on budget estimates. All necessary adjustment must be made such that the final amount charged to the Federal award is accurate, allowable, and properly allocated. 2 CFR § 200.431(b) (January 1, 2024) states, in relevant part: The cost of fringe benefits in the form of regular compensation paid to employees during periods of authorized absences from the job, such as for annual leave, family-related leave, sick leave, holidays, court leave, military leave, administrative leave, and other similar benefits, are allowable if all of the following criteria are met: (1) They are provided under established written leave policies; (2) The costs are equitably allocated to all related activities, including Federal awards; and, (3) The accounting basis (cash or accrual) selected for costing each type of leave is consistently followed by the non-Federal entity or specified grouping of employees. (i) When a non-Federal entity uses the cash basis of accounting, the cost of leave is recognized in the period that the leave is taken and paid for. Payments for unused leave when an employee retires or terminates employment are allowable in the year of payment. (ii) The accrual basis may be only used for those types of leave for which a liability as defined by GAAP exists when the leave is earned. When a non-Federal entity uses the accrual basis of accounting, allowable leave costs are the lesser of the amount accrued or funded. 2 CFR § 200.431(c) (January 1, 2024) states the following: The cost of fringe benefits in the form of employer contributions or expenses for social security; employee life, health, unemployment, and worker’s compensation insurance (except as indicated in §200.447); pension plan costs (see paragraph (i) of this section); and other similar benefits are allowable, provided such benefits are granted under established written policies. Such benefits, must be allocated to Federal awards and all other activities in a manner consistent with the pattern of benefits attributable to the individuals or group(s) of employees whose salaries and wages are chargeable to such Federal awards and other activities, and charged as direct or indirect costs in accordance with the non-Federal entity’s accounting practices. A good internal control plan requires procedures to ensure that salaries and wages, as well as other costs charged to subawards, are documented properly. Condition: Adequate documentation was not on file to support a payment to a subrecipient. Repeat Finding: No Questioned Costs: $1,697 known Statistical Sample: No Context: We randomly selected 16 non-payroll documents to test. Our sample population included operating expenditures, capital outlay expenditures, and subrecipient reimbursements. One of 16 documents tested lacked adequate documentation to support that the costs were in accordance with Federal cost principles. The Agency paid $17,268 to a subrecipient that submitted an invoice for lodging and travel costs, payroll, and indirect costs for one employee. The employee’s base rate of $35.82 per hour for 378.5 hours worked on the grant was calculated according to the following: a pay rate of $24.76 per hour; a charge of 18% for paid time off; 22.6% for employer taxes and benefits; and 26.2% for indirect costs. However, the subrecipient provided no documentation, such as payroll records or bank statements, to support the payroll costs, totaling $17,110. After the APA requested support, the Agency provided paystubs and detailed payroll records from the subrecipient’s accounting system; however, based on the support provided, the wages, benefits, taxes, and indirect costs allocable to the grant totaled $15,413. As a result, we questioned the variance of $1,697 between the support provided and the amount charged to the grant for the payroll costs. Federal payment errors noted for the sample tested were $1,697. The total Federal sample tested was $300,860, and the total sample population was $10,649,122. Based on the sample tested, the case error rate was 6.25% (1/16). The dollar error rate was 0.56% ($1,697/$300,860), which estimates the potential dollars at risk for fiscal year 2024 to be $59,635 (dollar error rate multiplied by the population). Cause: Inadequate subrecipient monitoring procedures. Effect: Without adequate subrecipient monitoring procedures and supporting documentation on file, there is an increased risk for not only misuse of Federal funds but also payments not complying with State and Federal requirements. Recommendation: We recommend the Agency improve subrecipient monitoring to ensure both the allowability of costs and adherence to Federal regulations. Management Response: NGPC disagrees with the questioned costs identified by the APA. Our subrecipient policy includes the ability to ask for detailed records for any expense at any time. Accounting records, invoices, and paystubs were provided to substantiate the total invoice amount. The subrecipient has been audited and there were no issues with their financial systems. Explanations and calculations were provided to include the benefits and taxes paid out by the subrecipient, which matched the accounting records. Per their latest audit, these expenses are allocated on the basis of time and effort which complies with 2 CFR § 200.431(c). Performance reports were received and activity monitored by NGPC staff. NGPC works closely with the subrecipient which is considered a low-risk entity as demonstrated by the information provided for the audit. APA Response: Documentation provided to the auditors was inadequate to support the full amount charged to the grant. Documentation was not provided to support that the paid time off charged to the grant was reasonable, and no support was provided for Federal and State unemployment taxes, workers’ compensation costs, retirement plan fees, and other benefit costs.

Program: AL 20.509 – Formula Grants for Rural Areas – Allowability & Subrecipient Monitoring Grant Number & Year: NE-2021-11-00, Performance End FFY 2024; NE-2023-030-00, Performance End October 30, 2025; NE-2024-006-00, Performance End December 31, 2026 Federal Grantor Agency: U.S. Department of Transportation Criteria: Per 2 CFR § 1201.1 (January 1, 2024), the U.S. Department of Transportation adopted the Uniform Administrative Requirements, Cost Principles, and Audit Requirements set forth at Title 2 CFR part 200. 2 CFR § 200.403 (January 1, 2024) requires costs to be reasonable, necessary, and adequately documented. A good internal control plan requires procedures to be in place to ensure compliance with Federal and State requirements. 2 CFR § 200.332(d) (January 1, 2024) requires the pass-through entity to do the following: Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. 2 CFR § 200.430(i)(1) (January 1, 2024) states the following, in relevant part: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; * * * * (vii) Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (viii) Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards . . . . Per 2 CFR § 200.405(a) (January 1, 2024), “A cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received.” 2 CFR § 200.442(a) (January 1, 2024) states the following: Costs of organized fund raising, including financial campaigns, endowment drives, solicitation of gifts and bequests, and similar expenses incurred to raise capital or obtain contributions, are unallowable. Fund raising costs for the purposes of meeting the Federal program objectives are allowable with the prior written approval of the Federal agency. Condition: The Agency lacked adequate documentation to support that payments were for allowable activities and in accordance with allowable cost principles. A similar finding was noted in the prior audit. Repeat Finding: 2023-065 Questioned Costs: $4,905 known See Schedule of Findings and Questioned Costs for chart/table. Statistical Sample: No Context: During the fiscal year, the Agency paid 64 subrecipients a total of $12,622,391. We selected five payments to subrecipients for testing. The Agency performed financial reviews for subrecipients; however, the reviews tested did not always include all necessary supporting documentation. When additional documentation was needed, we provided the Agency with the opportunity to obtain additional support from the subrecipient; however, adequate support was not always obtained or able to be provided. See Schedule of Findings and Questioned Costs for chart/table. We noted the following: • Two subrecipients tested did not have adequate support for all personnel charges. One individual tested was reimbursed at the non-operating rate but should have been reimbursed at the operating rate. Another individual’s personnel costs were based on budgeted amounts. • Fuel costs for one subrecipient did not agree with invoices. • One subrecipient did not properly report revenues collected, resulting in an overcharge of the Federal reimbursement. • All five subrecipients tested had capital or non-operating costs that were not adequately supported. Costs allocated between programs were not adequately supported, travel costs did not appear reasonable, and fundraising costs of $100 were charged. Cause: Procedures were not adequate to ensure costs were in accordance with Federal requirements. Effect: Increased risk for errors or misuse of funds. Recommendation: We recommend the Agency improve procedures to ensure expenditures are allowable and in accordance with Federal regulations. Management Response: NDOT acknowledges the audit findings related to subrecipient monitoring and cost allowability under the grant funding. We will continue to ensure compliance with regulations and are committed to improving our internal controls to prevent recurrence of similar findings.

Finding Number: 2024-009 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not Applicable ALN Number(s) and Program Title(s): 21.027 – COVID 19: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): SLFRP3627 Federal Award Year(s): 2021 Compliance Requirement(s) Affected: Subrecipient Monitoring Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2023-008. Criteria: In accordance with 2 CFR § 200.332(a)(1), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward: i. Subrecipient name (which must match the name associated with its unique entity identifier). ii. Subrecipient's unique entity identifier. iii. Federal Award Identification Number (FAIN). iv. Federal award date. v. Subaward Period of Performance start and end date. vi. Subaward budget period start and end date. vii. Amount of federal funds obligated to the subrecipient. viii. Total amount of federal funds obligated to the subrecipient by the pass-through entity, including the current financial obligation. ix. Total amount of the federal award committed to the subrecipient by the pass-through entity. x. Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA). xi. Name of federal agency, pass-through entity, and contact information for awarding official of the pass-through entity. xii. Assistance listings title and number (ALN); the pass-through entity must identify the dollar amount made available under each federal award and the ALN at the time of disbursement. xiii. Identification of whether the federal award is research and development. xiv. Indirect cost rate for the federal award (including if the de minimis rate is used in accordance with § 200.414). In addition, 2 CFR § 200.332(a)(4) requires an approved, federally recognized indirect cost rate between the subrecipient and the federal awarding agency. Condition and Context: ALA staff reviewed seven executed grant agreements, totaling $42,681,880, to determine if they met the Uniform Guidance criteria. Five of these grant agreements were selected randomly, and the remaining two were selected based upon concerns communicated to ALA by the Agency. The following deficiencies were noted in the two grant agreements selected based upon Agency concerns: • The agreements, which totaled $6,549,322, did not include all required terms, specifically items ii, iii, v, xii, xiii, and xiv from the criteria noted above. • The agreements did not include indirect cost rate agreements. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency did not ensure staff were trained and knowledgeable regarding Uniform Guidance requirements for subrecipients. Effect: Without a proper grant agreement, subrecipients may be unaware that their award is subject to federal compliance requirements, and the Agency risks noncompliance with subrecipient monitoring requirements. Recommendation: ALA staff recommend the Agency provide training to appropriate staff to ensure adherence to Uniform Guidance regarding subrecipient monitoring. Views of Responsible Officials and Planned Corrective Action: In 2023, ASBO sent out Amendment #1 for all SLFRF subgrants. This amendment was a one-page sheet providing information for all the requirements listed in 2 CFR § 200.332(a)(1). The subrecipient listed in this finding, Extreme Broadband, did not acknowledge or return their amendment. We will begin to request acknowledgement from this provider on a continuous quarterly basis. Anticipated Completion Date: March 4, 2025 Contact Person: Glen Howie, Jr. Director, Ark State Broadband Office Department of Commerce 1 Commerce Way Little Rock, AR 72202 (501) 682-1123 Glen.Howie@Arkansas.gov

Finding Number: 2024-010 State/Educational Agency(s): Arkansas Department of Agriculture – Natural Resources Division Pass-Through Entity: Not Applicable ALN Number(s) and Program Title(s): 21.027 – COVID 19: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): SLFRP3627 Federal Award Year(s): 2021 Compliance Requirement(s) Affected: Subrecipient Monitoring Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(a)(1), all pass-through entities must: ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward: i. Subrecipient name (which must match the name associated with its unique entity identifier). ii. Subrecipient's unique entity identifier. iii. Federal Award Identification Number (FAIN). iv. Federal award date. v. Subaward Period of Performance start and end date. vi. Subaward budget period start and end date. vii. Amount of federal funds obligated in the subaward. viii. Total amount of federal funds obligated to the subrecipient by the pass-through entity, including the current financial obligation. ix. Total amount of the federal award committed to the subrecipient by the pass-through entity. x. Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA). xi. Name of federal agency, pass-through entity, and contact information for awarding official of the pass-through entity. xii. Assistance listings title and number (ALN); the pass-through entity must identify the dollar amount made available under each federal award and the ALN at the time of disbursement. xiii. Identification of whether the federal award is research and development. xiv. Indirect cost rate for the federal award (including if the de minimis rate is used in accordance with § 200.414). In addition, 2 CFR § 200.332(a)(4) requires an approved, federally recognized indirect cost rate between the subrecipient and the federal awarding agency. Condition and Context: ALA staff reviewed 13 executed grant agreements, totaling $29,342,709, to determine if they met the Uniform Guidance criteria. The following deficiencies were noted: • The 13 grant agreements did not include all required terms, specifically items ii, iii, v, vi, xi, xii, xiii, and xiv from the criteria noted above. • An indirect cost rate agreement could not be provided. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency did not ensure staff were trained and knowledgeable regarding Uniform Guidance requirements for subrecipients. Effect: Without a proper grant agreement, subrecipients may be unaware that their award is subject to federal compliance requirements, and the Agency risks noncompliance with subrecipient monitoring requirements. Recommendation: ALA staff recommend the Agency provide training to appropriate staff to ensure adherence to Uniform Guidance regarding subrecipient monitoring. Views of Responsible Officials and Planned Corrective Action: The Department will execute an amendment to the grant agreements for all ARPA funding not disbursed as of 7/1/2024 to include the missing data as detailed in the finding. Staff will be trained on Uniform Guidance requirements. Anticipated Completion Date: June 30, 2025 Contact Person: Debby Dickson Water Development Division Manager Arkansas Department of Agriculture-Natural Resources Division 1 Natural Resources Drive Little Rock, AR 72205 (501) 225-1598 Debra.Dickson@agriculture.arkansas.gov

Finding Number: 2024-011 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 21.027 – COVID 19: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): SLFRP3627 Federal Award Year(s): 2021 Compliance Requirement(s) Affected: Subrecipient Monitoring Type of Finding: Material Weakness Repeat Finding: A similar issue was reported in prior-year finding 2023-008. Criteria: In accordance with 2 CFR § 200.332(c), pass-through entities must evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine appropriate subrecipient monitoring. Section 8(C)(7) of the Arkansas Rural Connect (ARC) rules require applicant Internet Service Providers (ISPs) to submit financial statements for the three most recent years, including an audited financial statement for the most recent year, for grant requests exceeding $2 million. Section 9(G) of the ARC rules state that within 45 days after grant approval, the ISP should submit the project plans to a licensed Professional Engineer (PE) for a technical adequacy confirmation. Once received, the ISP should submit the PE approval stamp to the Arkansas State Broadband Office (ASBO). Condition and Context: ALA staff reviewed eight executed subaward agreements, totaling $42,681,880, to determine if they met the Uniform Guidance criteria, as well as relevant ARC rules. The following deficiencies were noted: • For six of the eight agreements tested, the ASBO did not receive and review the applicants’ financial statements for the three previous years prior to executing a grant agreement. • Discussion with management indicated that the pass-through entity did not have documentation indicating that a PE reviewed the technical adequacy of any of the eight broadband projects ALA reviewed. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: Discussion with management indicated the ASBO was understaffed during the time these agreements were executed, and it did not ensure that training included requirements of Uniform Guidance or ARC rules. Effect: Without proper review of contractor financial statements, the Agency could award federal funds to a high-risk entity and fail to adjust the methods of monitoring accordingly. Without approval of a licensed PE, project plans may fail to meet technical adequacy required for the project. Recommendation: ALA staff recommend the Agency strengthen controls by providing training on established ARC rules and procedures, which include a review of the financial statements of contractors as well as the technical adequacy of projects to ensure adherence to Uniform Guidance and ARC rules regarding subrecipient monitoring. Views of Responsible Officials and Planned Corrective Action: Current staff believes the 3 requirements listed above were not performed in the past. For remaining active SLFRF subgrants, ASBO will establish a fraud/risk/noncompliance rating and set appropriate monitoring standards. Should any new applications for SLFRF funding be procured, ASBO will require financial statements and a PE Stamp prior to grant agreement execution. ASBO will provide 2 CFR 200 training and ARC rules training to our staff and contractors. Anticipated Completion Date: April 1, 2025 Contact Person: Glen Howie, Jr. Director, Ark State Broadband Office Department of Commerce 1 Commerce Way Little Rock, AR 72202 (501) 682-1123 Glen.Howie@Arkansas.gov

Reference Number: 2024-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Highway Planning and Construction Assistance Listing Number: 20.205 Award Number and Year: FFY2023 – FFY2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) omitted required federal award information from subawards it issued in the program and did not adequately monitor subrecipients. Context: Nineteen subawards were selected for testing and the following exceptions were noted: • For 16 of 19 subawards selected for testing, the federal award date was not included on the subaward agreement. • For 1 of 19 subawards selected for testing, the last on-site subrecipient monitoring visit was performed in FY 2019 and the next on-site monitoring did not take place until FY 2024. Per the VTrans subrecipient monitoring plan, on-site monitoring must be performed no less than every three years. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required federal information. Although VTrans subsequently modified its subaward issuance process, controls in effect during the audit period were not sufficient to ensure that subawards included all required information. Procedures and internal controls were also not sufficient to ensure that timely on-site monitoring visits were performed in accordance with its monitoring plan. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Failure to conduct adequate subrecipient monitoring may result in a failure of VTrans to detect that subawards are used for unauthorized purposes, are managed in violation of the terms and conditions of the subawards, or that subaward performance goals are not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by VTrans personnel on a timely basis. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding.

Finding 2024-002 Material Weakness: Subrecipient Monitoring – Compliance and Control Finding ALN 21.027: COVID-19: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Pass-through Entity: Illinois State Board of Education Criteria Or Specific Requirement: 2 CFR 200.332(a)(1) mandates that the Project inform subrecipients of specific federal award identifiers, including the award date, period of performance, federal awarding agency, Assistance Listing Number, and program name. Furthermore, 2 CFR 200.332(d) requires the Project to review subrecipient financial and performance reports, including single audit reports. Accurate award information allows subrecipients to fulfill their reporting obligations correctly and ensures that federal funds are used appropriately and for the intended purposes. Condition: The audit revealed that management did not provide subrecipients with accurate award information in all instances. Additionally, the review of subrecipient single audit reports was not included in the Project's established monitoring procedures. Cause: Management does not have an internal control process in place to ensure proper subrecipient monitoring. Effect: Failure to communicate all required federal award identifiers to subrecipients may result in their non-compliance with the federal program requirements. Questioned Costs: None Context: A review of a sample of 8 subrecipient awards and correspondence revealed that one subrecipient submitted a filing to the Federal Audit Clearinghouse with an incorrect Assistance Listing Number recorded on their data collection form. Additionally, all 16 subrecipients received grant agreements with an incorrect Assistance Listing Number. Identification As A Repeat Finding: 2023-003 Recommendation: We recommend that all subrecipient grant agreements are updated to include appropriate grant information set forth by 2 CFR 200.332(a)(1) and 2 CFR 200.332(d). Views Of Responsible Officials And Planned Corrective Action: An adequate subrecipient risk assessment policy will be put in place to evaluate and monitor subrecipients. Southwest Organizing Project will provide subrecipients with all required Federal awards identifiers. Edith Robles will ensure that Federal award identifiers are included in subrecipients' Grant Agreements.

Finding 2024 - 001 Lack of Subrecipient Monitoring Procedures – Verification of Audits Information on the Federal Programs: 19.511 Criteria: Per 2 CFR § 200.332(f), pass-through entities must ensure that subrecipients expending $750,000 or more in Federal awards during the subrecipient’s fiscal year undergo a single or program-specific audit as required by 2 CFR § 200.501. Additionally, per 2 CFR § 200.332(d), passthrough entities must monitor subrecipients to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Condition: During the audit, it was noted that the entity does not have a formalized process in place to verify whether subrecipients required to undergo a single audit have completed and submitted the audit as required. Specifically, there was no documented evidence that the entity reviewed audit reports or followed up on subrecipient audit compliance. Cause: The entity has not established or implemented adequate policies and procedures to monitor subrecipient compliance with audit requirements under the Uniform Guidance. Effect or Potential Effect: Failure to verify and review subrecipient audit reports increases the risk that noncompliance, questioned costs, or internal control deficiencies at the subrecipient level go undetected, potentially resulting in unallowable costs or noncompliance with Federal regulations. Questioned Costs: None noted at this time; however, the lack of monitoring increases the risk of unallowable costs in Federal programs. Context: BRAC USA has one primary subrecipient for which a single audit was not performed prior to our audit fieldwork. Identification as a Repeat Finding, if Applicable: Not a repeat finding. Recommendation: We recommend that the entity develop and implement formal written procedures to ensure subrecipient audit requirements are met. These procedures should include:  Identifying subrecipients required to undergo a single audit.  Requiring subrecipients to submit audit reports and management letters annually.  Reviewing subrecipient audit reports to identify findings that may impact the entity.  Establishing follow-up procedures to address and resolve subrecipient audit findings.  Maintaining documentation of audit verification and any corrective actions taken.

Finding: 2024-001 Subrecipient Monitoring Information on the Federal Program: Assistance Listing Number 16.738 Criteria: CFR § 200.332, "Requirements for pass-through entities", requires pass-through entities to evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: As part of our audit, we selected a sample of subawards charged to the major Federal program. We noted that the pre-award risk assessments were not performed until November 2024, subsequent to the subawards being signed with the subawardees. Based on our discussions with management, the process for performing pre-award risk assessments for subrecipients and determining and documenting the appropriate level of ongoing monitoring for subrecipients was implemented in November 2024. Cause: The Association did not perform pre-award risk assessments on its subrecipients as required by Federal regulation. Effect: The Association could inadvertently engage in relationships with subrecipients of higher risk without the appropriate level of oversight (i.e. monitoring) to ensure subrecipients are expending funds in accordance with the provisions and terms of the subaward. Questioned Costs: None noted. Context: Our audit procedures in this area consisted of substantive testwork over a sample of subrecipient expenditures that were selected based on a defined threshold. We consider our sample to be representative of the populations, and thus, is a statistically valid sample. The issue is deemed to be systemic. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Association strictly adhere to its current subaward policy and ensure the risk assessment procedures over all of its subrecipients are performed and documented prior to engagement. Based on these risk assessments, the Association should assign a risk level to each, and then determine the monitoring tools to apply based on these risk levels.

2024-003 Subrecipient Monitoring Federal Agency: Department of Labor Federal Programs: 17.258/17.259/17.278 Workforce Innovation Opportunity Act (WIOA) Cluster (Passed through MassHire Department of Career Services (MDCS)) Condition: The Organization did not perform any monitoring of its subrecipient in fiscal year 2024. Criteria: 2 CFR 200.332 of the Uniform Guidance requires pass-through entities to: • Identify the award and applicable requirements of the funding source to its subrecipients. • Evaluate each subrecipient’s risk of noncompliance with the regulations of the federal funds. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Cause: Although the Organization has policies and procedures in place surrounding the subrecipient monitoring requirements, there were delays in the subrecipient providing financial and other records needed for the Organization to complete its annual monitoring requirements. Effect: The Organization cannot ensure the costs of goods and services charged to the federal program are allowable and charged in accordance with the applicable regulations. Context: Total expenditures for the WIOA Cluster were $1,223,337 for the year ended June 30, 2024, which included $373,352 of expenditures to subrecipients. Questioned Costs: Unknown Recommendation: We recommend that management review its policies and procedures to ensure subrecipients are monitored for program compliance at least annually. Management Response: Management agrees with the finding. See management’s attached corrective action plan.

2024-003 Subrecipient Monitoring Federal Agency: Department of Labor Federal Programs: 17.258/17.259/17.278 Workforce Innovation Opportunity Act (WIOA) Cluster (Passed through MassHire Department of Career Services (MDCS)) Condition: The Organization did not perform any monitoring of its subrecipient in fiscal year 2024. Criteria: 2 CFR 200.332 of the Uniform Guidance requires pass-through entities to: • Identify the award and applicable requirements of the funding source to its subrecipients. • Evaluate each subrecipient’s risk of noncompliance with the regulations of the federal funds. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Cause: Although the Organization has policies and procedures in place surrounding the subrecipient monitoring requirements, there were delays in the subrecipient providing financial and other records needed for the Organization to complete its annual monitoring requirements. Effect: The Organization cannot ensure the costs of goods and services charged to the federal program are allowable and charged in accordance with the applicable regulations. Context: Total expenditures for the WIOA Cluster were $1,223,337 for the year ended June 30, 2024, which included $373,352 of expenditures to subrecipients. Questioned Costs: Unknown Recommendation: We recommend that management review its policies and procedures to ensure subrecipients are monitored for program compliance at least annually. Management Response: Management agrees with the finding. See management’s attached corrective action plan.

2024-003 Subrecipient Monitoring Federal Agency: Department of Labor Federal Programs: 17.258/17.259/17.278 Workforce Innovation Opportunity Act (WIOA) Cluster (Passed through MassHire Department of Career Services (MDCS)) Condition: The Organization did not perform any monitoring of its subrecipient in fiscal year 2024. Criteria: 2 CFR 200.332 of the Uniform Guidance requires pass-through entities to: • Identify the award and applicable requirements of the funding source to its subrecipients. • Evaluate each subrecipient’s risk of noncompliance with the regulations of the federal funds. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Cause: Although the Organization has policies and procedures in place surrounding the subrecipient monitoring requirements, there were delays in the subrecipient providing financial and other records needed for the Organization to complete its annual monitoring requirements. Effect: The Organization cannot ensure the costs of goods and services charged to the federal program are allowable and charged in accordance with the applicable regulations. Context: Total expenditures for the WIOA Cluster were $1,223,337 for the year ended June 30, 2024, which included $373,352 of expenditures to subrecipients. Questioned Costs: Unknown Recommendation: We recommend that management review its policies and procedures to ensure subrecipients are monitored for program compliance at least annually. Management Response: Management agrees with the finding. See management’s attached corrective action plan.

2 CFR 1000.10 gives regulatory effect to the U.S. Department of Treasury for 2 CFR 200.332 which states, in part, pass-through entities must ensure every subaward includes requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports. The grant’s pass-through entity is the Ohio Office of Budget and Management (OBM). State Fiscal Recovery Funds K-12 School Safety Grants Frequently Asked Questions require recipient schools to complete quarterly financial status reports via the OBM grants portal until they have spent all funds and completed their projects. The District did not have proper internal controls in place to ensure the completion and submission of the quarterly financial status reports. During testing of quarterly financial status reports for the Coronavirus State and Local Fiscal Recovery Funds (AL #21.027), we noted the District only completed one quarterly financial status report for the period of October 1, 2023 through December 31, 2023 despite having grant expenditures during July and August, 2023. A separate quarterly financial status report should have been prepared for the period of Jul1, 2023 through September 30, 2023. Failure to have the proper controls in place to ensure the completion and submission of the quarterly financial status reports could result in Treasury taking action against the District for failure to comply with programmatic requirements. The District should implement and have controls in place to ensure the quarterly expenditure reports are prepared and submitted.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

Compliance Requirement – Subrecipient Monitoring – Significant Deficiency and Noncompliance Criteria Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Additionally, in accordance with federal requirements, the University shall maintain internal controls over federal programs designed to provide reasonable assurance that transactions are executed in compliance with federal statutes, regulations, and the terms and conditions of the federal award that could have a direct and material effect on a federal program. Condition and Context We selected thirteen subrecipients for testwork out of 82 in total and we noted that the University did not properly receive and review the single audit reports for seven of those subrecipients to ensure they had no material findings that would impact the University. The University then identified an additional six subrecipients outside of our sample where the same deficiency occurred. Cause The University had turnover in staff in the Office of Sponsored Projects during the fiscal year 2024 and this led to miscommunication which resulted in this monitoring step not being performed timely. Effect Subrecipient monitoring that is not performed timely could result in federal dollars being passed down to subrecipients with significant control or compliance issues that could impact the University. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University strengthen its policies and procedures to ensure that subrecipient monitoring is being performed timely. The University should provide training to the departments responsible for these reviews.

The County failed to comply with subrecipient monitoring requirements as mandated by federal regulations and the grant terms. The County did not conduct regular oversight and monitoring of its subrecipients' programmatic and financial activities. The non-compliance with 2 CFR §200.330-332 (Subrecipient Monitoring) increases the likelihood of unallowable costs, misallocated resources, and non-compliance with program objectives. There was a change in key personnel responsible for the County's compliance with guidelines related to the federal program. Per 2 CFR §200.330-200.332, pass-through entities must monitor subrecipients to ensure compliance with federal statutes, award terms, and program objectives The County should strengthen its internal control procedures to ensure that the subaward agreement includes a clause for subrecipient monitoring activities and conduct monitoring reviews on a regular basis. The County's corrective action plan at the end of this report includes the views and planned actions of its responsible officials. We are not required to audit and have not audited these responses or corrective actions and therefore we provide no assurances as to their accuracy.

The County failed to comply with subrecipient monitoring requirements as mandated by federal regulations and the grant terms. The County did not conduct regular oversight and monitoring of its subrecipients' programmatic and financial activities. The non-compliance with 2 CFR §200.330-332 (Subrecipient Monitoring) increases the likelihood of unallowable costs, misallocated resources, and non-compliance with program objectives. There was a change in key personnel responsible for the County's compliance with guidelines related to the federal program. Per 2 CFR §200.330-200.332, pass-through entities must monitor subrecipients to ensure compliance with federal statutes, award terms, and program objectives The County should strengthen its internal control procedures to ensure that the subaward agreement includes a clause for subrecipient monitoring activities and conduct monitoring reviews on a regular basis. The County's corrective action plan at the end of this report includes the views and planned actions of its responsible officials. We are not required to audit and have not audited these responses or corrective actions and therefore we provide no assurances as to their accuracy.

The County failed to comply with subrecipient monitoring requirements as mandated by federal regulations and the grant terms. The County did not conduct regular oversight and monitoring of its subrecipients' programmatic and financial activities. The non-compliance with 2 CFR §200.330-332 (Subrecipient Monitoring) increases the likelihood of unallowable costs, misallocated resources, and non-compliance with program objectives. There was a change in key personnel responsible for the County's compliance with guidelines related to the federal program. Per 2 CFR §200.330-200.332, pass-through entities must monitor subrecipients to ensure compliance with federal statutes, award terms, and program objectives The County should strengthen its internal control procedures to ensure that the subaward agreement includes a clause for subrecipient monitoring activities and conduct monitoring reviews on a regular basis. The County's corrective action plan at the end of this report includes the views and planned actions of its responsible officials. We are not required to audit and have not audited these responses or corrective actions and therefore we provide no assurances as to their accuracy.

(2024-032) Title: Internal control over CNC subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 7 CFR 210.18; 7 CFR 225.7; U.S. Department of Agriculture Policy Memo SP 46-2015 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. The Department must conduct administrative reviews of School Food Authorities (SFAs) participating in the National School Lunch Program (NSLP) and the School Breakfast Program (SBP). These procedures must also be followed, as applicable, to conduct administrative reviews of the afterschool snacks, Special Milk Program (SMP) and the Fresh Fruit and Vegetable Program (FFVP). Documented corrective action is required for any degree of violation of general or critical areas identified in an administrative review. Corrective action may be provided at the time of the review; however, it must be postmarked or submitted to the State agency electronically no later than 30 days from the deadline for completion of each required corrective action. The State agency must maintain any documented corrective action on file for review by the Food and Nutrition Service (FNS). The Department must withhold all program payments to a SFA if: • documented corrective action for critical area violations is not provided with deadlines specified; or • corrective action for critical area violations was not completed. FNS may suspend or withhold program payments, in whole or in part, to those states failing to withhold payments in accordance with regulations and may withhold administrative funds. The Department must review sponsors to ensure compliance with Summer Food Service Program (SFSP) regulations. The Department is required to conduct a review of base year certification and benefit issuance documentation for any SFA requesting approval to participate in NSLP or SBP using U.S. Department of Agriculture (USDA) Special Provision 2, which is a provision established to reduce application burdens and simplify claim procedures. The review must occur at some point during the base year. If errors are identified as a result of the review, the Department must adjust all of the SFA’s closed claims that occurred in the current school year. Condition: The Child Nutrition Cluster (CNC) includes the NSLP, SBP, SMP, SFSP, and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of child nutrition programs for the State. DOE partners with local SFAs and sponsors to provide benefits to school-aged children. DOE has assigned subrecipient monitoring responsibilities, which include administrative reviews and other reviews as needed, to the Child Nutrition Services (CNS) division. Administrative reviews of all SFAs are required at least once every five years; however, regulations also specify that high-risk SFAs must receive targeted follow-up within two years. CNS utilizes a spreadsheet to track and facilitate the reviews, and a USDA questionnaire to document the completion of the review. CNS does not have a mechanism to centrally track the high-risk SFAs to ensure follow-up occurs. CNS is required to retain documentation to support all elements of the administrative reviews and to demonstrate the SFA’s compliance with the program, even if corrective action occurs onsite during the review. The Office of the State Auditor (OSA) tested 29 administrative reviews completed by CNS and found: • Performance Standard 1 findings, deemed critical findings by USDA, were identified in four reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for one review. • Performance Standard 2 findings, also deemed critical by USDA, were identified in three reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for two reviews. • corrective action completed onsite was indicated in five reviews; however, CNS could not provide documentation to support the corrective action. • corrective action for three reviews did not fully address the deficiencies noted. • corrective action for two reviews was received more than 30 days late. • 12 reviews were closed; however, corrective action remained outstanding. • one sponsor submitted corrective action in October 2023, but as of audit testing in March 2025, CNS had not notified the sponsor of the approval and had not closed the sponsor’s review. • corrective action submitted from two SFAs was not approved, and the SFAs were not notified until nine months after their submission. • the review tracking spreadsheet was not fully completed or conflicted with information obtained from the administrative review for 16 reviews. • questionnaires were not fully completed for seven reviews. • USDA questionnaire sections related to FFVP and SMP were erroneously excluded for eight reviews. • the date for required corrective action to be provided was omitted for seven reviews. • one review was erroneously excluded from the review tracking spreadsheet. In addition to administrative reviews, CNS must perform base year reviews for all SFAs that have applied to participate in USDA Special Provision 2. These base year reviews provide the required information necessary to determine the level of claims the SFA may submit in the subsequent three years. After completion of the base year review, a letter detailing the results, including any adjustments to previously submitted claims, is provided to the SFA. The SFA is required to adjust claims and enrollment data through the claim revision process and CNS is responsible for verifying that the appropriate revisions have been completed. In fiscal year 2024, CNS identified 17 SFAs that required a base year review. OSA tested four base year reviews and identified three SFAs that did not properly revise claims and enrollment data, and CNS did not verify the accuracy of the revisions completed by the SFAs. In addition, one SFA had an eligibility determination that was not supported by the application. The income amount included in the application exceeded income requirements for reduced-price eligibility, but the SFA categorized the applicant as eligible for reduced-price meals. In the base year review, the application was not recategorized by CNS, and claims were not revised to match the eligibility determination. OSA cannot determine if unallowable costs exist through the audit of subrecipient monitoring activities, as required information was not collected. OSA has questioned costs through the audit of allowable costs/costs principles and eligibility, see findings 2024-031 Internal control over CNC reimbursements needs improvement and 2024-030 Internal control over CNC eligibility needs improvement, respectively. OSA selected non-statistical random samples. Context: In fiscal year 2024, CNC expenditures totaled approximately $68 million, of which $67.6 million was provided to 241 SFAs and sponsors. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. • Potential questioned costs and disallowances. Base year reviews provide authorization for the level of allowable claims the SFA can claim in subsequent periods. Without a base year review and necessary revisions, SFAs could be underclaiming or overclaiming costs. Recommendation: We recommend that the Department implement policies and procedures and increase oversight to ensure that: • reviews are completed as required and supporting documentation is retained; • high-risk SFAs are tracked and considered in planning follow-up reviews; • SFAs revise claims appropriately after a base year review; and • CNS verifies that claim adjustments occur as necessary. Corrective Action Plan: See F-17 Management’s Response: The Department agrees with this finding. The Department will improve tracking and create procedures to evaluate the Administrative Review Processes for the team. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 24-1203-06)

(2024-032) Title: Internal control over CNC subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 7 CFR 210.18; 7 CFR 225.7; U.S. Department of Agriculture Policy Memo SP 46-2015 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. The Department must conduct administrative reviews of School Food Authorities (SFAs) participating in the National School Lunch Program (NSLP) and the School Breakfast Program (SBP). These procedures must also be followed, as applicable, to conduct administrative reviews of the afterschool snacks, Special Milk Program (SMP) and the Fresh Fruit and Vegetable Program (FFVP). Documented corrective action is required for any degree of violation of general or critical areas identified in an administrative review. Corrective action may be provided at the time of the review; however, it must be postmarked or submitted to the State agency electronically no later than 30 days from the deadline for completion of each required corrective action. The State agency must maintain any documented corrective action on file for review by the Food and Nutrition Service (FNS). The Department must withhold all program payments to a SFA if: • documented corrective action for critical area violations is not provided with deadlines specified; or • corrective action for critical area violations was not completed. FNS may suspend or withhold program payments, in whole or in part, to those states failing to withhold payments in accordance with regulations and may withhold administrative funds. The Department must review sponsors to ensure compliance with Summer Food Service Program (SFSP) regulations. The Department is required to conduct a review of base year certification and benefit issuance documentation for any SFA requesting approval to participate in NSLP or SBP using U.S. Department of Agriculture (USDA) Special Provision 2, which is a provision established to reduce application burdens and simplify claim procedures. The review must occur at some point during the base year. If errors are identified as a result of the review, the Department must adjust all of the SFA’s closed claims that occurred in the current school year. Condition: The Child Nutrition Cluster (CNC) includes the NSLP, SBP, SMP, SFSP, and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of child nutrition programs for the State. DOE partners with local SFAs and sponsors to provide benefits to school-aged children. DOE has assigned subrecipient monitoring responsibilities, which include administrative reviews and other reviews as needed, to the Child Nutrition Services (CNS) division. Administrative reviews of all SFAs are required at least once every five years; however, regulations also specify that high-risk SFAs must receive targeted follow-up within two years. CNS utilizes a spreadsheet to track and facilitate the reviews, and a USDA questionnaire to document the completion of the review. CNS does not have a mechanism to centrally track the high-risk SFAs to ensure follow-up occurs. CNS is required to retain documentation to support all elements of the administrative reviews and to demonstrate the SFA’s compliance with the program, even if corrective action occurs onsite during the review. The Office of the State Auditor (OSA) tested 29 administrative reviews completed by CNS and found: • Performance Standard 1 findings, deemed critical findings by USDA, were identified in four reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for one review. • Performance Standard 2 findings, also deemed critical by USDA, were identified in three reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for two reviews. • corrective action completed onsite was indicated in five reviews; however, CNS could not provide documentation to support the corrective action. • corrective action for three reviews did not fully address the deficiencies noted. • corrective action for two reviews was received more than 30 days late. • 12 reviews were closed; however, corrective action remained outstanding. • one sponsor submitted corrective action in October 2023, but as of audit testing in March 2025, CNS had not notified the sponsor of the approval and had not closed the sponsor’s review. • corrective action submitted from two SFAs was not approved, and the SFAs were not notified until nine months after their submission. • the review tracking spreadsheet was not fully completed or conflicted with information obtained from the administrative review for 16 reviews. • questionnaires were not fully completed for seven reviews. • USDA questionnaire sections related to FFVP and SMP were erroneously excluded for eight reviews. • the date for required corrective action to be provided was omitted for seven reviews. • one review was erroneously excluded from the review tracking spreadsheet. In addition to administrative reviews, CNS must perform base year reviews for all SFAs that have applied to participate in USDA Special Provision 2. These base year reviews provide the required information necessary to determine the level of claims the SFA may submit in the subsequent three years. After completion of the base year review, a letter detailing the results, including any adjustments to previously submitted claims, is provided to the SFA. The SFA is required to adjust claims and enrollment data through the claim revision process and CNS is responsible for verifying that the appropriate revisions have been completed. In fiscal year 2024, CNS identified 17 SFAs that required a base year review. OSA tested four base year reviews and identified three SFAs that did not properly revise claims and enrollment data, and CNS did not verify the accuracy of the revisions completed by the SFAs. In addition, one SFA had an eligibility determination that was not supported by the application. The income amount included in the application exceeded income requirements for reduced-price eligibility, but the SFA categorized the applicant as eligible for reduced-price meals. In the base year review, the application was not recategorized by CNS, and claims were not revised to match the eligibility determination. OSA cannot determine if unallowable costs exist through the audit of subrecipient monitoring activities, as required information was not collected. OSA has questioned costs through the audit of allowable costs/costs principles and eligibility, see findings 2024-031 Internal control over CNC reimbursements needs improvement and 2024-030 Internal control over CNC eligibility needs improvement, respectively. OSA selected non-statistical random samples. Context: In fiscal year 2024, CNC expenditures totaled approximately $68 million, of which $67.6 million was provided to 241 SFAs and sponsors. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. • Potential questioned costs and disallowances. Base year reviews provide authorization for the level of allowable claims the SFA can claim in subsequent periods. Without a base year review and necessary revisions, SFAs could be underclaiming or overclaiming costs. Recommendation: We recommend that the Department implement policies and procedures and increase oversight to ensure that: • reviews are completed as required and supporting documentation is retained; • high-risk SFAs are tracked and considered in planning follow-up reviews; • SFAs revise claims appropriately after a base year review; and • CNS verifies that claim adjustments occur as necessary. Corrective Action Plan: See F-17 Management’s Response: The Department agrees with this finding. The Department will improve tracking and create procedures to evaluate the Administrative Review Processes for the team. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 24-1203-06)

(2024-032) Title: Internal control over CNC subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 7 CFR 210.18; 7 CFR 225.7; U.S. Department of Agriculture Policy Memo SP 46-2015 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. The Department must conduct administrative reviews of School Food Authorities (SFAs) participating in the National School Lunch Program (NSLP) and the School Breakfast Program (SBP). These procedures must also be followed, as applicable, to conduct administrative reviews of the afterschool snacks, Special Milk Program (SMP) and the Fresh Fruit and Vegetable Program (FFVP). Documented corrective action is required for any degree of violation of general or critical areas identified in an administrative review. Corrective action may be provided at the time of the review; however, it must be postmarked or submitted to the State agency electronically no later than 30 days from the deadline for completion of each required corrective action. The State agency must maintain any documented corrective action on file for review by the Food and Nutrition Service (FNS). The Department must withhold all program payments to a SFA if: • documented corrective action for critical area violations is not provided with deadlines specified; or • corrective action for critical area violations was not completed. FNS may suspend or withhold program payments, in whole or in part, to those states failing to withhold payments in accordance with regulations and may withhold administrative funds. The Department must review sponsors to ensure compliance with Summer Food Service Program (SFSP) regulations. The Department is required to conduct a review of base year certification and benefit issuance documentation for any SFA requesting approval to participate in NSLP or SBP using U.S. Department of Agriculture (USDA) Special Provision 2, which is a provision established to reduce application burdens and simplify claim procedures. The review must occur at some point during the base year. If errors are identified as a result of the review, the Department must adjust all of the SFA’s closed claims that occurred in the current school year. Condition: The Child Nutrition Cluster (CNC) includes the NSLP, SBP, SMP, SFSP, and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of child nutrition programs for the State. DOE partners with local SFAs and sponsors to provide benefits to school-aged children. DOE has assigned subrecipient monitoring responsibilities, which include administrative reviews and other reviews as needed, to the Child Nutrition Services (CNS) division. Administrative reviews of all SFAs are required at least once every five years; however, regulations also specify that high-risk SFAs must receive targeted follow-up within two years. CNS utilizes a spreadsheet to track and facilitate the reviews, and a USDA questionnaire to document the completion of the review. CNS does not have a mechanism to centrally track the high-risk SFAs to ensure follow-up occurs. CNS is required to retain documentation to support all elements of the administrative reviews and to demonstrate the SFA’s compliance with the program, even if corrective action occurs onsite during the review. The Office of the State Auditor (OSA) tested 29 administrative reviews completed by CNS and found: • Performance Standard 1 findings, deemed critical findings by USDA, were identified in four reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for one review. • Performance Standard 2 findings, also deemed critical by USDA, were identified in three reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for two reviews. • corrective action completed onsite was indicated in five reviews; however, CNS could not provide documentation to support the corrective action. • corrective action for three reviews did not fully address the deficiencies noted. • corrective action for two reviews was received more than 30 days late. • 12 reviews were closed; however, corrective action remained outstanding. • one sponsor submitted corrective action in October 2023, but as of audit testing in March 2025, CNS had not notified the sponsor of the approval and had not closed the sponsor’s review. • corrective action submitted from two SFAs was not approved, and the SFAs were not notified until nine months after their submission. • the review tracking spreadsheet was not fully completed or conflicted with information obtained from the administrative review for 16 reviews. • questionnaires were not fully completed for seven reviews. • USDA questionnaire sections related to FFVP and SMP were erroneously excluded for eight reviews. • the date for required corrective action to be provided was omitted for seven reviews. • one review was erroneously excluded from the review tracking spreadsheet. In addition to administrative reviews, CNS must perform base year reviews for all SFAs that have applied to participate in USDA Special Provision 2. These base year reviews provide the required information necessary to determine the level of claims the SFA may submit in the subsequent three years. After completion of the base year review, a letter detailing the results, including any adjustments to previously submitted claims, is provided to the SFA. The SFA is required to adjust claims and enrollment data through the claim revision process and CNS is responsible for verifying that the appropriate revisions have been completed. In fiscal year 2024, CNS identified 17 SFAs that required a base year review. OSA tested four base year reviews and identified three SFAs that did not properly revise claims and enrollment data, and CNS did not verify the accuracy of the revisions completed by the SFAs. In addition, one SFA had an eligibility determination that was not supported by the application. The income amount included in the application exceeded income requirements for reduced-price eligibility, but the SFA categorized the applicant as eligible for reduced-price meals. In the base year review, the application was not recategorized by CNS, and claims were not revised to match the eligibility determination. OSA cannot determine if unallowable costs exist through the audit of subrecipient monitoring activities, as required information was not collected. OSA has questioned costs through the audit of allowable costs/costs principles and eligibility, see findings 2024-031 Internal control over CNC reimbursements needs improvement and 2024-030 Internal control over CNC eligibility needs improvement, respectively. OSA selected non-statistical random samples. Context: In fiscal year 2024, CNC expenditures totaled approximately $68 million, of which $67.6 million was provided to 241 SFAs and sponsors. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. • Potential questioned costs and disallowances. Base year reviews provide authorization for the level of allowable claims the SFA can claim in subsequent periods. Without a base year review and necessary revisions, SFAs could be underclaiming or overclaiming costs. Recommendation: We recommend that the Department implement policies and procedures and increase oversight to ensure that: • reviews are completed as required and supporting documentation is retained; • high-risk SFAs are tracked and considered in planning follow-up reviews; • SFAs revise claims appropriately after a base year review; and • CNS verifies that claim adjustments occur as necessary. Corrective Action Plan: See F-17 Management’s Response: The Department agrees with this finding. The Department will improve tracking and create procedures to evaluate the Administrative Review Processes for the team. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 24-1203-06)

(2024-032) Title: Internal control over CNC subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 7 CFR 210.18; 7 CFR 225.7; U.S. Department of Agriculture Policy Memo SP 46-2015 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. The Department must conduct administrative reviews of School Food Authorities (SFAs) participating in the National School Lunch Program (NSLP) and the School Breakfast Program (SBP). These procedures must also be followed, as applicable, to conduct administrative reviews of the afterschool snacks, Special Milk Program (SMP) and the Fresh Fruit and Vegetable Program (FFVP). Documented corrective action is required for any degree of violation of general or critical areas identified in an administrative review. Corrective action may be provided at the time of the review; however, it must be postmarked or submitted to the State agency electronically no later than 30 days from the deadline for completion of each required corrective action. The State agency must maintain any documented corrective action on file for review by the Food and Nutrition Service (FNS). The Department must withhold all program payments to a SFA if: • documented corrective action for critical area violations is not provided with deadlines specified; or • corrective action for critical area violations was not completed. FNS may suspend or withhold program payments, in whole or in part, to those states failing to withhold payments in accordance with regulations and may withhold administrative funds. The Department must review sponsors to ensure compliance with Summer Food Service Program (SFSP) regulations. The Department is required to conduct a review of base year certification and benefit issuance documentation for any SFA requesting approval to participate in NSLP or SBP using U.S. Department of Agriculture (USDA) Special Provision 2, which is a provision established to reduce application burdens and simplify claim procedures. The review must occur at some point during the base year. If errors are identified as a result of the review, the Department must adjust all of the SFA’s closed claims that occurred in the current school year. Condition: The Child Nutrition Cluster (CNC) includes the NSLP, SBP, SMP, SFSP, and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of child nutrition programs for the State. DOE partners with local SFAs and sponsors to provide benefits to school-aged children. DOE has assigned subrecipient monitoring responsibilities, which include administrative reviews and other reviews as needed, to the Child Nutrition Services (CNS) division. Administrative reviews of all SFAs are required at least once every five years; however, regulations also specify that high-risk SFAs must receive targeted follow-up within two years. CNS utilizes a spreadsheet to track and facilitate the reviews, and a USDA questionnaire to document the completion of the review. CNS does not have a mechanism to centrally track the high-risk SFAs to ensure follow-up occurs. CNS is required to retain documentation to support all elements of the administrative reviews and to demonstrate the SFA’s compliance with the program, even if corrective action occurs onsite during the review. The Office of the State Auditor (OSA) tested 29 administrative reviews completed by CNS and found: • Performance Standard 1 findings, deemed critical findings by USDA, were identified in four reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for one review. • Performance Standard 2 findings, also deemed critical by USDA, were identified in three reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for two reviews. • corrective action completed onsite was indicated in five reviews; however, CNS could not provide documentation to support the corrective action. • corrective action for three reviews did not fully address the deficiencies noted. • corrective action for two reviews was received more than 30 days late. • 12 reviews were closed; however, corrective action remained outstanding. • one sponsor submitted corrective action in October 2023, but as of audit testing in March 2025, CNS had not notified the sponsor of the approval and had not closed the sponsor’s review. • corrective action submitted from two SFAs was not approved, and the SFAs were not notified until nine months after their submission. • the review tracking spreadsheet was not fully completed or conflicted with information obtained from the administrative review for 16 reviews. • questionnaires were not fully completed for seven reviews. • USDA questionnaire sections related to FFVP and SMP were erroneously excluded for eight reviews. • the date for required corrective action to be provided was omitted for seven reviews. • one review was erroneously excluded from the review tracking spreadsheet. In addition to administrative reviews, CNS must perform base year reviews for all SFAs that have applied to participate in USDA Special Provision 2. These base year reviews provide the required information necessary to determine the level of claims the SFA may submit in the subsequent three years. After completion of the base year review, a letter detailing the results, including any adjustments to previously submitted claims, is provided to the SFA. The SFA is required to adjust claims and enrollment data through the claim revision process and CNS is responsible for verifying that the appropriate revisions have been completed. In fiscal year 2024, CNS identified 17 SFAs that required a base year review. OSA tested four base year reviews and identified three SFAs that did not properly revise claims and enrollment data, and CNS did not verify the accuracy of the revisions completed by the SFAs. In addition, one SFA had an eligibility determination that was not supported by the application. The income amount included in the application exceeded income requirements for reduced-price eligibility, but the SFA categorized the applicant as eligible for reduced-price meals. In the base year review, the application was not recategorized by CNS, and claims were not revised to match the eligibility determination. OSA cannot determine if unallowable costs exist through the audit of subrecipient monitoring activities, as required information was not collected. OSA has questioned costs through the audit of allowable costs/costs principles and eligibility, see findings 2024-031 Internal control over CNC reimbursements needs improvement and 2024-030 Internal control over CNC eligibility needs improvement, respectively. OSA selected non-statistical random samples. Context: In fiscal year 2024, CNC expenditures totaled approximately $68 million, of which $67.6 million was provided to 241 SFAs and sponsors. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. • Potential questioned costs and disallowances. Base year reviews provide authorization for the level of allowable claims the SFA can claim in subsequent periods. Without a base year review and necessary revisions, SFAs could be underclaiming or overclaiming costs. Recommendation: We recommend that the Department implement policies and procedures and increase oversight to ensure that: • reviews are completed as required and supporting documentation is retained; • high-risk SFAs are tracked and considered in planning follow-up reviews; • SFAs revise claims appropriately after a base year review; and • CNS verifies that claim adjustments occur as necessary. Corrective Action Plan: See F-17 Management’s Response: The Department agrees with this finding. The Department will improve tracking and create procedures to evaluate the Administrative Review Processes for the team. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 24-1203-06)

(2024-032) Title: Internal control over CNC subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 7 CFR 210.18; 7 CFR 225.7; U.S. Department of Agriculture Policy Memo SP 46-2015 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. The Department must conduct administrative reviews of School Food Authorities (SFAs) participating in the National School Lunch Program (NSLP) and the School Breakfast Program (SBP). These procedures must also be followed, as applicable, to conduct administrative reviews of the afterschool snacks, Special Milk Program (SMP) and the Fresh Fruit and Vegetable Program (FFVP). Documented corrective action is required for any degree of violation of general or critical areas identified in an administrative review. Corrective action may be provided at the time of the review; however, it must be postmarked or submitted to the State agency electronically no later than 30 days from the deadline for completion of each required corrective action. The State agency must maintain any documented corrective action on file for review by the Food and Nutrition Service (FNS). The Department must withhold all program payments to a SFA if: • documented corrective action for critical area violations is not provided with deadlines specified; or • corrective action for critical area violations was not completed. FNS may suspend or withhold program payments, in whole or in part, to those states failing to withhold payments in accordance with regulations and may withhold administrative funds. The Department must review sponsors to ensure compliance with Summer Food Service Program (SFSP) regulations. The Department is required to conduct a review of base year certification and benefit issuance documentation for any SFA requesting approval to participate in NSLP or SBP using U.S. Department of Agriculture (USDA) Special Provision 2, which is a provision established to reduce application burdens and simplify claim procedures. The review must occur at some point during the base year. If errors are identified as a result of the review, the Department must adjust all of the SFA’s closed claims that occurred in the current school year. Condition: The Child Nutrition Cluster (CNC) includes the NSLP, SBP, SMP, SFSP, and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of child nutrition programs for the State. DOE partners with local SFAs and sponsors to provide benefits to school-aged children. DOE has assigned subrecipient monitoring responsibilities, which include administrative reviews and other reviews as needed, to the Child Nutrition Services (CNS) division. Administrative reviews of all SFAs are required at least once every five years; however, regulations also specify that high-risk SFAs must receive targeted follow-up within two years. CNS utilizes a spreadsheet to track and facilitate the reviews, and a USDA questionnaire to document the completion of the review. CNS does not have a mechanism to centrally track the high-risk SFAs to ensure follow-up occurs. CNS is required to retain documentation to support all elements of the administrative reviews and to demonstrate the SFA’s compliance with the program, even if corrective action occurs onsite during the review. The Office of the State Auditor (OSA) tested 29 administrative reviews completed by CNS and found: • Performance Standard 1 findings, deemed critical findings by USDA, were identified in four reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for one review. • Performance Standard 2 findings, also deemed critical by USDA, were identified in three reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for two reviews. • corrective action completed onsite was indicated in five reviews; however, CNS could not provide documentation to support the corrective action. • corrective action for three reviews did not fully address the deficiencies noted. • corrective action for two reviews was received more than 30 days late. • 12 reviews were closed; however, corrective action remained outstanding. • one sponsor submitted corrective action in October 2023, but as of audit testing in March 2025, CNS had not notified the sponsor of the approval and had not closed the sponsor’s review. • corrective action submitted from two SFAs was not approved, and the SFAs were not notified until nine months after their submission. • the review tracking spreadsheet was not fully completed or conflicted with information obtained from the administrative review for 16 reviews. • questionnaires were not fully completed for seven reviews. • USDA questionnaire sections related to FFVP and SMP were erroneously excluded for eight reviews. • the date for required corrective action to be provided was omitted for seven reviews. • one review was erroneously excluded from the review tracking spreadsheet. In addition to administrative reviews, CNS must perform base year reviews for all SFAs that have applied to participate in USDA Special Provision 2. These base year reviews provide the required information necessary to determine the level of claims the SFA may submit in the subsequent three years. After completion of the base year review, a letter detailing the results, including any adjustments to previously submitted claims, is provided to the SFA. The SFA is required to adjust claims and enrollment data through the claim revision process and CNS is responsible for verifying that the appropriate revisions have been completed. In fiscal year 2024, CNS identified 17 SFAs that required a base year review. OSA tested four base year reviews and identified three SFAs that did not properly revise claims and enrollment data, and CNS did not verify the accuracy of the revisions completed by the SFAs. In addition, one SFA had an eligibility determination that was not supported by the application. The income amount included in the application exceeded income requirements for reduced-price eligibility, but the SFA categorized the applicant as eligible for reduced-price meals. In the base year review, the application was not recategorized by CNS, and claims were not revised to match the eligibility determination. OSA cannot determine if unallowable costs exist through the audit of subrecipient monitoring activities, as required information was not collected. OSA has questioned costs through the audit of allowable costs/costs principles and eligibility, see findings 2024-031 Internal control over CNC reimbursements needs improvement and 2024-030 Internal control over CNC eligibility needs improvement, respectively. OSA selected non-statistical random samples. Context: In fiscal year 2024, CNC expenditures totaled approximately $68 million, of which $67.6 million was provided to 241 SFAs and sponsors. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. • Potential questioned costs and disallowances. Base year reviews provide authorization for the level of allowable claims the SFA can claim in subsequent periods. Without a base year review and necessary revisions, SFAs could be underclaiming or overclaiming costs. Recommendation: We recommend that the Department implement policies and procedures and increase oversight to ensure that: • reviews are completed as required and supporting documentation is retained; • high-risk SFAs are tracked and considered in planning follow-up reviews; • SFAs revise claims appropriately after a base year review; and • CNS verifies that claim adjustments occur as necessary. Corrective Action Plan: See F-17 Management’s Response: The Department agrees with this finding. The Department will improve tracking and create procedures to evaluate the Administrative Review Processes for the team. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 24-1203-06)

(2024-043) Title: Internal control over HAF Program subrecipient monitoring needs improvement Prior Year Findings: None State Department: Professional and Financial Regulation State Bureau: Consumer Credit Protection Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Homeowner Assistance Fund Program (COVID-19) Assistance Listing Number: 21.026 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. • verify that the subrecipient is audited as required when a subrecipient’s Federal award expenditures are expected to equal or exceed $750,000 during the fiscal year. • monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Homeowner Assistance Fund (HAF) Program provides funding to mitigate financial hardships associated with the pandemic, including preventing homeowner mortgage delinquencies, defaults, foreclosures, and loss of utilities or home energy services and displacements of homeowners experiencing financial hardships. In fiscal year 2024, the Department passed through HAF Program funds to one subrecipient responsible for administering the program. The Department contracted with a vendor to perform all subrecipient monitoring for the HAF Program; however, only one monitoring report for the first quarter of fiscal year 2024 had been received by the Department at the time of audit testing in February 2025. No subrecipient monitoring information was received by the Department during the actual use of the grant award in fiscal year 2024. As a result, the Department had no assurance in fiscal year 2024 that: • the subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward was evaluated for purposes of determining the appropriate subrecipient monitoring procedures. • the subrecipient received a Single Audit as required. The Office of the State Auditor reviewed the quarterly monitoring report received from the vendor and noted that the subrecipient’s Single Audit requirement and related monitoring was not addressed. • the activities of the subrecipient were monitored as necessary to ensure that the subaward was used for authorized purposes and in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals were achieved. In addition to untimely vendor subrecipient monitoring reports, the Department’s review and approval of subrecipient reimbursement requests was not adequately designed, as submission of detailed expenditure information with the subrecipient’s requests for reimbursement of HAF Program funds was not required. A summary spreadsheet outlining actual and projected expenditures for the second-tier subrecipient was the only support provided to the Department with each reimbursement request, which does not provide adequate detail to ensure that the subaward was used for authorized purposes. Context: In fiscal year 2024, the Department expended $29.4 million in HAF Program funds; the entire amount was passed through to the subrecipient. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Lack of ongoing or adequate subrecipient monitoring procedures could result in subrecipient noncompliance that would go undetected during the award term. Recommendation: We recommend that the Department develop and implement policies and procedures to ensure that: • all Federal award program subrecipients of the Department are subject to ongoing monitoring activities during the grant award term. • detailed documentation in support of subrecipient reimbursement requests is received prior to payment approval. Corrective Action Plan: See F-20 Management’s Response: The Department agrees with this finding. The Department has contracted with a vendor to perform subrecipient monitoring of the HAF program. The Department will ensure that subrecipient reports adequately detail expenditures. Contact: Rachel Hendsbee, Director, Administrative Services Division, Department of Professional and Financial Regulation, 207-624-8500 (State Number: 24-1698-02)

(2024-044) Title: Internal control over CSLFRF reporting needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Administrative and Financial Services State Bureau: Security and Employment Service Center Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Assistance Listing Number: 21.027 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332(b); 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with reporting requirements. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number (ALN) and include the total amount provided to subrecipients from each Federal program. Condition: The Department of Administrative and Financial Services’ Security and Employment Service Center (SESC) is responsible for accurately recording information needed to report on the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Quarterly Project and Expenditure Reports. Information from these CSLFRF reports is used by the Office of the State Controller for SEFA preparation. The Office of the State Auditor reviewed amounts reported on the SEFA and identified $9.7 million of Federal expenditures incorrectly reported as amounts provided to subrecipients that should have been reported as direct expenditures. SESC inaccurately identified vendors as subrecipients. As a result, vendor payments were incorrectly classified as subrecipient payments on the CSLFRF Quarterly Project and Expenditure Reports and were incorrectly included in the initial amount reported on the SEFA as amounts provided to subrecipients. Context: Payments to the providers totaled $9.7 million of the $209.6 million in fiscal year 2024 CSLFRF expenditures. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Incomplete or inaccurate reporting of expenditures on the CSLFRF reports and SEFA, which are submitted to the Federal government, may result in incorrect information used for programmatic, policy or statistical purposes. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement policies and procedures to ensure contractors and subrecipients are appropriately classified and reported on the CSLFRF Quarterly Project and Expenditure Reports and SEFA. Corrective Action Plan: See F-20 Management’s Response: The Department agrees with this finding. The Security and Employment Service will continue to work with our partner agencies to help ensure the sub-recipient/vendor classification is appropriately determined when the initial contracts are written. In this case, the contracts ended in July 2023 and the contracting agency did not amend the contracts to change the classification. Contact: Marilyn Leimbach, Director, SESC, DAFS, 207-248-2556 (State Number: 24-1699-03)

(2024-045) Title: Internal control over CSLFRF subrecipient risk evaluation procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Labor State Bureau: Commissioner’s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Assistance Listing Number: 21.027 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: As part of the American Rescue Plan Act, the State was advanced approximately $997 million in Federal Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) to support its response to and recovery from the COVID-19 public health emergency. The Maine Department of Labor (MDOL) partnered with subrecipients to support the administration of CSLFRF. MDOL has a documented policy that requires subrecipient risk evaluations. The Office of the State Auditor (OSA) tested 44 subrecipients paid by various State agencies under CSLFRF, including five MDOL subrecipients, to ensure that proper subrecipient monitoring was performed as required by Federal regulations. MDOL subrecipient monitoring procedures included providing Federal award information in grant award agreements, communicating program guidelines, establishing reporting requirements, providing technical assistance, and communicating with the subrecipients to discuss program performance; however, MDOL could not provide evidence to demonstrate that monitoring procedures were established in response to an evaluation of the subrecipient’s risk of noncompliance for the five MDOL subrecipients tested. OSA selected a nonstatistical random sample. Context: During fiscal year 2024, the Department provided $5.8 million to 39 MDOL subrecipients, from a total of $137.9 million provided to all CSLFRF subrecipients. Cause: • Lack of supervisory oversight • Lack of adequate procedures Effect: Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department enhance oversight over policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-20 Management’s Response: The Department agrees with this finding. MDOL received funds via the Maine Jobs and Recovery Plan to accomplish several goals across 20 unique initiatives. To best meet the goals of several initiatives, MDOL selected various partners to work with - via a competitive Request for Applications (RFA) process or other contractual arrangement. MDOL’s competitive RFA process required evaluating individual applicants’ previous experience in managing grants and delivering similar programs, which directly correlated with selection criteria and grantee scoring. After selection, grantees are required to submit quarterly performance reports and participate in grantee check-in calls at least twice per year. For grantees not on track to meet their performance goals, monthly calls were held with interim progress milestones set to track performance. While the above procedures were implemented for all subrecipients, going forward, the Department will document that monitoring procedures were established in response to an evaluation of the subrecipient’s risk of noncompliance. Contact: Kimberley Moore, Director, Bureau of Employment Services, MDOL, 207-620-0183 (State Number: 24-1699-04)

(2024-049) Title: Internal control over ESF subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Education State Bureau: Commissioner’s Office Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number: 84.425D, 84.425R, 84.425U Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.313; 2 CFR 200.332 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. For equipment acquired with Federal funding, records must be maintained that include: • a description and identification number; • the source of funding, including the Federal Award Identification Number; • who holds title and the acquisition date; • the cost of the property, including the percentage of Federal participation in the project costs for the Federal award under which the property was acquired; • the location, use and condition; and • any ultimate disposition data including the date of disposal and sale price of the property. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Condition: The Education Stabilization Fund (ESF) provides funding to school administrative units (SAUs) to purchase equipment for use in preventing, preparing for, or responding to the COVID-19 pandemic. All SAU equipment purchases reimbursed with ESF are subject to applicable inventory control, log maintenance, and disposition requirements consistent with Federal regulations for equipment and real property management. In the fiscal year 2022 and 2023 audits, the Office of the State Auditor identified that the Department did not have procedures in place to track SAU equipment purchases reimbursed with ESF. During fiscal year 2024, the Department developed policies and procedures to track SAU equipment purchases reimbursed with ESF. These procedures outline documentation to be obtained from SAUs during the next subrecipient monitoring activity. Because the Department has not completed the subrecipient monitoring to obtain the necessary documentation, the Department does not have assurance that: • a complete and accurate record of all equipment purchased with ESF was maintained by each SAU. • subrecipients are in compliance with Federal regulations for equipment and real property management. Context: In fiscal year 2024, ESF expenditures totaled $194.1 million, of which $175.1 million was paid to subrecipient SAUs. Because a complete and accurate record of equipment purchased with ESF is not maintained, the amount of equipment purchased in fiscal year 2024 is unknown. Cause: • Newly developed policies and procedures have not been fully implemented. • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • SAUs may not be in compliance with equipment and real property management requirements. • Recordkeeping for assets purchased with ESF is not adequate, and as a result, the assets may not be properly safeguarded. Recommendation: We recommend that the Department conduct necessary subrecipient monitoring activities to ensure that a complete and accurate record of all equipment purchased with ESF is maintained by the Department and by each SAU. This record should be documented and maintained in order to verify ongoing compliance with Federal regulations for equipment and real property management. Corrective Action Plan: See F-21 Management’s Response: The Department agrees with this finding. The former Office of Federal Emergency Relief Programs will incorporate the collection of this information in the fiscal year 2024 and 2025 annual performance report. All equipment purchased with ESF will be self-reported by each individual School Administrative Unit. Contact: Shelly Chasse-Johndro, Director, ESEA, DOE, 207-458-3180 (State Number: 24-1235-01)

(2024-049) Title: Internal control over ESF subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Education State Bureau: Commissioner’s Office Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number: 84.425D, 84.425R, 84.425U Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.313; 2 CFR 200.332 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. For equipment acquired with Federal funding, records must be maintained that include: • a description and identification number; • the source of funding, including the Federal Award Identification Number; • who holds title and the acquisition date; • the cost of the property, including the percentage of Federal participation in the project costs for the Federal award under which the property was acquired; • the location, use and condition; and • any ultimate disposition data including the date of disposal and sale price of the property. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Condition: The Education Stabilization Fund (ESF) provides funding to school administrative units (SAUs) to purchase equipment for use in preventing, preparing for, or responding to the COVID-19 pandemic. All SAU equipment purchases reimbursed with ESF are subject to applicable inventory control, log maintenance, and disposition requirements consistent with Federal regulations for equipment and real property management. In the fiscal year 2022 and 2023 audits, the Office of the State Auditor identified that the Department did not have procedures in place to track SAU equipment purchases reimbursed with ESF. During fiscal year 2024, the Department developed policies and procedures to track SAU equipment purchases reimbursed with ESF. These procedures outline documentation to be obtained from SAUs during the next subrecipient monitoring activity. Because the Department has not completed the subrecipient monitoring to obtain the necessary documentation, the Department does not have assurance that: • a complete and accurate record of all equipment purchased with ESF was maintained by each SAU. • subrecipients are in compliance with Federal regulations for equipment and real property management. Context: In fiscal year 2024, ESF expenditures totaled $194.1 million, of which $175.1 million was paid to subrecipient SAUs. Because a complete and accurate record of equipment purchased with ESF is not maintained, the amount of equipment purchased in fiscal year 2024 is unknown. Cause: • Newly developed policies and procedures have not been fully implemented. • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • SAUs may not be in compliance with equipment and real property management requirements. • Recordkeeping for assets purchased with ESF is not adequate, and as a result, the assets may not be properly safeguarded. Recommendation: We recommend that the Department conduct necessary subrecipient monitoring activities to ensure that a complete and accurate record of all equipment purchased with ESF is maintained by the Department and by each SAU. This record should be documented and maintained in order to verify ongoing compliance with Federal regulations for equipment and real property management. Corrective Action Plan: See F-21 Management’s Response: The Department agrees with this finding. The former Office of Federal Emergency Relief Programs will incorporate the collection of this information in the fiscal year 2024 and 2025 annual performance report. All equipment purchased with ESF will be self-reported by each individual School Administrative Unit. Contact: Shelly Chasse-Johndro, Director, ESEA, DOE, 207-458-3180 (State Number: 24-1235-01)

(2024-049) Title: Internal control over ESF subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Education State Bureau: Commissioner’s Office Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number: 84.425D, 84.425R, 84.425U Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.313; 2 CFR 200.332 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. For equipment acquired with Federal funding, records must be maintained that include: • a description and identification number; • the source of funding, including the Federal Award Identification Number; • who holds title and the acquisition date; • the cost of the property, including the percentage of Federal participation in the project costs for the Federal award under which the property was acquired; • the location, use and condition; and • any ultimate disposition data including the date of disposal and sale price of the property. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Condition: The Education Stabilization Fund (ESF) provides funding to school administrative units (SAUs) to purchase equipment for use in preventing, preparing for, or responding to the COVID-19 pandemic. All SAU equipment purchases reimbursed with ESF are subject to applicable inventory control, log maintenance, and disposition requirements consistent with Federal regulations for equipment and real property management. In the fiscal year 2022 and 2023 audits, the Office of the State Auditor identified that the Department did not have procedures in place to track SAU equipment purchases reimbursed with ESF. During fiscal year 2024, the Department developed policies and procedures to track SAU equipment purchases reimbursed with ESF. These procedures outline documentation to be obtained from SAUs during the next subrecipient monitoring activity. Because the Department has not completed the subrecipient monitoring to obtain the necessary documentation, the Department does not have assurance that: • a complete and accurate record of all equipment purchased with ESF was maintained by each SAU. • subrecipients are in compliance with Federal regulations for equipment and real property management. Context: In fiscal year 2024, ESF expenditures totaled $194.1 million, of which $175.1 million was paid to subrecipient SAUs. Because a complete and accurate record of equipment purchased with ESF is not maintained, the amount of equipment purchased in fiscal year 2024 is unknown. Cause: • Newly developed policies and procedures have not been fully implemented. • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • SAUs may not be in compliance with equipment and real property management requirements. • Recordkeeping for assets purchased with ESF is not adequate, and as a result, the assets may not be properly safeguarded. Recommendation: We recommend that the Department conduct necessary subrecipient monitoring activities to ensure that a complete and accurate record of all equipment purchased with ESF is maintained by the Department and by each SAU. This record should be documented and maintained in order to verify ongoing compliance with Federal regulations for equipment and real property management. Corrective Action Plan: See F-21 Management’s Response: The Department agrees with this finding. The former Office of Federal Emergency Relief Programs will incorporate the collection of this information in the fiscal year 2024 and 2025 annual performance report. All equipment purchased with ESF will be self-reported by each individual School Administrative Unit. Contact: Shelly Chasse-Johndro, Director, ESEA, DOE, 207-458-3180 (State Number: 24-1235-01)

(2024-050) Title: Internal control over ICA program subrecipient cash management needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Division of Contract Management Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Immunization Cooperative Agreements (COVID-19) Assistance Listing Number: 93.268 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. The Department must monitor the activities of the subrecipient as necessary to ensure that subawards are used for authorized purposes and in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Condition: The Department’s Division of Contract Management (DCM) has three methods for providing payments to subrecipients: cost-settled, cost-settled by invoice, and fee-for-service subawards. • For cost-settled subawards, DCM procedures include making equal advance monthly payments and then reconciling those amounts to the quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • For “cost-settled by invoice” (reimbursement) subawards, DCM procedures do not require subrecipients to include supporting documentation with monthly requests for reimbursement nor do they request supporting documentation at a subsequent date. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • Cash management requirements are not applicable for fee-for-service subawards. Maine Center for Disease Control & Prevention (MeCDC) is responsible for ensuring the Immunization Cooperative Agreement (ICA) program’s subrecipients comply with Federal requirements; however, MeCDC’s subrecipient monitoring procedures do not include review of subrecipient compliance with cash management requirements. The ICA program’s subawards are either cost-settled or cost-settled by invoice. Therefore, DCM and MeCDC procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Additionally, MeCDC’s monitoring procedures do not include review of subrecipient invoices to ensure ICA grant funds are used for allowable purposes. Context: In fiscal year 2024, the Department provided $1.9 million to subrecipients from ICA grant funds totaling $31.1 million. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that MeCDC: • collaborate with DCM to implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the ICA program. • implement monitoring procedures over ICA program subrecipients to ensure that grant funds are used for allowable purposes. Corrective Action Plan: See F-22 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of funds. Payments are made as close as administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1)...that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Anthony Madden, Deputy Director, Division of Audit, DHHS, 207-287-2834 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation selectively emphasizes a single sentence from the broader paragraph, omitting critical context that informs the regulation’s full intent. According to the 2024 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR section 200.305(b)(1)). 2 CFR section 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. A full reading of the provision indicates that “administratively feasible” does not negate the obligation to implement effective controls that minimize this gap, nor does it permit delays or inadequate oversight in Federal cash management. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. Additionally, the Department does not require subrecipients to submit invoice documentation to substantiate the timing, amount, or nature of expenditures included in the request of Federal funds. As a result, the Department cannot demonstrate an adequate level of monitoring, as there is no evidence that they collect the necessary information to ensure compliance with Federal cash management requirements. Furthermore, the Department did not comment on the lack of monitoring procedures over subrecipient invoices to ensure Federal grant funds are used for allowable purposes. The finding remains as stated. (State Number: 24-1118-01)

(2024-050) Title: Internal control over ICA program subrecipient cash management needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Division of Contract Management Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Immunization Cooperative Agreements (COVID-19) Assistance Listing Number: 93.268 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. The Department must monitor the activities of the subrecipient as necessary to ensure that subawards are used for authorized purposes and in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Condition: The Department’s Division of Contract Management (DCM) has three methods for providing payments to subrecipients: cost-settled, cost-settled by invoice, and fee-for-service subawards. • For cost-settled subawards, DCM procedures include making equal advance monthly payments and then reconciling those amounts to the quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • For “cost-settled by invoice” (reimbursement) subawards, DCM procedures do not require subrecipients to include supporting documentation with monthly requests for reimbursement nor do they request supporting documentation at a subsequent date. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • Cash management requirements are not applicable for fee-for-service subawards. Maine Center for Disease Control & Prevention (MeCDC) is responsible for ensuring the Immunization Cooperative Agreement (ICA) program’s subrecipients comply with Federal requirements; however, MeCDC’s subrecipient monitoring procedures do not include review of subrecipient compliance with cash management requirements. The ICA program’s subawards are either cost-settled or cost-settled by invoice. Therefore, DCM and MeCDC procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Additionally, MeCDC’s monitoring procedures do not include review of subrecipient invoices to ensure ICA grant funds are used for allowable purposes. Context: In fiscal year 2024, the Department provided $1.9 million to subrecipients from ICA grant funds totaling $31.1 million. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that MeCDC: • collaborate with DCM to implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the ICA program. • implement monitoring procedures over ICA program subrecipients to ensure that grant funds are used for allowable purposes. Corrective Action Plan: See F-22 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of funds. Payments are made as close as administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1)...that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Anthony Madden, Deputy Director, Division of Audit, DHHS, 207-287-2834 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation selectively emphasizes a single sentence from the broader paragraph, omitting critical context that informs the regulation’s full intent. According to the 2024 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR section 200.305(b)(1)). 2 CFR section 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. A full reading of the provision indicates that “administratively feasible” does not negate the obligation to implement effective controls that minimize this gap, nor does it permit delays or inadequate oversight in Federal cash management. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. Additionally, the Department does not require subrecipients to submit invoice documentation to substantiate the timing, amount, or nature of expenditures included in the request of Federal funds. As a result, the Department cannot demonstrate an adequate level of monitoring, as there is no evidence that they collect the necessary information to ensure compliance with Federal cash management requirements. Furthermore, the Department did not comment on the lack of monitoring procedures over subrecipient invoices to ensure Federal grant funds are used for allowable purposes. The finding remains as stated. (State Number: 24-1118-01)

(2024-055) Title: Internal control over TANF program subrecipient cash management needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Division of Contract Management Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. The Department must monitor the activities of the subrecipient as necessary to ensure that subawards are used for authorized purposes and in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Condition: The Department’s Division of Contract Management (DCM) has three methods for providing payments to subrecipients: cost-settled, cost-settled by invoice, and fee-for-service subawards. • For cost-settled subawards, DCM procedures include making equal advance monthly payments and then reconciling those amounts to the quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • For “cost-settled by invoice” (reimbursement) subawards, DCM procedures do not require subrecipients to include supporting documentation with monthly requests for reimbursement nor do they request supporting documentation at a subsequent date. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • Cash management requirements are not applicable for fee-for-service subawards. The Office for Family Independence (OFI) is responsible for ensuring the Temporary Assistance for Needy Families (TANF) program’s subrecipients comply with Federal requirements; however, OFI’s subrecipient monitoring procedures do not include review of subrecipient compliance with cash management requirements. The TANF program’s subawards are cost-settled, cost-settled by invoice, or fee-for-service. Therefore, DCM and OFI procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Additionally, OFI’s monitoring procedures do not include review of subrecipient invoices to ensure TANF grant funds are used for allowable purposes. Context: In fiscal year 2024, the Department provided $34.2 million to subrecipients from TANF grant funds totaling $92.4 million. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that OFI: • collaborate with DCM to implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the TANF program. • implement monitoring procedures over TANF program subrecipients to ensure that grant funds are used for allowable purposes. Corrective Action Plan: See F-23 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of the funds. Payments are made as close as administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1)...that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Anthony Madden, Deputy Director, Division of Audit, DHHS, 207-287-2834 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation selectively emphasizes a single sentence from the broader paragraph, omitting critical context that informs the regulation’s full intent. According to the 2024 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR section 200.305(b)(1)). 2 CFR section 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. A full reading of the provision indicates that “administratively feasible” does not negate the obligation to implement effective controls that minimize this gap, nor does it permit delays or inadequate oversight in Federal cash management. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. Additionally, the Department does not require subrecipients to submit invoice documentation to substantiate the timing, amount, or nature of expenditures included in the request of Federal funds. As a result, the Department cannot demonstrate an adequate level of monitoring, as there is no evidence that they collect the necessary information to ensure compliance with Federal cash management requirements. Furthermore, the Department did not comment on the lack of monitoring procedures over subrecipient invoices to ensure Federal grant funds are used for allowable purposes. The finding remains as stated. (State Number: 24-1111-04)

(2024-056) Title: Internal control over TANF subrecipient risk evaluation procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Division of Contract Management Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Department determines subrecipient monitoring procedures based on the justification for the selection of the subrecipient and the services provided. If a subaward is competitively bid, the Department’s Division of Contract Management’s (DCM) Competitive Procurement Unit seeks input from the Department of Health and Human Services’ Service Center, the Department’s Division of Audit, and DCM’s Contracts Unit regarding known issues with the provider who submitted the bid. Those responses are collected and provided to the evaluation team, which consists of various program personnel. However, for both competitively bid and non-competitively bid subawards, the level of subrecipient monitoring that the Department performs is based on the services provided and not based on the specific subrecipient. The Office of the State Auditor (OSA) selected six TANF subrecipients, which included 11 subawards that were competitively bid and eight subawards that were not competitively bid and found that for: • seven competitively bid subawards, DCM provided evidence to support that feedback was solicited from other Bureaus for any known issues or prior noncompliance; however, evidence could not be provided to support the level of subrecipient monitoring that was performed based on a risk evaluation. • four competitively bid subawards, DCM could not provide evidence to support that feedback was solicited from other Bureaus for any known issues or prior noncompliance. In addition, evidence could not be provided to support the level of subrecipient monitoring that was performed based on a risk evaluation. • eight non-competitively bid subawards, evidence could not be provided to support the level of subrecipient monitoring that was performed based on a risk evaluation. OSA selected a non-statistical random sample. Context: The Department provided $34.2 million from a total of $92.4 million to TANF subrecipients during fiscal year 2024. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-24 Management’s Response: The Department disagrees with this finding. The Department evaluates risk on its subrecipients for the purpose of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department’s assessments are inconsistent with Federal regulation requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, not all subawards are competitively bid. As stated in the Condition, for both competitively bid and non-competitively bid subawards, the level of subrecipient monitoring that the Department performs is based on the services provided, rather than on an evaluation of risk assessed for specific subrecipients. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o The Department did not provide documentation to support that the level of subrecipient monitoring performed correlates to MAAP; and o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 24-1111-07)

2024-003 – Subrecipient Monitoring – Internal Control and Compliance over Subrecipient Monitoring (Significant Deficiency) Identification of the Federal Program: Assistance Listing Number: 21.027 Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: Department of Treasury Pass-Through Entity: N/A Federal Award Number and Award Year: N/A Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): C.F.R. § 200.332 prescribes that the pass-through entity must conduct monitoring activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. 3. Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. 4. The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. Condition: During the review of subrecipient monitoring records, several areas were noted for improvement: • For two (2) out of three (3) subrecipients, the official agreement was not formally documented. One subrecipient agreement was executed via internal resolution and email approval; another subrecipient’s agreement lacked sufficient identification and award details, omitting key funding terminology. • The City’s Subrecipient Monitoring Policy, which became effective on April 17, 2024, does not cover the period before the policy took effect. For all three (3) subrecipients, the City is unable to provide any documentation of the review of Financial and Performance Reports. • The required Pre-Award Risk Assessments have not been provided for at least one subrecipient because the City’s Subrecipient Monitoring Policy, which became effective on April 17, 2024, does not cover the period before the policy took effect. Cause: These conditions appear to stem from transitional challenges as the City implemented the new Monitoring Policy on April 17, 2024. In addition, there is an opportunity to enhance the documentation processes by moving from informal approvals to more formal subrecipient agreements, and by ensuring that Pre-Award Risk Assessments are consistently documented and maintained. Effect or Potential Effect: The City was not able to do the necessary subrecipient monitoring activities resulted to internal control and compliance requirement finding. Questioned Costs: None. Context: See condition above for context of the finding. Identification as a Repeat Finding, If Applicable: Yes. See prior year finding 2023-006. Recommendation: We recommended the City to fully implement its Monitoring Policy by formalizing subrecipient agreements, strengthening internal controls, and establishing consistent processes for documenting Pre-Award Risk Assessments and Financial and Performance Reports. Views of Responsible Officials: Management concurs.