Findings Citing § 200.332

Subrecipient Monitoring Program Name: HIV Care Formula Grants (Ryan White HIV/AIDS Program Part B) (Assistance Listing 93.917) Federal Award Agency: United States Department of Health and Human Services Award Year: Federal Fiscal Year 2024 Federal Award Numbers: 5 X07HA00022-33-00 and 6 X07HA00022-34-01 Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.332(e) provides that the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subrecipient used the subaward for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward and ensure that they achieve performance goals. This includes reviewing financial and performance reports required by the pass-through entity. The Ryan White HIV/AIDS Program Part B Manual requires an annual on-site financial review of all subrecipients to ensure compliance with federal and state requirements and the terms and conditions of the department’s contract. Condition Our review of the Department of Public Health (DPH) monitoring procedures for six not-for-profit and one for-profit subrecipients disclosed that the department did not conduct annual on-site financial review visits for any of the six not-for-profit subrecipients. Context During the fiscal year ended June 30, 2024, DPH provided $4,262,325 to six not-for-profit subrecipients and $21,633,283 to a for-profit subrecipient for AIDS health care and support services. We selected all seven fiscal year 2024 subrecipients for review as DPH had not completed the monitoring site visits for fiscal year 2025 funds. During the fiscal year 2025, the department provided $13,216,793 to subrecipients. Questioned Costs $0 Effect DPH had reduced assurance that its subrecipients used federal funds for allowable activities. Cause The department did not complete the financial reviews for fiscal year 2024 because staff lacked proper training, which was necessary due to new federal compliance requirements and DPH’s recent implementation of new audit software. Prior Audit Finding We previously reported this as finding 2024-201 and in one prior audit. Recommendation The Department of Public Health should strengthen internal controls to ensure compliance with federal requirements for monitoring subrecipients of the Ryan White HIV/AIDS Program Part B. Views of Responsible Officials “We agree with this finding. With the implementation of the new auditing software, Management Assurance will create a comprehensive, trackable financial review program and will ensure the reviews are completed in accordance with Federal guidance. We anticipate having the software fully implemented and the financial review program operational by March 01, 2026; the financial reviewer will be trained on the software and the program requirements no later than May 01, 2026. The financial reviews will begin as soon as possible after the reviewer completes their training; we intend to have a completed financial review for all Ryan White regional leads by year-end 2026.”

Federal Grantor: Department of Housing and Urban Development Program: COVID-19 Community Development Block Grants/Entitlement Grants (CDBG) Program Award No. and Year: B20-MW-19-0003 and 2020, B23-MC-19-0003 and 2023, B24-MC-19-0003 and 2024, B25-MC-19-0003 and 2025 Federal Financial Assistance Listing Number: 14.218 Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: CFR Section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. CFR Appendix A to Part 170I(a)(2), Reporting Requirements, states the recipient must report each subaward to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward was issued. Condition: During our testing of the City’s compliance with reporting requirements, we noted the City did not have any formal controls in place over the review and approval of reports. Reports were prepared, certified and submitted by the same individual. Additionally, during our testing, we noted for two (2) subaward reports submitted to FSRS, the information was not submitted timely. Cause: The City did not have a formal review process in place over the reports under the program. Additionally, the City did not have a process in place to ensure reports were submitted to FSRS timely. Effect: Reports could be submitted with inaccurate information. Additionally, reports were not submitted to FSRS in accordance with the reporting requirements per Appendix A to Part 170I(a)(2). Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of six (6) of eleven (11) reports were selected. The condition above was identified during our testwork of the City’s internal controls over reporting. Repeat Finding from Prior Years: No. Recommendation: We recommend that the City adhere to their policies and procedures in accordance with 2 CFR 200.332 to ensure compliance with subrecipient monitoring requirements. Views of Responsible Officials: Management agrees with the finding. See separate corrective action plan.

FINDING REFERENCE NUMBER 2025-011 FEDERAL PROGRAM (ALN 84.287) TWENTY-FIRST CENTURY COMMUNITY LEARNING CENTERS U.S. DEPARTMENT OF EDUCATION AWARD NUMBERS S287C200039C (07/01/2020 – 09/30/2021); S287C220039C (07/01/2022 – 09/30/2023); S287C220039C (07/01/2022 – 09/30/2023) COMPLIANCE REQUIREMENT SUBRECIPIENT MONITORING TYPE OF FINDING INTERNAL CONTROL AND COMPLIANCE – MATERIAL WEAKNESS AND MATERIAL NONCOMPLIANCE CRITERIA In accordance with 2 CFR § 200.332(f), pass-through entities are required to monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. In additions to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by terms and conditions of the award, subaward monitoring must include the following: Reviewing financial and programmatic (performance and special reports) required by PTE, following-up and ensuring that the subrecipients takes timely and appropriate action on all deficiencies pertaining to the Federal award, provide the subrecipient from the PTE detected through audits, on site reviews, and other means, issuing a management decision for audits findings pertaining to the Federal award provided to the subrecipient from the PTE as requires by 2 CFR 200.521(c). STATEMENT OF CONDITION As part of our procedures on subrecipient requirements, based on the subrecipient monitoring procedures established by the PRDE in the “Manual de Programa 21st CCLC”, we requested the risk analysis that established the monitoring plan for a period of three (3) years, this information was not provided for our evaluation. Based on this monitoring plan they established the type of monitoring that they will perform to the subrecipient, site reviews, desk reviews or closing reviews. Based on the terms and conditions of the award all subrecipients are required to submit their Single Audit Reports, for review and evaluation. As part of our audit procedures, we obtained the list of subrecipients active during the fiscal year 2024-2025 with a total of eighteen (18) subrecipients. We selected a sample of four (4) subrecipients to test internal controls and compliance with the subrecipient monitoring requirement related to the submission of Single Audit Reports. During our test we noted the following deficiencies: 1. For one (1) subrecipient the management decision for the audit’s findings reported in the subrecipient Single Audit was not provided for our evaluation. 2. For one (1) subrecipient, they notify that the program expenditures were not included in the entity Schedule of Expenditures of Federal Awards, but no evidence of follow-up about this matter was provided for our evaluation. QUESTIONED COSTS None PERSPECTIVE INFORMATION The PRDE does not maintain an internal control process that provides reasonable assurance of complying with the requirement of receipt, evaluation and issuance of management decisions as required by Federal regulations and the required corrections of any findings and disposition of questioned costs within the required timeframes of the Federal regulations from audit or monitoring process. This is a systemic deficiency. The sampling was a statistically valid sample. STATEMENT OF CAUSE The PRDE did not adequate documentation related to the procedures to comply with the subrecipient monitoring requirements. Although procedures are established in the “Manual de Programa 21st CCLC” no evidence was provided to ensure compliance with the procedures established in the manual. POSSIBLE ASSERTED EFFECT Failure to review subrecipient monitoring requirement increases the risk that audit findings or noncompliance at the subrecipient level may go undetected and unaddressed. This may lead to improper use of Federal funds and noncompliance with Federal requirements. IDENTIFICATION AS A REPEAT FINDING This is a repeat finding (Finding Reference Number 2024-012). RECOMMENDATION We recommend that the PRDE establish and implement formal procedures to: Identify all subrecipients subject to Single Audit requirements, obtain and review their audit reports in a timely manner, follow up on relevant audit findings, and maintain documentation of all monitoring activities performed.

EMERGENCY RENTAL ASSISTANCE PROGRAM – 21.023 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: ERAE0006 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: SLFRP0136 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Compliance Requirements: Subrecipient Monitoring; Allowable Costs/Cost Principles SUBRECIPIENT PAYMENTS AND MONITORING Subrecipient monitoring procedures were insufficient to ensure subrecipient audit reports are obtained and reviewed. Monitoring procedures were not in place to ensure adequate documentation was obtained regarding the use of payment advances. Background: The Pandemic Recovery Office, as the administering agency of both the Emergency Rental Assistance Program (ERA) and the State Fiscal Recovery Fund (SFRF), executes memoranda of understanding with the various departments and agencies to conduct projects under the allowable uses of the program. The departments and agencies then often execute subawards within the scope of the specific project. In fiscal 2025, expenditures related to these subawards were primarily executed by the Executive Office of Housing. Criteria: 2 CFR §200.332(e) Requirements for pass-through entities requires that all pass-through entities must “monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” That monitoring must include (1) reviewing financial and performance reports, (2) following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award, and (4) resolving audit findings specifically related to the subaward. Uniform Guidance cost principles dictate that, in order to be allowable under Federal awards, costs must be adequately documented (2 CFR §200.403(g)). 2 CFR §200.332(b)(1) requires that subawards clearly identify certain federal award identification information to the subrecipient. Condition: For SFRF, our sample consisted of 34 subawards executed with 20 unique subrecipients. For ERA, our sample consisted of 29 subawards executed with 15 unique subrecipients. In fiscal 2025, subrecipient Single Audit Reports were not obtained and reviewed by the pass-through entity for 19 of the 20 SFRF subrecipients or any of the 15 ERA subrecipients. Note: Between ERA and SFRF, there were 27 unique subrecipients; eight subrecipients received funding from the Executive Office of Housing under both programs. Subrecipients noted under both programs were issued separate subawards for ERA and SFRF. As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each sampled subrecipient to identify if there were any findings reported. While we did not note any findings related to the subawards sampled (i.e. no findings reported on ERA or SFRF), we did note several subrecipient entities with findings reported on internal control over financial reporting and/or internal control over compliance with federal awards on other programs that could be of interest to the pass-through entity in evaluating the level of monitoring necessary for each subrecipient. Additionally, many of these subrecipients receive funding on a periodic basis. Of 34 SFRF subrecipient payments reviewed, 4 were payment advances to subrecipients for which no additional documentation or reconciliation was available to support subrecipient expenditures related to those prepayments. We noted several other subrecipient reimbursement payments for SFRF that were lacking adequate support for the expenditures being reimbursed. We did not note any deficiencies in the review of reimbursement requests for ERA. The Executive Office of Housing (responsible for 32 of the 34 sampled subawards and 18 of the 20 subrecipients under SFRF and all subawards under ERA) made several improvements to its subrecipient monitoring procedures in fiscal year 2026, including periodic site visits (depending on the nature of the project) and requiring subrecipients to submit their Single Audit Report or financial audit report when requesting annual funding. Monitoring deficiencies in fiscal 2025 were significantly impacted by organization restructuring and related resource constraints. We also noted several subawards that were missing certain required federal award identifying information; subawards include an appendix that details the required information. For ERA, we noted 1 subaward that appeared to include the incorrect entity name in the appendix, 1 subaward that was missing the Federal Award Identification Number (FAIN), Assistance Listing Number (ALN), and program title, and 2 instances where a subrecipient had differing Unique Entity IDs (UEIs) between their respective subawards. For SFRF, we noted 4 subawards that did not include the UEI, 3 subawards that did not include the FAIN, 5 subawards that did not include the ALN and program title, and 6 subawards that did not include the federal award date. Cause: Subrecipient monitoring procedures are not in place to ensure audit reports are reviewed and management decisions are issued, as required by Uniform Guidance. Other monitoring procedures were inadequate to ensure that subrecipients appropriately utilized the funds provided to support program objectives. Effect: Noncompliance with program guidelines and/or federal regulations at the subrecipient level could go undetected and unresolved. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-039a Enhance internal control procedures to ensure timely review of audit reports and issuance of management decisions in accordance with Uniform Guidance. Ensure review of reports is adequately documented, including notation of findings unrelated to the subaward, which could have an indirect impact on the administration of the subaward. 2025-039b Enhance controls to ensure adequate documentation of monitoring procedures performed and support for subrecipient expenditures is obtained. Document any meetings and/or conversations with the subrecipients and discussion had therein. 2025-039c Continue to strengthen and improve subrecipient monitoring procedures to ensure subrecipient compliance with terms and conditions of the grant award and subaward. 2025-039d Enhance controls to ensure all award identifying information required by 2 CFR §200.332(b)(1) is accurately included in the subaward.

CORONAVIRUS CAPITAL PROJECTS FUND – 21.029 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2022-2027 Federal Award Number: CPFFN0169 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Compliance Requirement: Subrecipient Monitoring REVIEW OF SUBRECIPIENT AUDIT REPORTS Review of subrecipient audit reports under the Coronavirus Capital Projects Fund can be enhanced to provide detailed documentation of deficiencies that directly or indirectly impact the subawards. Background: Under the Coronavirus Capital Projects Fund (CPF), the State awarded funding to cities and towns to invest in multipurpose community facility projects that directly and jointly enable work, education, and health monitoring. Twenty-one facility projects were awarded to eighteen municipalities across the State. Criteria: 2 CFR §200.332(e) Requirements for pass-through entities requires that all pass-through entities must “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” That monitoring must include (1) reviewing financial and performance reports, (2) following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award, and (4) resolving audit findings specifically related to the subaward. Condition: The PRO obtained and documented its review of subrecipient audit reports during fiscal 2025, however, the review did not document the pertinent information related to the CPF subawards. This would include the amount of CPF expenditures, whether the program was audited as major, if any findings were reported and any management decisions issued from PRO if findings existed specific to the subaward. Additionally, any other reported findings that could have an indirect impact on the subrecipient’s administration of the CPF subawards (e.g., a finding on cash management related to a different federal award could indicate an underlying issue that may affect CPF) were not documented. As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each subrecipient to identify if there were any findings reported. No findings were reported on CPF subawards and therefore, no additional follow-up was necessary from the PRO as the pass-through entity. Cause: The scope of subrecipient audit report reviews did not focus on the subaward or other aspects related to the administration of federal programs. Effect: Lack of thorough review could result in reported findings related to CPF subawards not being resolved, as required by Uniform Guidance. Lack of documentation of other findings could impact extent of other monitoring procedures to mitigate risks that may indirectly impact CPF subawards. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-042 Improve documentation of subrecipient audit report reviews to include notation of whether any findings pertained to the CPF subaward that require issuance of a management decision in accordance with Uniform Guidance and whether any other findings reported could indirectly impact the administration of the subaward.

Federal Program: Research and Development Cluster Criteria The College, as a pass-through entity, is required to monitor the activities of subrecipients as necessary to ensure subawards are used for authorized purposes and in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Such monitoring includes reviewing financial and programmatic reports, following up on identified deficiencies, ensuring timely corrective action, and maintaining adequate documentation evidencing the performance of monitoring and oversight procedures. Condition During testing of subrecipient monitoring procedures for the Research and Development Cluster, the College was unable to provide documentation evidencing that required subrecipient monitoring confirmations and related monitoring procedures were performed for one of their subrecipients during the period July 1, 2024 through June 30, 2025. Management indicated that due to staffing turnover within the Grants & Contracts Office, the College could not verify whether monitoring confirmations were requested or received during the audit period. In addition, supporting documentation evidencing the performance of monitoring activities was not maintained or available for audit review. Cause The College experienced staffing turnover within the Grants & Contracts Office which resulted in a breakdown in controls over subrecipient monitoring documentation retention and oversight procedures. Effect The College was unable to demonstrate compliance with subrecipient monitoring requirements in accordance with 2 CFR §200.332. As a result, there is an increased risk that noncompliance by subrecipients may not be identified, monitored, or addressed in a timely manner. Questioned Costs None. Recommendation We recommend the College strengthen controls over subrecipient monitoring by: implementing formalized monitoring procedures and documentation retention requirements, maintaining centralized records of monitoring activities and confirmations, assigning clear responsibility for monitoring oversight, and implementing supervisory review controls to ensure compliance with Uniform Guidance requirements. Views of Responsible Officials See Management Corrective Action Plan. The College had no prior year findings reported.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster State Administering Department: California Department of Aging ALN: 93.044, 93.045, 93.053 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401CAOACM; October 1, 2023 – September 30, 2025 2401CAOAHD; October 1, 2023 – September 30, 2025 2401CAOANS; October 1, 2023 – September 30, 2025 2401CAOASS; October 1, 2023 – September 30, 2025 2501CAOACM; October 1, 2024 – September 30, 2026 2501CAOAHD; October 1, 2024 – September 30, 2026 2501CAOANS; October 1, 2024 – September 30, 2026 2501CAOASS; October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. §200.332 Requirements for passthrough entities (2 CFR 200.332): All pass-through entities must: (a) Verify that the subrecipient is not excluded or disqualified in accordance with §180.300. Verification methods are provided in §180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. Condition: Audit procedures included a review of eight subrecipient agreements to determine whether the Department complied with federal suspension and debarment requirements for covered transactions. The subrecipient agreements reviewed did not contain a suspension and debarment certification clause indicating that the subrecipient was not suspended or debarred from participation in federally funded programs. Furthermore, the Department was unable to provide documentation demonstrating that suspension and debarment verification procedures, such as a review of the System for Award Management (SAM), had been performed prior to entering into the covered transactions. As part of audit procedures, we independently verified the suspension and debarment status of all subrecipients tested through a review of the SAM Exclusions database and noted that none were suspended or debarred at the time of our testing. Questioned costs: None Context: See “Condition.” Cause: Controls designed to ensure compliance with federal suspension and debarment requirements were not operating with sufficient precision to verify and document the eligibility of subrecipients prior to entering into covered transactions. Specifically, personnel responsible for administering the program had not established or consistently performed procedures to verify suspension and debarment status through SAM or obtain required certifications, resulting in unsupported compliance with 2 CFR §200.214 and 2 CFR Part 180. Effect: Failure to verify and document suspension and debarment status prior to entering into covered transactions results in noncompliance with 2 CFR §180.300 and increases the risk that federal funds could be awarded to subrecipients that are suspended or debarred from participation in federally funded programs. Although the audit's independent verification determined that none of the subrecipients tested were suspended or debarred, the lack of documented verification procedures prevents the Department from demonstrating compliance with federal requirements and increases the risk that ineligible parties could be engaged in future transactions. Repeat finding: No Recommendation: The Department should review and strengthen its procedures for verifying the suspension and debarment status of subrecipients before entering into any agreement involving federal funds and ensure that the verification documentation is maintained. Alternatively, incorporate a clause in subrecipient contracts certification of their suspension or debarment status. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Epidemiology and Laboratory Capacity for ProgramInfectious Diseases (ELC) State Administering Department: California Department of Public Health ALN: 93.323 Pass-Through Agency: Heluna Health Pass-Through Number(s): 95-2557063 Award Number and Period: NU50CK000539; August 1, 2019 – July 31, 2027 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.302 – Financial management (b) The recipient's and subrecipient's financial management system must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. § 200.332 – Requirements for pass-though entities A pass-through entity must: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: (1) Federal award identification. (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated in the subaward; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; (xiii) Identification of whether the Federal award is for research and development; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with § 200.414). Condition: Audit procedures included a review of eleven subrecipient agreements to determine whether the pass-through entity included the information required to be communicated to subrecipients in accordance with Uniform Guidance. Of the eleven agreements tested, all eleven (100%) did not contain one or more required federal award identification elements. Specifically, the agreements omitted the subrecipient’s Unique Entity Identifier (UEI), the Federal Award Identification Number (FAIN), the Federal award date, the applicable Assistance Listing Number (ALN), identification of whether the award was designated as research and development (R&D), and the applicable indirect cost rate for the federal award, including whether the de minimis indirect cost rate authorized under 2 CFR §200.414 was being used. As a result, the subrecipient agreements did not include all information required to be provided to subrecipients under 2 CFR §200.332(b). Questioned costs: None Context: See “Condition.” Cause: Controls designed to ensure the inclusion of all federally required award identification information in subrecipient agreements were not operating with sufficient precision to identify and prevent the omission of required elements prior to execution of the agreements. As a result, agreements were issued without all information required under 2 CFR §200.332(b), including the UEI, FAIN, Federal award date, ALN, identification of whether the award was designated as R&D, and the applicable indirect cost rate. Effect: The omission of required federal award information from subrecipient agreements may limit subrecipients' understanding of applicable federal award requirements and increase the risk of noncompliance with federal regulations. Incomplete award information may also result in inaccurate or inconsistent administration, monitoring, and reporting of federal awards by subrecipients and the pass-through entity. Repeat finding: Yes – 2024-009 Recommendation: Public Health should ensure every subaward includes all requirements imposed on the subrecipient so that the federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the federal award. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101CACDC6; October 1, 2020 – September 30, 2024 2334CACCDD; October 1, 2022 – September 30, 2025 2334CACCDF; October 1, 2022 – September 30, 2025 2334CACCDM; October 1, 2022 – September 30, 2025 2434CACCDD; October 1, 2023 – September 30, 2026 2434CACCDF; October 1, 2023 – September 30, 2026 2434CACCDM; October 1, 2023 – September 30, 2025 2534CACCDD; October 1, 2024 – September 30, 2027 2534CACCDF; October 1, 2024 – September 30, 2027 2534CACCDM; October 1, 2024 – September 30, 2026 2534CACCDY; December 21, 2024 – September 30, 2028 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Complianceand Material Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.302 – Financial management (b) The recipient's and subrecipient's financial management system must provide for the following: (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. §200.328 Financial reporting (c) The recipient or subrecipient must submit financial reports as required by the Federal award. Reports submitted annually by the recipient or subrecipient must be due no later than 90 calendar days after the reporting period. Reports submitted quarterly or semiannually must be due no later than 30 calendar days after the reporting period. (d) The final financial report submitted by the recipient must be due no later than 120 calendar days after the conclusion of the period of performance. A subrecipient must submit a final financial report to a pass-through entity no later than 90 calendar days after the conclusion of the period of performance. § 200.329 Monitoring and reporting program performance (a) Monitoring by the recipient and subrecipient The recipient and subrecipient are responsible for the oversight of the Federal award. The recipient and subrecipient must monitor their activities under Federal awards to ensure they are compliant with all requirements and meeting performance expectations. Monitoring by the recipient and subrecipient must cover each program, function, or activity. See also § 200.332. Title 45 – Public Welfare Subtitle A – Department of Health and Human Services Subchapter A – General Administration Part 98 – Child Care and Development Fund Subpart G – Financial Management § 98.60 – Availability of funds (d) The following obligation and liquidation provisions apply to States and Territories: (1) Discretionary Fund allotments shall be obligated in the fiscal year in which funds are awarded or in the succeeding fiscal year. Unliquidated obligations as of the end of the succeeding fiscal year shall be liquidated within one year. (2)(i) Mandatory Funds for States requesting Matching Funds per § 98.55 shall be obligated in the fiscal year in which the funds are granted and are available until expended. (4) Both the Federal and non-Federal share of the Matching Fund shall be obligated in the fiscal year in which the funds are granted and liquidated no later than the end of the succeeding fiscal year. (5) Determination of whether funds have been obligated and liquidated will be based on State or local law or, if there is no applicable State or local law, the regulation at 2 CFR 200.1, Expenditures and Obligations. § 98.65 Audits and financial reporting (a) Each Lead Agency shall have an audit conducted after the close of each program period in accordance with 2 CFR part 200, subpart F, and the Single Audit Act Amendments of 1996. (b) Lead Agencies are responsible for ensuring that subgrantees are audited in accordance with appropriate audit requirements. (c) Not later than 30 days after the completion of the audit, Lead Agencies shall submit a copy of their audit report to the legislature of the State or, if applicable, to the Tribal Council(s). Lead Agencies shall also submit a copy of their audit report to the HHS Inspector General for Audit Services, as well as to their cognizant agency, if applicable. (d) Any amounts determined through an audit not to have been expended in accordance with these statutory or regulatory provisions, or with the Plan, and that are subsequently disallowed by the Department shall be repaid to the Federal government, or the Secretary will offset such amounts against any other CCDF funds to which the Lead Agency is or may be entitled. (e) Lead Agencies shall provide access to appropriate books, documents, papers and records to allow the Secretary to verify that CCDF funds have been expended in accordance with the statutory and regulatory requirements of the program, and with the Plan. (f) The audit required in paragraph (a) of this section shall be conducted by an agency that is independent of the State, Territory or Tribe as defined by generally accepted government auditing standards issued by the Comptroller General, or a public accountant who meets such independent standards. (g) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended. (h) At a minimum, a State or territorial Lead Agency's quarterly report shall include the following information on expenditures under CCDF grant funds, including Discretionary (which includes realloted funding and any funds transferred from the TANF block grant), Mandatory, and Matching Funds (which includes redistributed funding); and State Matching and Maintenance-of- Effort (MOE) Funds: (1) Child care administration; (2) Quality activities, including any sub-categories of quality activities as required by ACF; (3) Direct services for both grant or contracted slots and certificates; (4) Non-direct services, including: (i) Establishment and maintenance of computerized child care information systems; (ii) Certificate program cost/eligibility determination; (iii) All other non-direct services; and (5) Such other information as specified by the Secretary. § 98.67 – Fiscal requirements (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. Condition: Audit procedures included a review of the entire population of ACF-696 financial reports submitted for the CCDF Cluster. Our testing identified that certain reported amounts did not agree or reconcile to the underlying general ledger, resulting in a total variance of $491,119,535. Additionally, audit procedures identified that internal controls over reporting were not operating effectively to ensure the accurate submission of reports. Specifically, certain reports contained inaccuracies at the time of submission, and controls were not performed with sufficient precision to verify that reported information was complete and accurate in accordance with federal reporting requirements. Questioned costs: None Context: See “Condition.” Cause: The controls over the preparation and review of ACF-696 reports were not performed with sufficient precision to identify and resolve discrepancies between reported amounts and the underlying general ledger. Specifically, controls were not designed or operating at a level precise enough to ensure that reported data was accurate, reconciled, and submitted in a timely manner in accordance with federal requirements. As a result, variances and reporting errors were not detected or corrected prior to submission. Effect: Without a documented reconciliation between the ACF-696 reports and the general ledger, the Department cannot demonstrate that reported expenditures were accurate, complete, and supported by accounting records. This increases the risk that expenditures, obligations, liquidations, unobligated balances, or expenditure categories reported to ACF may be misstated. Inaccurate ACF-696 reporting may affect ACF’s ability to monitor compliance with CCDF spending, obligation, liquidation, and availability requirements. Repeat finding: Yes – 2024-015 Recommendation: Management should establish a formal reconciliation process to ensure that ACF-696 expense reports align with the general ledger. This process should include assigning responsibility to a designated finance team member for performing and documenting reconciliations, implementing a monthly reconciliation schedule, and promptly investigating and resolving any variances with documented approvals. Additionally, financial reporting policies should be updated to incorporate reconciliation requirements, and staff should receive training on compliance and reconciliation procedures to strengthen internal controls and reduce the risk of reporting inaccuracies. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report. Response to views of responsible officials: We acknowledge management's explanation that variances between the ACF-696 reports and the general ledger resulted from timing differences associated with subsequent cost allocations, accruals, and other adjustments. However, the issue identified during the audit was not the existence of timing differences, but that the reconciliation process did not adequately identify, explain, and support significant variances. Audit testing identified unreconciled variances totaling $491,119,535 between the ACF-696 reports and the general ledger. Although management indicated that adjustments were reported in subsequent quarters, documentation supporting a complete and accurate reconciliation was not available at the time of report preparation and submission. As a result, controls did not operate with sufficient precision to ensure reported amounts were accurate, complete, and supported by the Department's accounting records. Accordingly, we continue to conclude that the finding is valid as presented. We appreciate management's planned corrective actions to formalize the reconciliation process and strengthen oversight of ACF-696 reporting.

Special Tests and Provisions Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2434CACCDD; October 1, 2023 - September 30, 2026 2434CACCDF; October 1, 2023 - September 30, 2026 2434CACCDM; October 1, 2023 - September 30, 2025 2534CACCDD; October 1, 2024 - September 30, 2027 2534CACCDF; October 1, 2024 - September 30, 2027 2534CACCDM; October 1, 2024 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.329 Monitoring and reporting program performance (a) Monitoring by the recipient and subrecipient The recipient and subrecipient are responsible for the oversight of the Federal award. The recipient and subrecipient must monitor their activities under Federal awards to ensure they are compliant with all requirements and meeting performance expectations. Monitoring by the recipient and subrecipient must cover each program, function, or activity. See also § 200.332. Title 45 – Public Welfare Subtitle A – Department of Health and Human Services Subchapter A – General Administration Part 98 – Child Care and Development Fund Subpart B – General Application Procedures § 98.11 – Administration under contracts and agreements Lead Agencies have broad authority to administer and operate the CCDF program through other governmental, nongovernmental, or public or private local agencies; however, the Lead Agency must retain overall responsibility for the administration of the program and ensure that administrative and implementation responsibilities undertaken by agencies other than the Lead Agency are governed by written agreements specifying the mutual roles and responsibilities of the Lead Agency and other agencies in meeting CCDF requirements. The approved FFY 2025–2027 CCDF State Plan identifies CDSS as the Lead Agency and states that activities performed by agencies other than CDSS are governed through written agreements, including contracts and grant award notifications, that include required elements such as tasks to be performed, schedules for completing tasks, budgets, and performance measures. The State Plan further describes CDSS’s monitoring process for contractors, including standard review instruments, corrective action follow-up, fiscal and program reporting, and contractor review requirements. Condition: Audit procedures included testing a sample of 60 CCDF contractors to determine whether CDSS performed on-site monitoring visits in accordance with the contractor review cycle specified in the approved State Plan and related monitoring procedures. Of the 60 contractors tested, 2 contractors did not receive an on-site monitoring visit within the required review period. Specifically, the contractors had not received an on-site visit within four years, although the State Plan and related monitoring procedures require contractor reviews to be performed within a three-year cycle. As a result, CDSS did not consistently perform required monitoring procedures within the timeframe established for oversight of CCDF contractors. Questioned costs: None Context: See “Condition.” Cause: CDSS did not maintain internal controls that operated with sufficient precision to ensure all CCDF contractors were scheduled for and received required on-site monitoring visits within the established review cycle. Specifically, monitoring controls were not designed or performed at a level sufficient to identify overdue contractor reviews, track the status of required visits, and ensure timely completion of on-site monitoring for all applicable contractors. Effect: Failure to perform timely on-site monitoring visits reduces CDSS’s ability to determine whether contractors are operating in accordance with written agreements, State Plan requirements, and applicable CCDF program requirements. Untimely monitoring increases the risk that contractor noncompliance, performance deficiencies, or unsupported program activities are not identified and corrected promptly, which may affect CDSS’s ability to retain effective oversight and overall responsibility for the CCDF program. Repeat finding: No Recommendation: We recommend that CDSS strengthen internal controls over CCDF contractor monitoring by implementing procedures to ensure all contractors are scheduled for and receive required on-site monitoring visits within the review cycle established in the approved State Plan and related monitoring procedures. These procedures should include maintaining a complete monitoring schedule, tracking the date of each contractor’s last review, identifying upcoming and overdue reviews, and requiring documented supervisory review to ensure monitoring visits are completed timely. CDSS should also establish a process to periodically reconcile the monitoring schedule to the population of active CCDF contractors and promptly follow up on overdue reviews. These controls should help ensure CDSS performs contractor oversight consistently, documents compliance with written agreement monitoring requirements, and retains effective responsibility for CCDF administration. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report. Response to views of responsible officials: We acknowledge CDSS's response regarding resource constraints, risk-based prioritization, and its interpretation of the "as resources permit" language in Title 5, California Code of Regulations, Section 18023(b). However, the approved State Plan and related monitoring procedures in effect during the audit period established a three-year review cycle for contractor monitoring. Audit testing identified that 2 of 60 CCDF contractors did not receive an on-site monitoring visit for more than four years. While CDSS employed a risk-based approach to prioritize monitoring activities, the required reviews were not completed within the established review cycle for the contractors identified in our testing. Accordingly, the finding is based on CDSS's failure to consistently perform monitoring reviews within the established review cycle and the lack of controls to ensure overdue reviews were identified, tracked, and completed timely. Therefore, we continue to conclude that the finding is valid as presented.

2025-001 U.S. Department of the Treasury COVID-19 – Coronavirus State and Local Fiscal Recovery Fund – ALN 21.027 Compliance Finding and Material Weakness in Internal Controls Over Compliance Criteria: 2 CFR section 200.332, provides the requirements for pass-through entities to communicate subaward information to the subrecipient and to monitor the activities of the subrecipient. Condition: The City did not maintain risk assessments to evaluate each subrecipients risk of noncompliance and level of monitoring required and did not maintain any documentation indicating that monitoring occurred for five subrecipients. Context: The above condition applied to each of the five subrecipients selected for testing. As a result, we were unable to determine the extent of any monitoring that may have occurred. The sample was not a statistically valid sample. Cause: The City experienced turnover in the grant administrator position and did not follow its documented internal controls for subrecipient monitoring. Effect: Lack of controls over subrecipient monitoring could result in the City’s noncompliance with grant requirements. Questioned Costs: None. Repeat Finding from Prior Year: No. Recommendation: The City should require all persons charged with managing federal grants to review the City’s documented internal controls for federal grant compliance. Regarding subrecipient monitoring, the City should ensure that risk assessments are performed to evaluate each subrecipients risk of noncompliance and to develop the appropriate subrecipient monitoring procedures to be employed. All records of subrecipient monitoring should be maintained to document grant compliance. Views of Responsible Official: Management agrees with the finding

Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Federal Financial Assistance Listing Number: 21.027 Federal Grantor: U.S. Department of the Treasury Award Number and Year: 2021 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance and Material Non-Compliance Criteria: In accordance with Title 2 U.S. Code of Federal Regulations (CFR) 200.332, pass-through entities must comply with the following: • 2 CFR Part 200.332(a), Requirements for Pass-Through Entities, states that all passthrough entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information as well as all the requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations, and the terms and conditions of the award. • 2 CFR 200.332(b) – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. This evaluation of risk may include consideration of such factors listed in 2 CFR 200.332(b)(1) through (4). • 2 CFR 200.332(d)- Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include the information at 2 CFR 200.332(d)(1) through (4). • 2 CFR 200.332(f) – Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 200.501. • 2 CFR section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: We noted for three (3) of three (3) subrecipients selected for testwork, the City did not perform any of the required subrecipient monitoring procedures as required under 2 CFR 200.332 (a. through i.). As a result, we were unable to perform audit procedures over Subrecipient Monitoring compliance requirements. Cause: The City did not have adequate policies and procedures in place to monitor subrecipient in accordance with 2 CFR 200.332. Effect: The City did not have procedures in place requiring compliance with the Subrecipient Monitoring requirements in 2 CFR 200.332 and as such did not comply with subrecipient monitoring requirements related to the program. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of three (3) of three (3) subrecipients were sampled. Repeat Finding from Prior Year: No. Recommendation: The City should implement policies and procedures to ensure that subrecipients are properly identified at the time of award and accurately reported on the SEFA. Additionally, the City should establish and perform ongoing subrecipient monitoring procedures in accordance with Federal requirements, including risk assessments and documentation of monitoring activities. Views of Responsible Officials and Planned Corrective Action: Management agrees. See separately issued Corrective Action Plan.

Finding 2025-003 (Material Weakness) Program: Housing Opportunities for Persons with AIDS Federal Agency: United States Department of Housing and Urban Development (HUD) AL #: 14.241 Federal Award Identification Number and Year: Various – See SEFA Pass-through Entity: N/A Type of Compliance Finding: M) Subrecipient Monitoring Criteria Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). Condition The City did not provide evidence supporting compliance with this requirement. Cause The City failed to 1) evaluate the results of subrecipient’s previous audits including whether or not the subrecipient received a single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward was audited as a major program; and 2) have the Subrecipient address the identified findings in the contract monitoring report according to the response timeframe outlined in the report; to ensure quality programming that benefits the clients. Effect The City may not be compliant with HUD, which could result in the City not receiving federal assistance or repayment of grant funds. Questioned Costs None Context N/A Is the finding a repeat finding No Recommendations We recommend the City ensure Subrecipients respond to all corrective action plans by the required timeframes outlined and ensure all subrecipients are monitored as stated in the Federal regulations and City’s policy. Views of Responsible Officials / Planned Corrective Actions Management agrees with the finding. See Corrective Action Plan on Organization’s letterhead.

2025 – 003 Subrecipient Monitoring Federal Award Identification: Coronavirus State and Local Fiscal Recovery Funds (SLFRF)(ALN 21.027) Criteria: Under 2 CFR §200.332, pass-through entities are required to monitor the activities of subrecipients as necessary to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Such monitoring includes reviewing Single Audit reports, considering whether audit findings relate to the pass-through entity's subawards, and ensuring that subrecipients take timely and appropriate corrective action on deficiencies pertaining to Federal awards provided by the pass-through entity. Condition: The City passed through portions of SLFRF funding to a nonprofit organization. The City also provided Homeowners Assistance Fund Program (HAF) funds to that same organization. The City did not document that it had obtained the subrecipient's Single Audit reports, nor did it document its review of amounts reported in the SEFA and its evaluation of a finding reported by the subrecipient related to the SLFRF program with an assessment of corrective actions taken by the subrecipient. The subrecipient’s SEFA for June 30, 2025, did not properly identify the City as a passthrough entity of HAF funding. Rather, the expenditures appeared to be direct funding from Treasury due to the lack of passthrough agency identification. The City did not document timely inquiry, review, or follow-up regarding the omission of HAF expenditures from the subrecipient's SEFA, despite the City having provided HAF funding to the nonprofit during the period. Cause: The City's subrecipient monitoring procedures were not adequately designed or implemented to ensure that subrecipient Single Audit findings were formally reviewed and followed up on, and discrepancies identified in subrecipient reporting were investigated and resolved. Effect: Failure to evaluate and follow up on subrecipient audit findings and reporting discrepancies may allow noncompliance to remain unresolved, increase the risk of improper use of Federal funds, impair the City's ability to identify potential questioned costs, and result in noncompliance with Uniform Guidance subrecipient monitoring requirements. As a result, the City lacked additional assurance that its subawards were administered in accordance with applicable Federal requirements. Questioned Costs: Undeterminable Recommendation: We recommend that the City strengthen its subrecipient monitoring procedures to: • Document its review of subrecipient Single Audit reports; • Evaluate whether reported audit findings relate to City-funded subawards; • Follow up on corrective actions for applicable findings and maintain supporting documentation of that review; and • Investigate and resolve discrepancies in subrecipient Federal award reporting, including omissions identified on the SEFA. • Amend its existing grants administration policy to include a section related to subrecipient monitoring responsibilities Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding. The City will establish and document formal subrecipient-monitoring procedures consistent with 2 CFR §200.332.

Assistance Listing Numbers: 21.027 Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Pass-Through Agencies: Maricopa County Pass-Through Grantor Identifying Number: None Award Year: November 1, 2021 through September 30, 2026 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR 200.332 (e) & (g) - pass-through entities must monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Condition: While AACHC performed several of the required subrecipient monitoring tasks, AACHC's system of internal controls did not include a process to monitor the subrecipients' financial and performance reports by verifying that subrecipients are audited if they meet the single audit criteria and ensure that subrecipients take corrective action on single audit findings. Questioned Costs: N/A Context: In a population of five subrecipients, we noted that for all five subrecipients, while AACHC performed several of the required subrecipient monitoring tasks, AACHC did not monitor subrecipient activity through reviewing financial and performance reports, verify that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. This is deemed to be a material weakness in internal control over compliance. Effect: The system of internal controls was not properly designed to include a process to review financial and performance reports, verifying that subrecipients are audited if the meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Cause: AACHC was not aware of the requirements within the Uniform Guidance for pass-through entities to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Identification of Repeat Finding: Not a repeat finding. Recommendation: AACHC should update their subrecipient monitoring policies and procedures to specifically include a process to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. We also recommend AACHC regularly attend trainings on the Uniform Guidance to ensure they are knowledgeable of the required compliance procedures. Views of Responsible Officials and Planned Corrective Actions: Management of AACHC concurs with the finding. See Corrective Action Plan.

Assistance Listing Numbers: 93.332 Program: Cooperative Agreement to Support Navigators in Federally-Facilitated Exchanges Federal Agency: Department of Health and Human Services Pass-Through Agencies: N/A Pass-Through Grantor Identifying Number: NN/A Award Year: August 27, 2021 through August 26, 2024; August 27, 2024 through August 26, 2027 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR 200.332 (e) & (g) - pass-through entities must monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Condition: While AACHC performed several of the required subrecipient monitoring tasks, AACHC's system of internal controls did not include a process to monitor the subrecipients' financial and performance reports by verifying that subrecipients are audited if they meet the single audit criteria and ensure that subrecipients take corrective action on single audit findings. Questioned Costs: N/A Context: In a population of twelve subrecipients, we noted that for all twelve subrecipients, while AACHC performed several of the required subrecipient monitoring tasks, AACHC did not monitor subrecipient activity through reviewing financial and performance reports, verify that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. This is deemed to be a material weakness in internal control over compliance. Effect: The system of internal controls was not properly designed to include a process to review financial and performance reports, verifying that subrecipients are audited if the meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Cause: AACHC was not aware of the requirements within the Uniform Guidance for pass-through entities to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Identification of Repeat Finding: Not a repeat finding. Recommendation: AACHC should update their subrecipient monitoring policies and procedures to specifically include a process to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. We also recommend AACHC regularly attend trainings on the Uniform Guidance to ensure they are knowledgeable of the required compliance procedures. Views of Responsible Officials and Planned Corrective Actions: Management of AACHC concurs with the finding. See Corrective Action Plan.

2025-001 - Internal Control over Compliance and Compliance with Subrecipient Monitoring Requirements Information on the Federal Program: United States Department of Treasury Assistance Listing Number: 21.027 Assistance Listing Name: Coronavirus State and Local Fiscal Recovery Fund Pass-Through Entity: Prince George’s Country Maryland Pass-Through Entity Number: 52-6000-998 Award Period: February 28, 2024 through June 30, 2025 Criteria– In accordance with §200.303(a), Internal Controls, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §180.300, Suspension and Debarment, non-federal entities cannot enter into awards, subawards, or contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Non-federal entities must either check for exclusions in the System for Award Management (SAM); collect a certification from the entity, or add a clause or condition to the covered transaction with the entity prior to entering into a covered transaction with a non-federal entity. In addition, in accordance with §180.415(b), non-federal entities cannot renew or extend covered transactions (other than no-cost time extension) with any excluded person, or under which an excluded person is a principal, unless the non-federal entity obtains an exception under §180.135. 2 CFR §200.332(b), Requirements for pass-through entities, indicates that pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and that the subaward document includes the best available information provided within 2 CFR §200.332(b)(1). Condition – During our testing of the two subrecipients under this program, we noted that management did not determine whether the subrecipients were suspended or debarred prior to entering into the agreement with the subrecipients or when the subaward agreements were amended. Additionally, the agreements between The Community Foundation and the subrecipients did not contain certain key information, such as the assistance listing number, as required by 2 CFR §200.332(b)(1). Context – During our review of The Community Foundation’s compliance with the Uniform Guidance requirements, we noted that there were two subrecipients under the applicable federal program. Both subrecipients were selected for testing, resulting in a 100% examination rather than a sample-based approach. Upon identification of compliance errors, management subsequently verified the status of the subrecipients in the System for Award Management (“SAM”) to confirm that neither was suspended nor debarred. We reviewed supporting documentation from SAM and confirmed that both subrecipients were not suspended or debarred. Following the audit procedures, which identified missing data elements required by 2 CFR §200.332(b)(1), management issued communications to each subrecipient, providing the relevant information that had initially been omitted from the subaward agreements. Cause - The Community Foundation’s policies include requirements to determine whether vendors/subrecipients are suspended are debarred when working on Federal programs. The individuals executing the agreements between The Community Foundation and the two subrecipients did not properly follow the procurement policy with respect to checks for suspension and debarment. In addition, the individuals executing the agreements with the two subrecipients did not properly review the regulations and did not identify the need to include the information in 2 CFR §200.332(b)(1). Effect or Potential Effect - The lack of adherence to the established internal control policies and procedures can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements which could ultimately lead to disallowed costs for the major federal program. Questioned Costs - There are no questioned costs. Repeat Finding - This is not a repeat finding from prior year. Recommendation - We recommend that The Community Foundation ensure consistent adherence to its policies and procedures. Given that federal funding is not received on a recurring basis, certain policies and procedures may become outdated. We further recommend that, upon receipt of federal funding in the future, management designate an individual with appropriate knowledge and experience to review applicable federal regulations and update policies and procedures as necessary to maintain compliance. Views of Responsible Officials – Management agrees with the finding and has implemented corrective actions, including verifying subrecipients’ eligibility in SAM.gov before awarding or amending federal subawards, updating subaward templates to meet federal requirements, and revising procurement and cash management policies for compliance. The Controller will act as Compliance Coordinator for future federal funding, overseeing regulation review, staff training, and quarterly compliance checks, with any deficiencies reported to the CFO for prompt resolution. These measures aim to ensure ongoing adherence to federal grant requirements.

2024-001 Significant Deficiency in Internal Controls over Compliance and Compliance, Other Matter – Procurement (suspension and debarment) Agency: U.S. Department of the Interior Program(s) and Federal Award Listing Number(s): Partners for Fish and Wildlife ALN: 15.631 FAIN: FA22AC02756, FA23AC02476 New or Repeat: New Criteria: Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Per 2 CFR Part 180, as referenced in 2 CFR Part 1400, for any contract expected to total $25,000 or more, a recipient of federal funds must confirm that the contractor is not suspended or debarred from receiving federal funds. Per 2 CFR 200.332, a pass-through entity must verify that the subrecipient is not suspended, debarred, or otherwise excluded from receiving federal funds in accordance with 2 CFR 180.300. Condition: SAWC was not able to provide supporting documentation indicating that it had verified that contractors and subrecipients were not suspended or debarred prior to contracting with, or making a subaward to, the entities. Cause: Internal controls were designed, but not sufficiently implemented to ensure that documentation of the check for suspension and debarment was retained. Effect: SAWC could have contracted with, or made a subaward to, an entity that was suspended or debarred. Context: We tested 100% of the procurement population. For three of the three contractors/subrecipients tested, we were not able to verify that SAWC confirmed the contractor/subrecipient was not suspended or debarred prior to entering into the transaction. Questioned costs: There are no questioned costs associated with this finding. Recommendation: We recommend SAWC consider either collecting a certification regarding suspension and debarment from contractors/subrecipients or adding a suspension and debarment clause or condition to contracts and subawards. View of responsible officials: Management concurs with this finding, see corrective action plan.

2024-001 Significant Deficiency in Internal Controls over Compliance and Compliance, Other Matter – Procurement (suspension and debarment) Agency: U.S. Department of the Interior Program(s) and Federal Award Listing Number(s): Partners for Fish and Wildlife ALN: 15.631 FAIN: FA22AC02756, FA23AC02476 New or Repeat: New Criteria: Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Per 2 CFR Part 180, as referenced in 2 CFR Part 1400, for any contract expected to total $25,000 or more, a recipient of federal funds must confirm that the contractor is not suspended or debarred from receiving federal funds. Per 2 CFR 200.332, a pass-through entity must verify that the subrecipient is not suspended, debarred, or otherwise excluded from receiving federal funds in accordance with 2 CFR 180.300. Condition: SAWC was not able to provide supporting documentation indicating that it had verified that contractors and subrecipients were not suspended or debarred prior to contracting with, or making a subaward to, the entities. Cause: Internal controls were designed, but not sufficiently implemented to ensure that documentation of the check for suspension and debarment was retained. Effect: SAWC could have contracted with, or made a subaward to, an entity that was suspended or debarred. Context: We tested 100% of the procurement population. For three of the three contractors/subrecipients tested, we were not able to verify that SAWC confirmed the contractor/subrecipient was not suspended or debarred prior to entering into the transaction. Questioned costs: There are no questioned costs associated with this finding. Recommendation: We recommend SAWC consider either collecting a certification regarding suspension and debarment from contractors/subrecipients or adding a suspension and debarment clause or condition to contracts and subawards. View of responsible officials: Management concurs with this finding, see corrective action plan.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

2024-001 Research and Development Cluster – Education Innovation and Research (formerly Investing in Innovation (i3) Fund – Validation Grants) Assistance Listing No. 84.411A Criteria: 2 CFR 200.332 notes, “All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; …” Condition: For both subawards selected for testing, the identification of the contact information for the awarding agency was incorrect. The contact information was Education Analytics, Inc., the Organization’s grantor, but should have been Future Forward, Inc. Further, one of the two subawards selected for testing had information missing from the subaward including all requirements for the award to be used in accordance with Federal statutes, regulations and terms and conditions of the Federal award. We consider this condition to be an instance of noncompliance relating to the Subrecipient Monitoring compliance requirement. Statistical sampling was not used in making sample selections. Questioned Costs: N/A Cause and Effect: Without communication of the required information, subrecipients may overspend award amounts or incur unallowable expenses towards the grant as well as report the incorrect grantor on their schedule of expenditures of federal awards. Recommendation: We recommend the Organization evaluates policies and procedures to ensure all required information is communicated with the subrecipient. Views of Responsible Officials: Management agrees with this Single Audit Finding and response is included in the Corrective Action Plan.

2024-002 Significant Deficiency in Internal Control and Compliance over Major Programs Funding Agency: Department of Treasury ALN: 21.027 Criteria Internal controls and other compliance knowledge should provide adequate subrecipient monitoring under federal awards. Per 2 CFR 200.332(d), pass-through entities should "monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations and the terms and conditions of the subaward; and that subaward performance goals are achieved." This would include site monitoring visits during the grant's period of performance. Condition The Organization provided funds to subrecipients under its direct award from the Department of Treasury. Payments to subrecipients are made on a reimbursement basis. Context During our subrecipient monitoring testing, we noted one of the three subrecipients tested did not receive a site visit during the grant agreement period. Per our discussion with management, the Organization was unable to schedule a monitoring visit during the grant agreement period. The Organization was also unable to provide sufficient documentation that supported adequate monitoring activities were in place during the grant agreement period. Cause The error was caused by the Organization's negligence to conduct any monitoring activity during the grant agreement period. Effect Unallowable activities or cost principles could be charged to the Department of Treasury. Repeat Finding No.Auditor's Recommendation It is recommended that the Organization reevaluates its internal controls over subrecipient monitoring to ensure that proper monitoring is occurring during the grant agreement period. The Organization should also consider who is responsible for the monitoring activity, and if necessary, assign those responsibilities to an employee who has a more flexible schedule that can accommodate the scheduled monitoring visits.

2024-002 Significant Deficiency in Internal Control and Compliance over Major Programs Funding Agency: Department of Treasury ALN: 21.027 Criteria Internal controls and other compliance knowledge should provide adequate subrecipient monitoring under federal awards. Per 2 CFR 200.332(d), pass-through entities should "monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations and the terms and conditions of the subaward; and that subaward performance goals are achieved." This would include site monitoring visits during the grant's period of performance. Condition The Organization provided funds to subrecipients under its direct award from the Department of Treasury. Payments to subrecipients are made on a reimbursement basis. Context During our subrecipient monitoring testing, we noted one of the three subrecipients tested did not receive a site visit during the grant agreement period. Per our discussion with management, the Organization was unable to schedule a monitoring visit during the grant agreement period. The Organization was also unable to provide sufficient documentation that supported adequate monitoring activities were in place during the grant agreement period. Cause The error was caused by the Organization's negligence to conduct any monitoring activity during the grant agreement period. Effect Unallowable activities or cost principles could be charged to the Department of Treasury. Repeat Finding No.Auditor's Recommendation It is recommended that the Organization reevaluates its internal controls over subrecipient monitoring to ensure that proper monitoring is occurring during the grant agreement period. The Organization should also consider who is responsible for the monitoring activity, and if necessary, assign those responsibilities to an employee who has a more flexible schedule that can accommodate the scheduled monitoring visits.

2024-002 Significant Deficiency in Internal Control and Compliance over Major Programs Funding Agency: Department of Treasury ALN: 21.027 Criteria Internal controls and other compliance knowledge should provide adequate subrecipient monitoring under federal awards. Per 2 CFR 200.332(d), pass-through entities should "monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations and the terms and conditions of the subaward; and that subaward performance goals are achieved." This would include site monitoring visits during the grant's period of performance. Condition The Organization provided funds to subrecipients under its direct award from the Department of Treasury. Payments to subrecipients are made on a reimbursement basis. Context During our subrecipient monitoring testing, we noted one of the three subrecipients tested did not receive a site visit during the grant agreement period. Per our discussion with management, the Organization was unable to schedule a monitoring visit during the grant agreement period. The Organization was also unable to provide sufficient documentation that supported adequate monitoring activities were in place during the grant agreement period. Cause The error was caused by the Organization's negligence to conduct any monitoring activity during the grant agreement period. Effect Unallowable activities or cost principles could be charged to the Department of Treasury. Repeat Finding No.Auditor's Recommendation It is recommended that the Organization reevaluates its internal controls over subrecipient monitoring to ensure that proper monitoring is occurring during the grant agreement period. The Organization should also consider who is responsible for the monitoring activity, and if necessary, assign those responsibilities to an employee who has a more flexible schedule that can accommodate the scheduled monitoring visits.

2024-002 Significant Deficiency in Internal Control and Compliance over Major Programs Funding Agency: Department of Treasury ALN: 21.027 Criteria Internal controls and other compliance knowledge should provide adequate subrecipient monitoring under federal awards. Per 2 CFR 200.332(d), pass-through entities should "monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations and the terms and conditions of the subaward; and that subaward performance goals are achieved." This would include site monitoring visits during the grant's period of performance. Condition The Organization provided funds to subrecipients under its direct award from the Department of Treasury. Payments to subrecipients are made on a reimbursement basis. Context During our subrecipient monitoring testing, we noted one of the three subrecipients tested did not receive a site visit during the grant agreement period. Per our discussion with management, the Organization was unable to schedule a monitoring visit during the grant agreement period. The Organization was also unable to provide sufficient documentation that supported adequate monitoring activities were in place during the grant agreement period. Cause The error was caused by the Organization's negligence to conduct any monitoring activity during the grant agreement period. Effect Unallowable activities or cost principles could be charged to the Department of Treasury. Repeat Finding No.Auditor's Recommendation It is recommended that the Organization reevaluates its internal controls over subrecipient monitoring to ensure that proper monitoring is occurring during the grant agreement period. The Organization should also consider who is responsible for the monitoring activity, and if necessary, assign those responsibilities to an employee who has a more flexible schedule that can accommodate the scheduled monitoring visits.

2024-002 Significant Deficiency in Internal Control and Compliance over Major Programs Funding Agency: Department of Treasury ALN: 21.027 Criteria Internal controls and other compliance knowledge should provide adequate subrecipient monitoring under federal awards. Per 2 CFR 200.332(d), pass-through entities should "monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations and the terms and conditions of the subaward; and that subaward performance goals are achieved." This would include site monitoring visits during the grant's period of performance. Condition The Organization provided funds to subrecipients under its direct award from the Department of Treasury. Payments to subrecipients are made on a reimbursement basis. Context During our subrecipient monitoring testing, we noted one of the three subrecipients tested did not receive a site visit during the grant agreement period. Per our discussion with management, the Organization was unable to schedule a monitoring visit during the grant agreement period. The Organization was also unable to provide sufficient documentation that supported adequate monitoring activities were in place during the grant agreement period. Cause The error was caused by the Organization's negligence to conduct any monitoring activity during the grant agreement period. Effect Unallowable activities or cost principles could be charged to the Department of Treasury. Repeat Finding No.Auditor's Recommendation It is recommended that the Organization reevaluates its internal controls over subrecipient monitoring to ensure that proper monitoring is occurring during the grant agreement period. The Organization should also consider who is responsible for the monitoring activity, and if necessary, assign those responsibilities to an employee who has a more flexible schedule that can accommodate the scheduled monitoring visits.

Subrecipient Monitoring Prior Year Finding Number: N/A Year of Finding Origination: 2024 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Significant Deficiency and Other Matter Federal Agency: U.S. Department of the Treasury Program: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Award Number and Year: SLT0790; 2021 Pass-Through Agency: N/A – Direct Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 U.S. Code of Federal Regulations § 200.332 includes requirements such as evaluating the subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the award. Condition: The City did not have documentation of risk assessment procedures performed for two of the four subrecipients tested. Questioned Costs: None. Context: The City of Minneapolis has documented the subaward and subrecipient procedures that its staff are expected to follow. These procedures include the completion of a pre-award risk assessment form and for the form to be maintained in the contract file of the subrecipient. The sample size was based on guidance from Chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Effect: The City is not in compliance with federal regulations. Cause: City staff were not aware of the requirement to perform pre-award risk assessments with subrecipients. Recommendation: We recommend the City ensure that the City’s employees follow its procedures for completing risk assessments when contracting with subrecipients. View of Responsible Official: Concur

Criteria: 2 CFR 200.332 establishes requirements for pass-through entities. Included in these requirements is to monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. Condition: The City did have procedures in place to monitor allowable costs and activities of its subrecipients. However, while conducting a review of expenditures through the monitoring of the Appalachia Community Grant (ACG), the Ohio Department of Development (ODOD), noted that a subrecipient of the City had made unallowable expenditures for the grant. This demonstrates a control weakness in the subrecipient monitoring controls conducted by the City. Context: The City, ODOD, and the subrecipient are working on a way to recover any questioned costs associated with this and these do not represent questioned costs of the City. Effect: There is a significant deficiency in the subrecipient monitoring controls of the City that could allow future unallowable costs or activities at subrecipients, if not improved. Recommendation: We recommend that the City implement stronger monitoring controls including vendor verification and review of invoices for the draw down requests that they receive from their subrecipients.

FINDING 2024-001 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Subrecipient Monitoring Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Other Matters INDIANA STATE BOARD OF ACCOUNTS 13 HANCOCK COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Condition and Context The County received an allocation of the COVID-19 - State and Local Fiscal Recovery Funds (SLFRF) from the U.S. Department of the Treasury to support its response and recovery from the novel coronavirus. A portion of the County's allocation was then used to subaward funds to another entity (i.e., the subrecipient) to carry out an eligible use. The subaward was provided to the subrecipient via two different subaward agreements. Both subaward agreements were selected for testing. The County, as the pass-through entity, is to clearly identify the subaward and the terms and conditions of the award in the agreement with the subrecipient. During review of the two subaward agreements, it was determined that the Assistance Listings Number (ALN) and Federal Award Identification Number (FAIN) were not included as required. Additionally, the County as the pass-through entity, is to monitor the activities of the subrecipient to ensure that the subaward is used for authorized purposes in compliance with federal statutes, regulations, and terms and conditions of the subaward and that performance goals are achieved. Part of the monitoring requirements include verifying the subrecipient received an audit as required so as to be able to issue management decisions on any findings, as applicable. The County did not have a process in place to obtain and review audits received by the subrecipient. Therefore, the County would not have been able to issue management decisions or ensure timely and appropriate action by the subrecipient. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: "(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states in part: "All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); INDIANA STATE BOARD OF ACCOUNTS 14 HANCOCK COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date . . . of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the passthrough entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R & D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is used charged) per § 200.414. . . . (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 of this part and in program regulations." Cause The County did not have adequate processes or procedures in place to ensure all of the proper information about the grant was provided to the subrecipient and all required monitoring activities were being conducted. Effect Not providing award identification information to subrecipients could result in the subrecipient not properly reporting the grant on their Schedule of Expenditures of Federal Awards. Furthermore, due to the absence of policies and procedures to monitor the activities of subrecipients, subrecipients could be spending federal funds for unauthorized purposes without the County's knowledge. As such, the County cannot ensure proper accountability and compliance with the program requirements. INDIANA STATE BOARD OF ACCOUNTS 15 HANCOCK COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that the County strengthen its system of internal controls to ensure that the County verifies that all subrecipients of federal awards receive an audit and that the County receives and reviews any audit reports of the subrecipients. Additionally, we recommended that the County strengthen its system of internal controls to ensure that subaward agreements include all required information that should be known to the subrecipient. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Criteria or specific requirement: Per 2 CFR 200.303(a), the County must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the ”Standards for Internal Control in the Federal Government” issued by the Comptroller General of the Untied States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Under Uniform Grant Guidance, the County must: • Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain required information including but not limited to: Federal and subaward information, indirect cost rate, and the subrecipient’s unique entity identifier (UEI). (2 CFR 200.332 (b)) • Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. (2 CFR 200.332 (c)) • Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. (2 CFR 200.332 (e)) • Verify that a subrecipient is audited as required by 2 CFR 200.501. (2 CFR 200.332 (g))Condition: Subaward agreement was expired and did not include all required information, nor did the subrecipient have the required UEI. Subaward requirements were not communicated to the subrecipient; therefore, monitoring activities were not effective. Documentation of subrecipient risk assessment or audit verification not available for audit.Questioned Costs: None noted.Context: Audit procedures included testing of the one subrecipient who received a subaward during the year. There were no other subrecipients.Cause: The County’s procedures were not sufficient to ensure the subawards were issued or monitored in compliance with Federal requirements. Internal controls did not prevent or detect the errors.Effect: Failure to properly document required contract information, perform the necessary risk assessments, and document the review of the subrecipient’s single audit may result in noncompliance with grant terms and conditions. Subrecipients may have incomplete Schedules of Expenditures of Federal Awards, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance.

Federal Program Name: Research and Development Cluster: Uniformed Services University Medical Research Projects Federal Agency: U.S. Department of Defense Federal Assistance Listing Number: 12.750 Criteria or Specific Requirement: Subrecipient Monitoring Condition: During testing of subrecipient monitoring, it was noted that the Organization awarded three awards to subrecipients during the year and did not inform these subrecipients of the federal nature of the award at the time of the subaward. Specifically, the required federal award information was not included in the subaward documentation. Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance with federal requirements. Questioned Costs: None Context: In accordance with 2 CFR section 200.332(a), pass-through entities are required to clearly identify to the subrecipient the federal award information at the time of the subaward. This includes the federal award identification number, the federal awarding agency, the assistance listing number (ALN), and the amount of federal funds obligated. This information was not communicated to the subrecipients Cause: The Organization did not have adequate procedures in place to ensure that all required federal award information was communicated to subrecipients. Repeat Finding: No Recommendation: We recommend that the Organization implement procedures to ensure that all required federal award information is included in subaward agreements and communicated to subrecipients at the time of the award. Views of Responsible Officials and Planned Corrective Action: The Organization agrees with the comment and will revise policies to communicate all required federal award information to subrecipients.

Federal Program Name: Research and Development Cluster: Uniformed Services University Medical Research Projects Federal Agency: U.S. Department of Defense Federal Assistance Listing Number: 12.750 Criteria or Specific Requirement: Subrecipient Monitoring Condition: During testing of subrecipient monitoring, it was noted that the Organization awarded three awards to subrecipients during the year and did not inform these subrecipients of the federal nature of the award at the time of the subaward. Specifically, the required federal award information was not included in the subaward documentation. Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance with federal requirements. Questioned Costs: None Context: In accordance with 2 CFR section 200.332(a), pass-through entities are required to clearly identify to the subrecipient the federal award information at the time of the subaward. This includes the federal award identification number, the federal awarding agency, the assistance listing number (ALN), and the amount of federal funds obligated. This information was not communicated to the subrecipients Cause: The Organization did not have adequate procedures in place to ensure that all required federal award information was communicated to subrecipients. Repeat Finding: No Recommendation: We recommend that the Organization implement procedures to ensure that all required federal award information is included in subaward agreements and communicated to subrecipients at the time of the award. Views of Responsible Officials and Planned Corrective Action: The Organization agrees with the comment and will revise policies to communicate all required federal award information to subrecipients.

Federal Program Name: Research and Development Cluster: Uniformed Services University Medical Research Projects Federal Agency: U.S. Department of Defense Federal Assistance Listing Number: 12.750 Criteria or Specific Requirement: Subrecipient Monitoring Condition: During testing of subrecipient monitoring, it was noted that the Organization awarded three awards to subrecipients during the year and did not inform these subrecipients of the federal nature of the award at the time of the subaward. Specifically, the required federal award information was not included in the subaward documentation. Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance with federal requirements. Questioned Costs: None Context: In accordance with 2 CFR section 200.332(a), pass-through entities are required to clearly identify to the subrecipient the federal award information at the time of the subaward. This includes the federal award identification number, the federal awarding agency, the assistance listing number (ALN), and the amount of federal funds obligated. This information was not communicated to the subrecipients Cause: The Organization did not have adequate procedures in place to ensure that all required federal award information was communicated to subrecipients. Repeat Finding: No Recommendation: We recommend that the Organization implement procedures to ensure that all required federal award information is included in subaward agreements and communicated to subrecipients at the time of the award. Views of Responsible Officials and Planned Corrective Action: The Organization agrees with the comment and will revise policies to communicate all required federal award information to subrecipients.

Federal Program Name: Research and Development Cluster: Uniformed Services University Medical Research Projects Federal Agency: U.S. Department of Defense Federal Assistance Listing Number: 12.750 Criteria or Specific Requirement: Subrecipient Monitoring Condition: During testing of subrecipient monitoring, it was noted that the Organization awarded three awards to subrecipients during the year and did not inform these subrecipients of the federal nature of the award at the time of the subaward. Specifically, the required federal award information was not included in the subaward documentation. Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance with federal requirements. Questioned Costs: None Context: In accordance with 2 CFR section 200.332(a), pass-through entities are required to clearly identify to the subrecipient the federal award information at the time of the subaward. This includes the federal award identification number, the federal awarding agency, the assistance listing number (ALN), and the amount of federal funds obligated. This information was not communicated to the subrecipients Cause: The Organization did not have adequate procedures in place to ensure that all required federal award information was communicated to subrecipients. Repeat Finding: No Recommendation: We recommend that the Organization implement procedures to ensure that all required federal award information is included in subaward agreements and communicated to subrecipients at the time of the award. Views of Responsible Officials and Planned Corrective Action: The Organization agrees with the comment and will revise policies to communicate all required federal award information to subrecipients.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024 – 002: Subrecipient Monitoring Significant Deficiency Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 • Pass-Through from Project Concern International – PCI-1203-SG-1600 • Direct award: Reducing Post Harvest Losses through Access to New Technologies - 720BHA22CA00020 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Weaknesses were found in federal subrecipient controls and monitoring during 2024. Context: For each of the six subrecipients selected for testing, the documentation within the 2024 monitoring tracker tool was incomplete, as certain monitoring procedures conducted were not fully recorded and reviewed in the tracker as required by iDE policies. Additionally, one subrecipient underwent a site visit that was not formally documented in a monitoring visit report, resulting in the absence of any record indicating a review had occurred. Overall, subrecipient risk assessments were inconsistently evaluated, leading to insufficient focus on high-risk subrecipients relative to those considered low risk. Cause: Employee turnover and personnel constraints. Effect: Inadequate procedures and controls for subrecipient monitoring may result in noncompliance with applicable federal statutes, regulations, or award terms and conditions. Questioned costs: None Repeat finding? No Recommendation: Management may consider reviewing existing controls over subrecipient monitoring to evaluate their effectiveness in supporting iDE's compliance with 2 CFR 200 requirements. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.

Finding 2024-004: 10. 761 - U.S. Department of Agriculture - Water and Waste Technical Assistance and Training - Material Weakness Compliance Requirement: Subrecipient Monitoring Criteria: Per Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Subpart D, section 200.332, the non-Federal entity must determine the subrecipient is not excluded or debarred or otherwise excluded from receiving Federal funds, as well as develop written subrecipient monitoring policies and procedures. Condition: During our testing of internal controls over compliance related to subrecipient monitoring, we identified EWB-USA did not have written subrecipient monitoring policies or procedures in place, nor determine that the subrecipient was not suspended or debarred or otherwise excluded from receiving Federal funds. Additionally, EWB-USA did not obtain a copy of the subrecipient's Uniform Guidance compliance audit. Questioned Costs: None. Cause: EWB-USA did not have adequate controls in place to ensure compliance with applicable federal requirements. Effect: EWB-USA was not in compliance with the subrecipient monitoring provisions as prescribed in the Uniform Guidance. Recommendation: We recommend that EWB-USA adopt formal, written subrecipient monitoring policies and procedures the comply with the Uniform Guidance. Response: 1. Develop a policy for subrecipient monitoring, and implement procedures to oversee the programmatic and financial activities of subrecipients and ensure compliance with regulations. 2. Develop a standardized checklist to guide the monitoring of subrecipients. 3. Provide training to relevant staff on the new procedures for subrecipient monitoring and the importance of compliance with federal regulations.

Finding 2024-004: 10. 761 - U.S. Department of Agriculture - Water and Waste Technical Assistance and Training - Material Weakness Compliance Requirement: Subrecipient Monitoring Criteria: Per Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Subpart D, section 200.332, the non-Federal entity must determine the subrecipient is not excluded or debarred or otherwise excluded from receiving Federal funds, as well as develop written subrecipient monitoring policies and procedures. Condition: During our testing of internal controls over compliance related to subrecipient monitoring, we identified EWB-USA did not have written subrecipient monitoring policies or procedures in place, nor determine that the subrecipient was not suspended or debarred or otherwise excluded from receiving Federal funds. Additionally, EWB-USA did not obtain a copy of the subrecipient's Uniform Guidance compliance audit. Questioned Costs: None. Cause: EWB-USA did not have adequate controls in place to ensure compliance with applicable federal requirements. Effect: EWB-USA was not in compliance with the subrecipient monitoring provisions as prescribed in the Uniform Guidance. Recommendation: We recommend that EWB-USA adopt formal, written subrecipient monitoring policies and procedures the comply with the Uniform Guidance. Response: 1. Develop a policy for subrecipient monitoring, and implement procedures to oversee the programmatic and financial activities of subrecipients and ensure compliance with regulations. 2. Develop a standardized checklist to guide the monitoring of subrecipients. 3. Provide training to relevant staff on the new procedures for subrecipient monitoring and the importance of compliance with federal regulations.

2024-001: Internal Control over Compliance with Subrecipient Monitoring and Noncompliance with Subrecipient Monitoring U.S. Department of Health and Human Services; Passed through the State of Tennessee Department of Health: ALN #93.558 Temporary Assistance for Needy Families Federal Award Identification: 68080 Grant Year: 10/1/2020-9/30/2024 Criteria: 2 CFR section 200.332(d) states: Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200-521. Condition and context: The Organization typically requests and reviews subrecipient financial statement audits on an annual basis with annual renewals of contracts. The Temporary Assistance for Needy Families Grant has a three-year grant period. Since subrecipients weren't required to have annual renewals, the Organization did not request or review the annual financial statement audits of subrecipients of this grant. Therefore, the Organization did not comply with the monitoring required by 2CFR section 200.332(d). Cause: The Organization’s internal controls over subrecipient monitoring were not sufficiently designed and implemented to ensure that applicable audits from subrecipients were obtained and reviewed annually. Effect or potential effect: Procedures required by 2 CFR section 200.332(d) related to reviewing financial reports of the subrecipient and following-up on deficiencies pertaining to the Federal award could not completed. The Uniform Guidance audit could have noted findings related to compliance with the spending of the federal assistance that would have been unknown to the Organization. Recommendation: We recommend that the Organization track all subrecipient with federal assistance and establish a process to ensure the financial statement and Uniform Guidance audits are obtained timely and monitoring procedures required by 2 CFR section 200.332(d) are completed. Views of responsible officials: Management acknowledge this finding and will address remediation in the accompanying corrective action plan in Appendix A