Findings Citing § 200.332

Significant deficiency in internal controls over subrecipient monitoring. • Program Title: Substance Abuse Block Grants • Assistance Listing Number: 93.959 • Federal award identification number: B08TI085843 • Federal Agency: Department of Health and Human Services • Pass-through Entity: Washington State Health Care Authority Criteria 2 U.S. Code of Federal Regulations (CFR) 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) Subpart D section 2 CFR 200.332 requires that a pass-through entity must ensure that every subaward is clearly identified to the subrecipient as a subaward. Condition/Context Washington Association of Sheriffs & Police Chiefs (the Association) passes substantially all federal funding through to subrecipients. During testing it was identified that, although the Association satisfied all ongoing monitoring requirements, on the coversheet of all subrecipient contracts in place during the year, a box indicating that the third party was not a subrecipient was incorrectly checked. This error by default incorrectly communicated to their subrecipients that they were contractors. Cause Washington Association of Sheriffs & Police Chiefs’ internal controls related to the review of subrecipient contracts were not functioning properly causing the pervasive error to be overlooked. Effect or potential effect Subrecipients were not clearly communicated their roles. Questioned costs N/A Repeat audit finding No Recommendation We recommend that Washington Association of Sheriffs & Police Chiefs ensure there is a proper understanding of the nature of a subrecipient vs a contractor, and that they ensure that this determination is being reviewed, and clearly communicated in underlying agreements, as part of their internal control processes Views of responsible officials Management agrees with the finding and has provided the corrective action plan following the Single Audit Report

Criteria: In accordance with 2 CFR 200.332(d), recipients of federal awards who pass funds to subrecipients are required to monitor the activities of subrecipients to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Required monitoring includes reviewing financial and performance reports, following up on deficiencies, and ensuring timely corrective action is taken. Condition: During the year ended December 31, 2024, FFT passed CSLFRF funds to one subrecipient. FFT did not perform any documented monitoring activities over this subrecipient. Specifically, FFT did not obtain or review financial and performance reports, nor did it conduct site visits, desk reviews, or other monitoring procedures required to ensure compliance with federal regulations. Cause: FFT did not establish formalized subrecipient monitoring procedures for CSLFRF funds, due in part to a misunderstanding of its responsibilities as a pass-through entity and the federal compliance requirements related to subrecipient oversight. Effect: As a result of inadequate subrecipient monitoring, there is an increased risk that subrecipients may have expended federal funds on unallowable costs or failed to comply with CSLFRF program requirements. This deficiency exposes FFT to potential repayment of funds and reputational risk if noncompliance is identified at the subrecipient level. Questioned Cost: No specific questioned costs were identified; however, the total amount of CSLFRF funds passed through to the subrecipients without adequate monitoring was $353,050, which is considered to be at risk of noncompliance. Recommendation: We recommend that FFT establish and implement formal subrecipient monitoring procedures to ensure compliance with 2 CFR 200.332(d). This should include, developing a documented monitoring plan for CSLFRF subrecipients, obtaining and reviewing periodic financial and performance reports from subrecipients, performing documented follow-up on any deficiencies noted, and providing training to responsible staff regarding subrecipient monitoring requirements. Views of Responsible Officials: See 2024 Corrective Action Plan.

2024-002 Finding – Federal Award Type: Subrecipient Monitoring – Non-Compliance and Significant Deficiency in Internal Control Over Compliance. AL Number: 10.163 Market Protection and PromotionCriteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. In accordance with 2 CFR section 200.332, a pass-through entity must clearly identify to the subrecipient the award as a subaward by providing the required federal information related to the award, all requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the provisions of contracts and grants agreements. The pass-through entity must evaluate risk of non-compliance of each subrecipient, monitoring the subrecipient and ensuring accountability of for-profit subrecipients. Condition / Context: Oregon Tilth passed through $1,593,444 in funding to subrecipients under Assistance Listing 10.163. During our audit, we noted that Oregon Tilth did have documented written procedures or controls in place to ensure compliance with the U.S. Office of Management and Budget’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) subrecipient monitoring requirements. It was noted that within subaward contracts, required federal contract information was provided. Further, subrecipients are being evaluated for risk of non-compliance, prior to engaging in a subcontract. While monitoring has improved, as Oregon Tilth is having regular meetings to ensure tasks are being completed timely and providing technical assistance when needed, it was noted that in the sample of five subrecipients, three subrecipient was subject to 2 CFR Subpart F and the audit for this entity was not obtained. Per 2 CFR 200.332(d)(2) & (3), an entity must ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, highlighting the status of action planned or taken to address Single Audit Finding related to the subaward. They must also issue a management decision for applicable audit findings. Further, per 2 CFR 200.332(g), pass-through entities must verify that a subrecipient is audited as required by 2 CFR 200 subpart F. Oregon Tilth did have the subrecipient answer a questionnaire that included a question asking if the subrecipient was subject to 2 CFR 200 subpart F, however they did not obtain the audit or verify in any other way that the client was audited as required by 2 CFR 200 subpart F. Cause: Procedures were in place to ensure that Oregon Tilth is maintaining proper subrecipient monitoring for each federal subrecipient, however the procedures were not fully compliant with 2 CFR 200.332. Effect: Failure to maintain sufficient subrecipient monitoring may result in the wrongful use of federal funds and non‐compliance with the provisions of applicable requirements of the federal award. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding the contracting and monitoring of subrecipients that are in line with Uniform Guidance requirements, as well as establish organizational controls to ensure that such policies and procedures are being followed. Management’s Response: Management concurs with the finding and will implement effective internal controls to ensure that subrecipient monitoring is properly done and documented appropriately.

Finding 2024-004 – Subrecipient Monitoring U.S. Department of Commerce Economic Development Cluster ALN 11.307 Grantor Number 01-79-15312 Condition: The Organization does not have formal subrecipient monitoring policies and procedures in place to document the assessment of risk for subrecipients. Specifically, there is no documented review of subrecipient financial or performance reports, no formal risk assessments conducted prior to disbursement of funds, and no site visits or other monitoring activities to ensure compliance with award terms and federal regulations. In addition, the Organization does not have procedures in place to adequately review the subrecipient audits received, ensure that audit requirement language is included in each contract, or notify the subrecipient of the subaward ALN and amount that was paid during the year. Criteria of Specific Requirement: Pass-through entities are required to evaluate subrecipient risks of noncompliance as part of their subrecipient monitoring procedures. In addition, 2 CFR 200.332(d) indicates as part of the monitoring process, the pass-through entity should ensure subrecipients are notified of their requirement to receive an audit and take follow-up action on audit deficiencies, which would be identified as part of the review of the annual audit reports of subrecipients and 2 CFR section 200.332(a) required pass-through entities to notify the subrecipient at the time of the subaward of the subaward ALN and amount that was paid during the year. Questioned Costs: Unknown Cause: The Organization does not have procedures in place to document the assessment of risk for subrecipients. In addition, the Organization does not have procedures in place to adequately review all subrecipient audits or notify the subrecipient of the subaward ALN and amount that was paid during the year. Effect: The Organization was not in compliance with subrecipient monitoring requirements. Identification as a Repeat Finding: This is a repeat finding. Recommendation: The Organization should review all contract documents for conditions and terms, and based upon that review, implement procedures to ensure subrecipient monitoring includes proper risk assessment and monitoring of single audit compliance, along with any other grant requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees; see separate corrective action plan.

Finding 2024-002 Agency: Department of Labor Program: Apprenticeship State Funds (AL No. 17.285) Material Weakness over Subrecipient Monitoring Repeat Finding: No Condition: For all subrecipients of AACC, there was no supporting documentation to show that a risk assessment was performed by the pass-through entity before awarding funds to each subrecipient. Additionally, for monitoring procedures performed AACC used general subrecipient monitoring forms which were all signed in March 2025 which is after the annual monitoring period ending December 31, 2024. The monitoring forms did not include information related to missing support for various subrecipient invoices as noted in finding 2024-001. Additionally, there were no follow-up procedures documented on the forms to ensure corrective action took place. Criteria: As provided in 2 CFR section 200.332: Requirements for pass-through entities, a pass-through entity must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. Cause: AACC does not have a policy in place to properly document risk assessment of subrecipients before awarding funds to them. AACC does not have a policy in place to ensure all necessary monitoring procedures performed based on its risk assessment are properly documented in a timely manner. Effect: AACC was not in compliance with the Subrecipient Monitoring requirements in accordance with Uniform Guidance. Questioned Costs: Unknown Recommendation: We recommend AACC implements a policy to properly document their assessment of their subrecipients fraud risk and risk of noncompliance to then conclude on satisfactory monitoring procedures. We recommend AACC implements a policy to properly document all necessary monitoring procedures in a timely manner. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report.

FINDING 2024-003 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Subrecipient Monitoring Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): SLFRP1096 Compliance Requirement: Subrecipient Monitoring Audit Finding: Material Weakness INDIANA STATE BOARD OF ACCOUNTS 19 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Condition and Context Subrecipients associated with the City's Non-profit, Affordable Housing, and Homeless Initiatives activities funded by the COVID-19 - Coronavirus State and Local Fiscal Recovery Funds were required to submit reports on program activities either quarterly or monthly. The City did not have adequate internal controls in place designed to ensure that these reports were reviewed. Responsibility for reviewing these reports rested primarily with one employee. For two of three subrecipients tested, we were not able to determine that there was a second employee involved that would ensure that the reports submitted by the subrecipients were reviewed by the City. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states: "All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and include the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward notification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; INDIANA STATE BOARD OF ACCOUNTS 20 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the passthrough entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the passthrough entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports. (4) (i) An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the passthrough entity must determine the appropriate rate in collaboration with the subrecipient, which is either: (A) The negotiated indirect cost rate between the pass-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass through entity is not required to collect information justifying this rate, but may elect to do so; (B) The de minimis indirect cost rate. (ii) The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). INDIANA STATE BOARD OF ACCOUNTS 21 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and (6) Appropriate terms and conditions concerning closeout of the subaward. . . . (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. INDIANA STATE BOARD OF ACCOUNTS 22 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program related matters; and (2) Performing on-site reviews of the subrecipient's program operations. (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 of this part and in program regulations." Cause A system of internal controls to include oversite and review of the quarterly or monthly reports prepared by the subrecipients was not in place. One individual was primarily responsible for reviewing the subrecipient reports. Effect Not having procedures in place for oversite and review of the monitoring reports could lead to noncompliance with the requirements for subrecipient monitoring. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the City. INDIANA STATE BOARD OF ACCOUNTS 23 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the City establish a proper system of internal controls to include oversite and review to ensure that the subrecipient report reviews are reviewed/approved by a second party. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Federal Program – American Rescue Plan Technical Assistance Investment Program – Assistance Listing No. 10.234 – Award No. 2023-70504-40441 – Program Year 2024 – U.S. Department of Agriculture Criteria or specific requirement – Subrecipient Monitoring, 2 CFR 200.332(b), (c) and (e) Condition – The pass-through entity is responsible for identifying the award and applicable requirements to the subrecipient at the time of the subaward providing information described in 2 CFR section 200.332 to ensure the subrecipient uses the federal award in accordance with federal statues, regulations, and the terms and conditions of the award. The pass-through entity is responsible for evaluating each subrecipient’s risk of noncompliance for purposes of determining appropriate subrecipient monitoring. The pass-through entity is responsible for monitoring the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Cause – While the organization did perform certain monitoring procedures, the organization did not have sufficient controls in place to ensure agreements with subrecipients were in compliance with requirements as well as to ensure appropriate monitoring of the subrecipients’ use of funding in accordance with 2 CFR section 200.332. Effect – The organization failed to have agreements with subrecipients that were inclusive of all applicable requirements outlined within 2 CFR section 200.332. The organization did not have sufficient procedures to appropriately monitor the subrecipients’ use of funds within the reporting period. Questioned costs – N/A Context – Out of a population of 8 subrecipients, 2 subrecipients were selected for testing. For the 2 subrecipients, the agreement with the subrecipient was missing information that is required to be communicated with the subrecipient to ensure compliance with federal requirements. Additionally, for the 2 subrecipients, audit reports were not obtained by the pass-through entity during the reporting period to ensure proper use of funding received and proper monitoring of the subaward. Our sample was not and was not intended to be statistically valid. Identification as a repeat finding, if applicable – N/A Recommendation – The organization should ensure agreements with subrecipients include all information required to be communicated to the subrecipient for the subaward. The organization should put controls in place to ensure that monitoring activities are tailored to this risk of each subrecipient and appropriately followed in alignment with what is required. Views of Responsible Officials and Planned Corrective Actions – Management agrees with finding. Management plans to develop a subrecipient monitoring policy aligned with 2 CFR 200.331-333. Management will also standardize agreement templates to include all required clauses for federal award subrecipient agreements, implement a subrecipient risk assessment tool to determine monitoring frequency and risk level identification, and assign staff for annual subrecipient desk reviews or site visits based on risk levels.

Assistance Listing Number: 93.193 Name of Federal Program: COVID-19 Urban Indian Health Services Name of Federal Agency: Department of Health and Human Services Award Period: January 1, 2024 – December 31, 2024 Criteria or Specific Requirement: Per 2 CFR Part 200, non-federal entities receiving federal awards must establish and maintain written policies and procedures addressing areas including, but not limited to: procurement (§200.317–§200.327); travel costs (§200.475); methods for avoiding duplication of costs (§200.403); subrecipient monitoring (§200.332); cash management and allowable costs (§200.302, §200.305). Condition: The organization has not implemented all policies and procedures required under the Uniform Guidance. Specifically, certain written policies and procedures required by 2 CFR Part 200, such as cash management, allowability of costs, equipment management, conflict of interest, procurement, travel, compensation, and fringe benefits, were either incomplete, not formally documented, or not in place during the audit period. Cause: The Council has not detailed its policies to conform with the requirements of the Uniform Guidance. Effect or Potential Effect: Without documented and implemented policies and procedures, the organization increases the risk of noncompliance with federal regulations, inconsistent application of requirements, unallowable costs being charged to federal awards, and potential questioned costs or sanctions from funding agencies. Repeat Finding: No Recommendation: Management should develop, formally adopt, and implement all required Uniform Guidance policies and procedures. Policies should be documented, communicated to relevant staff, and periodically reviewed to ensure ongoing compliance. Views of Responsible Officials: Management agrees with the finding and revise its policies and procedures to meet the criteria of the Uniform Guidance.

Assistance Listing Number: 93.193 Name of Federal Program: COVID-19 Urban Indian Health Services Name of Federal Agency: Department of Health and Human Services Award Period: January 1, 2024 – December 31, 2024 Criteria or Specific Requirement: Per 2 CFR Part 200, non-federal entities receiving federal awards must establish and maintain written policies and procedures addressing areas including, but not limited to: procurement (§200.317–§200.327); travel costs (§200.475); methods for avoiding duplication of costs (§200.403); subrecipient monitoring (§200.332); cash management and allowable costs (§200.302, §200.305). Condition: The organization has not implemented all policies and procedures required under the Uniform Guidance. Specifically, certain written policies and procedures required by 2 CFR Part 200, such as cash management, allowability of costs, equipment management, conflict of interest, procurement, travel, compensation, and fringe benefits, were either incomplete, not formally documented, or not in place during the audit period. Cause: The Council has not detailed its policies to conform with the requirements of the Uniform Guidance. Effect or Potential Effect: Without documented and implemented policies and procedures, the organization increases the risk of noncompliance with federal regulations, inconsistent application of requirements, unallowable costs being charged to federal awards, and potential questioned costs or sanctions from funding agencies. Repeat Finding: No Recommendation: Management should develop, formally adopt, and implement all required Uniform Guidance policies and procedures. Policies should be documented, communicated to relevant staff, and periodically reviewed to ensure ongoing compliance. Views of Responsible Officials: Management agrees with the finding and revise its policies and procedures to meet the criteria of the Uniform Guidance.

Finding 2024-001: Subrecipient Monitoring Federal Agency: U.S. Department of Housing and Urban Development Program Name: COVID 19 – HOME Investment Partnerships Program and HOME Investment Partnerships Program (HOME) - ALN 14.239; Award Identification Number: MC420501 Criteria of Specific Requirement: Per 2 CFR 200.332, a pass-through entity must monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Condition: During our testing of subrecipient monitoring, we noted that the City did not perform required monitoring procedures during the year. Questioned Costs: Unknown Cause: The City did not have adequate internal controls in place to ensure compliance with subrecipient monitoring requirements, and staffing turnover contributed to the lack of oversight. Effect: The City was not in compliance with subrecipient monitoring requirements. Identification as a Repeat Finding: This is not a repeat finding from the prior audit. Recommendation: We recommend the City implement controls to ensure compliance with subrecipient monitoring, documenting monitoring activities performed and following up on any identified deficiencies in a timely manner. Views of Responsible Officials and Planned Corrective Actions: Management agrees; see separate corrective action plan.

Finding 2024-001: Subrecipient Monitoring Federal Agency: U.S. Department of Housing and Urban Development Program Name: COVID 19 – HOME Investment Partnerships Program and HOME Investment Partnerships Program (HOME) - ALN 14.239; Award Identification Number: MC420501 Criteria of Specific Requirement: Per 2 CFR 200.332, a pass-through entity must monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Condition: During our testing of subrecipient monitoring, we noted that the City did not perform required monitoring procedures during the year. Questioned Costs: Unknown Cause: The City did not have adequate internal controls in place to ensure compliance with subrecipient monitoring requirements, and staffing turnover contributed to the lack of oversight. Effect: The City was not in compliance with subrecipient monitoring requirements. Identification as a Repeat Finding: This is not a repeat finding from the prior audit. Recommendation: We recommend the City implement controls to ensure compliance with subrecipient monitoring, documenting monitoring activities performed and following up on any identified deficiencies in a timely manner. Views of Responsible Officials and Planned Corrective Actions: Management agrees; see separate corrective action plan.

2024-001: Subrecipient Monitoring – Low Income Home Energy Assistance Program Federal Program: Low Income Home Energy Assistance/COVID-19 – Low Income Home Energy Assistance– American Rescue Plan Act Assistance Listing No.: 93.568 Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: None Federal Award Identification Number: 2401MELIEA/2501MELIEA/2401MELIEI/COVID-19 2101MEE5C6 Repeat Finding: This is not a repeat finding Criteria – CFR 200.332 states that pass-through entities must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Pass-through entities must also monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward and that subaward performance goals are achieved. MaineHousing performs annual quality assurance reviews over subrecipients for the Low Income Home Energy Assistance (LIHEAP) Program to ensure source documentation for determining benefits is accurate. In addition, MaineHousing performs annual fiscal monitoring reviews for subrecipients participating in the LIHEAP Program. Condition – During 2024, for two subrecipients, MaineHousing did not perform annual quality assurance reviews. For one high-risk subrecipient, MaineHousing did not formally document their fiscal monitoring review. Questioned costs – None. Cause – MaineHousing did not perform annual quality assurance reviews for two subrecipients due to staff turnover in the program. The annual fiscal monitoring review was not formally documented for one high-risk subrecipient as the subrecipient did not have an annual audit performed for the fiscal year. Effect or potential effect – There is a risk that LIHEAP benefits may not be properly calculated and beneficiaries may not have provided proper support in their request for benefits. Context – The sample of subrecipients was a statistically valid sample. Recommendation – MaineHousing should enhance controls to ensure that all subrecipients undergo required quality assurance reviews annually. If fiscal monitoring reviews are not applicable to certain subrecipients, management should document what steps were taken to supplant the monitoring reviews to ensure that the subrecipient was appropriately monitored and reviewed. Views of responsible officials – Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the Summary Schedule of Prior Audit Findings.

2024-001: Subrecipient Monitoring – Low Income Home Energy Assistance Program Federal Program: Low Income Home Energy Assistance/COVID-19 – Low Income Home Energy Assistance– American Rescue Plan Act Assistance Listing No.: 93.568 Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: None Federal Award Identification Number: 2401MELIEA/2501MELIEA/2401MELIEI/COVID-19 2101MEE5C6 Repeat Finding: This is not a repeat finding Criteria – CFR 200.332 states that pass-through entities must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Pass-through entities must also monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward and that subaward performance goals are achieved. MaineHousing performs annual quality assurance reviews over subrecipients for the Low Income Home Energy Assistance (LIHEAP) Program to ensure source documentation for determining benefits is accurate. In addition, MaineHousing performs annual fiscal monitoring reviews for subrecipients participating in the LIHEAP Program. Condition – During 2024, for two subrecipients, MaineHousing did not perform annual quality assurance reviews. For one high-risk subrecipient, MaineHousing did not formally document their fiscal monitoring review. Questioned costs – None. Cause – MaineHousing did not perform annual quality assurance reviews for two subrecipients due to staff turnover in the program. The annual fiscal monitoring review was not formally documented for one high-risk subrecipient as the subrecipient did not have an annual audit performed for the fiscal year. Effect or potential effect – There is a risk that LIHEAP benefits may not be properly calculated and beneficiaries may not have provided proper support in their request for benefits. Context – The sample of subrecipients was a statistically valid sample. Recommendation – MaineHousing should enhance controls to ensure that all subrecipients undergo required quality assurance reviews annually. If fiscal monitoring reviews are not applicable to certain subrecipients, management should document what steps were taken to supplant the monitoring reviews to ensure that the subrecipient was appropriately monitored and reviewed. Views of responsible officials – Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the Summary Schedule of Prior Audit Findings.

REFERENCE NUMBER 2024-002 Subrecipient Monitoring FEDERAL AGENCY Department of Transportation FEDERAL PROGRAM Formula Grants for Rural Areas and Tribal Transit Program ALN 20.509 IDENTIFICATION AS A REPEAT FINDING No QUESTIONED COSTS None EVALUATION OF FINDING Audit finding disclosed that are required to be reported in accordance with Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). CRITERIA The Uniform Guidance at 2 CFR section 200.332(c) requires ECCOG as the pass-through entity to assess the subrecipient's fraud risk and risk of noncompliance to determine the appropriate level of subrecipient monitoring. The Uniform Guidance at 2 CFR 332(e) requires the pass-through entity to review financial and performance reports and ensure the subrecipient takes appropriate corrective action. Finally, the Uniform Guidance at 2 CFR 332(f) requires the pass-through to perform additional monitoring based on its risk analysis. CONDITION ECCOG did not perform a formal risk assessment of its subrecipients. ECCOG did not document the required level of subrecipient monitoring. ECCOG did not review financial reports. One entity had a Single Audit for the year-ended December 31, 2023. ECCOG did input the subrecipient's statistics into the Colorado Department of Transportation's COTRAMS system. CONTEXT ECCOG had three subrecipients, two of which were material. This finding occurred for all three subrecipients. CAUSE ECCOG performed an informal analysis of the entities' risks. In addition, during the years-ended December 31, 2023 and 2024 reimbursement of subrecipient costs was being resolved with the Colorado Department of Transportation (CDOT). Certain 2023 costs were not reimbursed until 2024. CDOT did not agree to pay the subrecipient costs for the period March, 2024 to December 2024 until January 2025. In 2025, these entities are no longer subrecipients of ECCOG. The two significant subrecipients are now subrecipients of CDOT. EFFECT OR POTENTIAL EFFECT Failure to adequately perform and document the risk assessments on its subrecipients could result in the inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. RECOMMENDATION As noted above, ECCOG no longer has any subrecipients. ECCOG should document the necessary processes for subrecipient monitoring in its grant management policies. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTION See ECCOG’s corrective action plan on page 16.

2024-002 Finding – Federal Award Type: Subrecipient Monitoring – Non-Compliance and Significant Deficiency in Internal Control Over Compliance. (Partial repeat of finding 2023-001) Identification of Federal Program: AL Number: 81.086 Conservation Research and Development Program Criteria / Requirement: 2 CFR section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. In accordance with 2 CFR section 200.332, a pass-through entity must clearly identify to the subrecipient the award as a subaward by providing the required federal information related to the award, all requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the provisions of contracts and grants agreements. The pass-through entity must evaluate risk of non-compliance of each subrecipient, monitoring the subrecipient and ensuring accountability of for-profit subrecipients. Condition / Context: Forth Mobility Fund passed through $1,578,580 in funding to subrecipients under Assistance Listing 81.086. During our audit, we noted that Forth Mobility Fund had made improvements to subrecipient monitoring in 2024 by establishing a subrecipient monitoring policy and evaluating for risk of non-compliance for subrecipients prior to engaging in a subcontract on a prospective basis. It was noted that within subaward contracts, required federal contract information was provided and if the subrecipient is subject to 2 CFR Subpart F, the audit for this entity was obtained and reviewed for applicable audit findings. However, while monitoring has improved, as Forth Mobility Fund is having regular meetings to ensure tasks are being completed timely and providing technical assistance when needed, there is no formal documentation of this. Further, while a risk assessment is being made for new subrecipients, past subrecipients have not been evaluated and there is no methodical execution of the results of the risk assessment. Cause: Procedures were not in place to ensure that Forth Mobility Fund is maintaining proper subrecipient monitoring for each federal subrecipient. Effect: Failure to maintain sufficient subrecipient monitoring may result in the wrongful use of federal funds and non‐compliance with the provisions of applicable requirements of the federal award. Questioned Costs: None. Recommendation: The Organization should establish written policies and procedures regarding the contracting and monitoring of subrecipients that are in line with Uniform Guidance requirements, as well as establish organizational controls to ensure that such policies and procedures are prescriptive and being followed. Management’s Response: We agree with the auditor's comments, and effective October 31, 2024, we established procedures for monitoring subrecipients, including obtaining and reviewing their annual audits. We will strengthen these procedures by establishing a monitoring plan based on risk assessment for each subrecipient and formally documenting all monitoring activities by November 30, 2025

FINDING 2024-002 Significant Deficiency in Internal Controls Over Compliance, Noncompliance – Subrecipient Monitoring Federal Agency: U.S. Department of Agriculture Pass through Grantor: Not Applicable – Direct Award Federal Program: Soil and Water Conservation Assistance Listing Number: 10.902 Federal Award Identification Number: NR243A750023C002, NR243A750023C003 Criteria: Per 2 CFR Part 200, Subpart D, 200.332(c), the pass-through entity ("PTE") must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Further, in accordance with 2 CFR, Subpart D, Section 200.332(e), the PTE must monitor the activities of the subrecipient including ensuring that the subrecipient takes corrective action on findings. Lastly, per 2 CFR, Subpart D, Section 200.332(g), the PTE must verify that the subrecipient is audited as required by Subpart D. Condition/Context: Through Subrecipient Monitoring testing, we identified 2 subrecipients, both of which were selected for testing. The subrecipients expended $96,462 of federal award funding passed through to them from Ichauway for the year ended December 31, 2024. For both subrecipients, we determined that management did not monitor the subrecipients to ensure the subrecipient took corrective action on any findings nor did management verify that the subrecipient was audited as required by Subpart D. Cause: Management has not updated their subrecipient monitoring procedures to ensure it aligns with federal requirements. Effect: Without formal procedures or documented communications to verify that subrecipients are aware of, have completed, and have addressed any deficiencies identified in required audits, there is a risk that audit findings or compliance issues at the subrecipient level may go undetected or unaddressed. This could result in noncompliance with federal subrecipient monitoring requirements, potentially exposing Ichauway to reputational risk, questioned costs, or other adverse consequences in the event of a review or audit. Questioned Costs: None. Recommendation: Management should develop and implement formal procedures for subrecipient monitoring. This should include documented communications to verify that subrecipients are aware of audit requirements, have completed required audits, and have addressed any identified deficiencies in a timely manner. Views of Responsible Officials: See Corrective Action Plan.

FINDING 2024-002 Significant Deficiency in Internal Controls Over Compliance, Noncompliance – Subrecipient Monitoring Federal Agency: U.S. Department of Agriculture Pass through Grantor: Not Applicable – Direct Award Federal Program: Soil and Water Conservation Assistance Listing Number: 10.902 Federal Award Identification Number: NR243A750023C002, NR243A750023C003 Criteria: Per 2 CFR Part 200, Subpart D, 200.332(c), the pass-through entity ("PTE") must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Further, in accordance with 2 CFR, Subpart D, Section 200.332(e), the PTE must monitor the activities of the subrecipient including ensuring that the subrecipient takes corrective action on findings. Lastly, per 2 CFR, Subpart D, Section 200.332(g), the PTE must verify that the subrecipient is audited as required by Subpart D. Condition/Context: Through Subrecipient Monitoring testing, we identified 2 subrecipients, both of which were selected for testing. The subrecipients expended $96,462 of federal award funding passed through to them from Ichauway for the year ended December 31, 2024. For both subrecipients, we determined that management did not monitor the subrecipients to ensure the subrecipient took corrective action on any findings nor did management verify that the subrecipient was audited as required by Subpart D. Cause: Management has not updated their subrecipient monitoring procedures to ensure it aligns with federal requirements. Effect: Without formal procedures or documented communications to verify that subrecipients are aware of, have completed, and have addressed any deficiencies identified in required audits, there is a risk that audit findings or compliance issues at the subrecipient level may go undetected or unaddressed. This could result in noncompliance with federal subrecipient monitoring requirements, potentially exposing Ichauway to reputational risk, questioned costs, or other adverse consequences in the event of a review or audit. Questioned Costs: None. Recommendation: Management should develop and implement formal procedures for subrecipient monitoring. This should include documented communications to verify that subrecipients are aware of audit requirements, have completed required audits, and have addressed any identified deficiencies in a timely manner. Views of Responsible Officials: See Corrective Action Plan.

Community Health Workers for Public Health Response & Resilient AL #93.495 Subrecipient Monitoring Condition: The Allegheny County Health Department did not communicate to three subrecipients randomly selected for testing all of the information required to be communicated about the subawards. It appears that the Health Department does not have a process in place to communicate such information. The Health Department did not determine whether the three subrecipients we randomly selected for testing were required to obtain single audits and did not request or review such audits. We were also informed that the Health Department did not determine whether any of the subrecipients involved in the administration of the program required single audits and did not request or review such audits from any of the subrecipients. Criteria: The Uniform Guidance indicates that all pass-through entities must verify that every subrecipient is audited as required when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the applicable threshold (2 CFR 200.332(f)) and consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records (2 CFR 200.332(g)). Cause: This subrecipient monitoring was also a prior 2023 finding. The Health Department developed the corrective action plan for the prior finding on September 20, 2024, however, this grant ended on August 30, 2024 and the Health Department did not have the time to implement any of the corrective action plans for this program. In addition, the Health Department does not have proper internal controls in place to ensure they are complying with all audit requirements. Effect: The County was not in compliance with the terms of the federal grant program. Questioned Costs: None Recommendation: The Health Department should maintain lists of the subrecipients utilized for each federal program and use checklists to help ensure that the required subrecipient monitoring activities are performed for each subrecipient to ensure compliance with federal requirements. Management Response: Management agrees with the finding, see attached Corrective Action Plan.

Targeted Airshed Grant Program- AL# 66.956 Subrecipient Monitoring Condition: The Allegheny County Health Department did not communicate to Pittsburgh Regional Transit (PRT) all of the information required to be communicated about the subaward. It appears that the Health Department does not have a process in place to communicate such information. The Health Department also did not determine whether PRT was required to obtain a single audit and did not request or review such an audit. Consequently, the Health Department has no knowledge of any subrecipient single audit findings that may impact the federal award. Criteria: The Uniform Guidance indicates that all pass-through entities must verify that every subrecipient is audited as required when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the applicable threshold (2 CFR 200.332(f)) and consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records (2 CFR 200.332(g)). Cause: The Health Department was not attentive to the audit requirements. Effect: The County was not in compliance with the terms of the federal grant program. Questioned Costs: None Recommendation: The Health Department should maintain lists of the subrecipients utilized for each federal program and use checklists to help ensure that the required subrecipient monitoring activities are performed for each subrecipient to ensure compliance with federal program requirements. Management Response: Management agrees with the finding, see attached Corrective Action Plan.

Noncompliance with Subrecipient Monitoring Requirements and Material Weakness in Internal Control over Subrecipient Monitoring Assistance Listing Number: 21.027 Name of Federal Program or Cluster: COVID-19: Coronavirus State and Local Fiscal Recovery Funds Name of Federal Agency: Department of Treasury Name of Pass-Through Entities: State of Wisconsin Department of Administration Subrecipient Monitoring 2 CFR§200.332 requirements for pass-through entities: The Code of Federal Regulations (CFR) Section 200.332(e) requires a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. 2 CFR§200.303 requires the Organization to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The organization did not perform subrecipient monitoring procedures as listed in the criteria above for the subrecipient of the COVID-19: Coronavirus State and Local Fiscal Recovery Funds. In addition, the Organization’s internal controls over subrecipient monitoring did not prevent or detect noncompliance with subrecipient monitoring requirements. The Organization did, however, confirm with SAM.gov that the subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal Funds; included the required information in the subaward agreement, and performed the required risk assessment. The Organization has policies and procedures related to subrecipient monitoring in its fiscal procedures manual. However, management did not monitor to ensure that the requirements listed in its policies and procedures manual as well as the Uniform Guidance are being followed. Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Recommendation: We recommend that Organization management monitor their compliance with their subrecipient monitoring procedures to ensure that the required subrecipient monitoring is occurring. No WRTP has reviewed the organization’s fiscal policy manual including all subsections regarding monitoring responsibilities. Additional training has been provided and completed by management and staff. Management has reviewed all monitoring with the subrecipient in good faith efforts.

Noncompliance with Subrecipient Monitoring Requirements and Material Weakness in Internal Control over Subrecipient Monitoring Assistance Listing Number: 21.027 Name of Federal Program or Cluster: COVID-19: Coronavirus State and Local Fiscal Recovery Funds Name of Federal Agency: Department of Treasury Name of Pass-Through Entities: State of Wisconsin Department of Administration Subrecipient Monitoring 2 CFR§200.332 requirements for pass-through entities: The Code of Federal Regulations (CFR) Section 200.332(e) requires a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. 2 CFR§200.303 requires the Organization to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The organization did not perform subrecipient monitoring procedures as listed in the criteria above for the subrecipient of the COVID-19: Coronavirus State and Local Fiscal Recovery Funds. In addition, the Organization’s internal controls over subrecipient monitoring did not prevent or detect noncompliance with subrecipient monitoring requirements. The Organization did, however, confirm with SAM.gov that the subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal Funds; included the required information in the subaward agreement, and performed the required risk assessment. The Organization has policies and procedures related to subrecipient monitoring in its fiscal procedures manual. However, management did not monitor to ensure that the requirements listed in its policies and procedures manual as well as the Uniform Guidance are being followed. Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Recommendation: We recommend that Organization management monitor their compliance with their subrecipient monitoring procedures to ensure that the required subrecipient monitoring is occurring. No WRTP has reviewed the organization’s fiscal policy manual including all subsections regarding monitoring responsibilities. Additional training has been provided and completed by management and staff. Management has reviewed all monitoring with the subrecipient in good faith efforts.

Noncompliance with Subrecipient Monitoring Requirements and Material Weakness in Internal Control over Subrecipient Monitoring Assistance Listing Number: 21.027 Name of Federal Program or Cluster: COVID-19: Coronavirus State and Local Fiscal Recovery Funds Name of Federal Agency: Department of Treasury Name of Pass-Through Entities: State of Wisconsin Department of Administration Subrecipient Monitoring 2 CFR§200.332 requirements for pass-through entities: The Code of Federal Regulations (CFR) Section 200.332(e) requires a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. 2 CFR§200.303 requires the Organization to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The organization did not perform subrecipient monitoring procedures as listed in the criteria above for the subrecipient of the COVID-19: Coronavirus State and Local Fiscal Recovery Funds. In addition, the Organization’s internal controls over subrecipient monitoring did not prevent or detect noncompliance with subrecipient monitoring requirements. The Organization did, however, confirm with SAM.gov that the subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal Funds; included the required information in the subaward agreement, and performed the required risk assessment. The Organization has policies and procedures related to subrecipient monitoring in its fiscal procedures manual. However, management did not monitor to ensure that the requirements listed in its policies and procedures manual as well as the Uniform Guidance are being followed. Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Recommendation: We recommend that Organization management monitor their compliance with their subrecipient monitoring procedures to ensure that the required subrecipient monitoring is occurring. No WRTP has reviewed the organization’s fiscal policy manual including all subsections regarding monitoring responsibilities. Additional training has been provided and completed by management and staff. Management has reviewed all monitoring with the subrecipient in good faith efforts.

2024-001: Subrecipient Monitoring Criteria: The Code of Federal Regulations 2 CFR 200.332 states that all pass-through entities (PTE) must: Identify the Award and Applicable Requirements - Clearly identify to the subrecipient: (1) the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.331(a)(1); (2)all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.331(a)(3)). Evaluate Risk - Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). Monitor - Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: (1) Reviewing financial and programmatic (performance and special reports) required by the PTE. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Condition: The Organization did not clearly communicate the required federal award information and applicable requirements to the subrecipients. The Organization did not evaluate the risk of non-compliance of the subrecipients in order to identify the appropriate monitoring procedures. Cause: The Organization has not implemented policies or procedures, to the degree necessary, to ensure that federal award monitoring compliance requirements are being met. Effect: The Organization did not perform adequate monitoring procedures on the subrecipients. Without communication of required information, subrecipients may overspend award amounts or incur unallowable expenses towards the grant. Questioned Costs: N/A Statistical Sampling: Statistical sampling was not used in making sample selections. Recommendation: We recommend that management of the Organization implement policies, procedures, and internal controls to evaluate the subrecipient risk of noncompliance to ensure subrecipients are being appropriately monitored in compliance with federal regulations. Views of Responsible Officials: Management agrees with this finding and their response is included in the corrective action plan.

2024-005 Corporation for National and Community Service Federal Financial Assistance Listing #94.012, 22BIICA001 10/1/2022 – 9/30/2025, 23BIACA001 10/1/2023 – 9/30/2026, 23BIFNY001 10/1/2023 – 9/30/2026 Americorps September 11th National Day of Service and Remembrance Grants Subrecipient Monitoring Material Weakness in Internal Controls over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. 2 CFR 200.332 identifies the requirements for all pass-through entities surrounding subrecipient monitoring and management. Condition: We noted the following during testing; a) Subawards did not contain minimum required elements in accordance with 2 CFR 200.332(b) b) The organization did not consider all suggested elements when evaluating subgrantee’s fraud risk and risk of noncompliance with subaward in accordance with 2 CFR 200.332(c) c) Documentation could not be provided to substantiate whether suspension and debarment was considered prior to awarding subgrant d) The organization required the subgrantee to complete performance reports, however, did not require completion of a financial report in accordance with 2 CFR 200.332(e)(1) e) The organization did not considered whether subgrantee was required to be audited and therefore did not review whether subgrantee had deficiencies reported over the federal program in accordance with 2 CFR 200.332(e)(2) through 2 CFR 200.332(e)(4) Cause: Management was not familiar with all subrecipient monitoring requirements as published under 2 CFR 200.332. The organization has not adopted a subrecipient monitoring policy. Effect: Without full understanding of subrecipient monitoring requirements under 2 CFR 200.332, demonstrating that the program complies with laws, regulations, and other compliance requirements is difficult. Questioned Costs: None reported. Context/Sampling: Four out of seventeen subrecipients were reviewed for testing. Repeat Finding from Prior Year: No. Recommendation: We recommend management to review subrecipient monitoring requirements as published under 2 CFR 200.332 and adopt a subrecipient monitoring policy. Views of Responsible Officials: Management is in agreement.

Criteria or Specific Requirement: Per 2 CFR 200.332(b), Pass-through entities are responsible for identifying all the information in the subaward agreement to the subrecipients to provide reasonable assurance that subrecipient used the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Condition: The sole subaward issued under the federal program lacked key information identifying the recipient as a subrecipient of federal funding. Questioned Costs: None Context: There was only one subrecipient and subaward agreement lacking the key information outlined in 2 CFR 200.332(b). This subrecipient was started by former SFP employees and contractors and was only later split off as a separate legal entity. The intermingled nature of the original relationship of the subrecipient’s projects lead to the lack of formalized information in the subaward. Cause: Lack of adequate knowledge about the information required to be included in subaward agreements, per Uniform Guidance requirements. Effect: A lack of clear identification of federal funding in a subaward could lead to a subrecipient misunderstanding the nature of the funding sources it receives and the corresponding single audit requirements. Repeat Finding: No Recommendation: CLA recommends amending existing subaward agreements to include the award information required by CFR 200.332(b) and to verify all future subawards agreements include all necessary information prior to issuance. Views of Responsible Officials: There is no disagreement with the audit finding.

Subrecipient monitoring was direct and material to the Coronavirus State and Local Fiscal Recovery Funds program. The County passed funding to sixteen subrecipients and five subrecipients were selected for testing. Based upon the subrecipients selected for testing, subrecipient agreements were executed but did not include all required information under CFR § 200.332. In addition, the County does not have a formal process to monitor expenditures incurred by subrecipients. Reimbursement requests are submitted by subrecipients but supporting documentation was not consistently provided by subrecipient to enable the County to effectively monitor subrecipient expenditures.

Finding 2024-002 – Subrecipient Monitoring (Material Weakness) Program Information: 11.307 Economic Adjustment Assistance Criteria: Per 2 CFR § 200.332, pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information at the time of issuance and upon modification. Required elements include federal award identification; all requirements of the subaward including the federal statutes, regulations and terms and conditions; indirect cost rate; access to records; and closeout terms and conditions. Condition: The Organization awarded 13 awards to subrecipients and did not include the information required by 2 CFR § 200.332 in the subaward agreement. Cause/Effect: The pass-through entity did not have a standardized process or checklist to ensure all required subaward elements were included in the agreements. Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance and misuse of federal funds. Questioned costs: None Repeat findings: No similar findings noted in the prior year. Recommendation: We recommend that the pass-through entity implement a standardized subaward template and checklist aligned with 2 CFR § 200.332. Staff should be trained on Uniform Guidance requirements to ensure all subawards include the necessary elements. Views of responsible officials: Management agrees with the finding and the auditors’ recommendation. See Corrective Action Plan at the end of the report.

FINDING 2024-002 Subrecipient (Noncompliance, Significant Deficiency) Federal Program Information: Education Stabilization Fund (ALN 84.425U) Criteria: Per 2 CFR § 200.332, pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information at the time of issuance and upon modification. Required elements include federal award identification; all requirements of the subaward including the federal statutes, regulations and terms and conditions; indirect cost rate; access to records; and closeout terms and conditions. Condition: The Organization awarded 39 awards to subrecipients and did not include the information required by 2 CFR § 200.332 in the subaward agreement. Cause: The Organization did not have a standardized process or checklist to ensure all required subaward elements were included in the agreement. Effect or Potential Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance and misuse of federal funds. The Organization was not in compliance with the subrecipient requirements outlined in the agreement and in 2CFR200.332. Prior Year Finding: Reported as 2023-002 in the prior year. Recommendation: We recommend that the Organization update subaward agreements to include all federal provisions required to be communicated by the grant and also 2 CFR § 200.332. Views of Responsible Officials: Management agrees with the finding and the auditors’ recommendation. See Corrective Action Plan at the end of the report.

Federal Program(s): Enhanced Mobility of Seniors and Individuals with Disabilities (ALN 20.513) Agencies: U.S. Department of Transportation – Federal Transit Administration Criteria - 2 CFR §200.510: Auditee must prepare an accurate SEFA including ALN, program name, award number, award year, pass-through number, and total expenditures. 2 CFR §200.332: Pass-through entities must identify the ALN in all subaward documents. 2 CFR §200.303: Auditees must establish and maintain effective internal controls over federal awards. Condition - During our audit of ENVIDA’s federal programs, we identified an internal control deficiency affecting the accuracy of the Schedule of Expenditures of Federal Awards (SEFA). Context - The issue stems from the Envida's need to formalize documented procedures and adequate review over the SEFA preparation process, as well as the need to implement controls for verifying federal award information received from pass-through entities. Specifically, ENVIDA’s SEFA included initial misstatements, including erroneous reporting of $61,576 in required matched funds as federal expenditures (which they were not), the inclusion of $79,225 in OnDemand expenditures that were not federally funded (incorrect information from passthrough entity), and a $45,403 posting error that misclassified expenditures between grant years. These errors resulted in a material overstatement of the SEFA federal expenditures as originally prepared. Management corrected these errors during the audit process. Cause - Due to lack of funding information provided in the contracts with a major passthrough entity, Envida is unable to verify accuracy of federal funding information contemporaneously. For 2024, incomplete or inaccurate information from pass-through entities, coupled with the absence of formalized internal controls to verify and document federal award details, led to initial errors in SEFA reporting. Contracts with the pass-through entity, Pikes Peak Area Council of Governments (PPACG), did not include the required Assistance Listing Numbers (ALNs), which contributed to the confusion and misreporting. These deficiencies are inconsistent with the requirements of 2 CFR §200.510(b), §200.303, and §200.332(a)(1), which collectively mandate accurate SEFA reporting, proper identification of federal awards, and internal controls over federal funding. Effect - SEFA initially overstated by 15.5% due to match and OnDemand errors. FY24 award overstated by 17.5%; FY25 award understated by 14.6% Potential audit coverage gaps and risk misassessment under 2 CFR §200.518. Recommendation - We recommend that ENVIDA establish and document clear procedures for the preparation of the Schedule of Expenditures of Federal Awards (SEFA) as well as for the proper classification of accounts receivable. In addition, ENVIDA should implement a supervisory review process to help ensure accuracy and compliance with federal requirements. To further strengthen controls, all subaward agreements should require written confirmation of the Assistance Listing Numbers (ALNs). Finally, ENVIDA should verify federal award information directly against official federal award notices prior to preparing the SEFA. Views of Responsible Official and Planned Corrective Action - Management has agreed with the finding and plans to revise the SEFA to reflect accurate federal expenditures. They will work with pass-through entities to ensure future subaward documentation includes all required federal award identifiers and will implement internal controls to prevent recurrence.

FINDING 2024-003 – CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS Federal Program: COVID-19 Coronavirus State and Local Fiscal Recovery Funds (ALN Number: 21.027) Federal Agency: Department of Treasury Federal Award Number (or Other Identifying Number): N/A Pass-Through Entity: State Budget Agency Subject – Subrecipient Monitoring – Internal Controls Audit Finding: Significant Deficiency Criteria: Federal regulations 2 CFR section 200.332 (b), (d), (f) and (g) requires the County to: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. Condition: An effective internal control system was not in place at the County to ensure compliance with requirements related to the grant agreement and the subrecipient monitoring compliance requirement. Questioned Cost: None. Context: During our subrecipient monitoring testing, we saw no formal, documented review of the two subrecipient's audit reports selected for testing. Management asserted they reviewed the reports, but there was no formal documented review of the reports noted. The audit reports sampled for testing contained no findings in the reports that would normally require the County to follow up on. We also noted the County does not have a process to assess the risk of each subrecipient. Effect: The failure to establish an effective internal control system placed the County at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the program. Cause: Management had not developed a system of internal control that would have ensured compliance with the grant agreement and the compliance requirements listed above for the full period under audit. Repeat Finding: Yes, this is repeat of finding 2023-004. Recommendation: We recommended that the County formally documents their review of the subrecipient audit reports and follow up actions taken on the audit reports as needed. Views of Responsible Officials: Management concurs with this finding. See the corrective action plan.

Criteria In accordance with 2 CFR § 200.332(a) of the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), pass-through entities are required to “clearly identify to the subrecipient” certain information and requirements at the time of subaward, including the Federal award identification, all compliance requirements, and any additional terms and conditions imposed by the pass-through entity. Condition During our audit of the airport improvement program grant awarded to the Town, we noted that the Town did not execute a formal subrecipient agreement with Fishers Island Ferry District, to whom federal funds were passed through during the audit period. Specifically, no written agreement was in place outlining the subrecipient’s responsibilities, applicable compliance requirements, or the terms and conditions of the award. Cause The Town did not have procedures in place to ensure that subrecipient agreements are issued for this program. Effect Without a formal subrecipient agreement, the entity increased the risk that the subrecipient may not fully understand or comply with federal award requirements. This could result in noncompliance with federal regulations, potential misuse of funds, and questioned costs. Additionally, the entity is not in full compliance with Uniform Guidance. Questioned Costs None Recommendation We recommend that the Town develop and implement procedures to ensure that formal written subrecipient agreements are executed prior to the disbursement of federal funds. These agreements should contain all elements required by 2 CFR § 200.332(a), including the identification of the federal award, applicable compliance requirements, and any additional terms and conditions. Views of Responsible Officials The Town agrees with this finding. The absence of subrecipient agreements for the airport improvement program was an oversight. Procedures have since been put in place to ensure that formal written subrecipient agreements are executed prior to the disbursement of federal funds.

Criteria: Per 2 CFR 200.332, pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward, and monitor subrecipient activities to provide reasonable assurance that the subaward is used for authorized purposes and in compliance with applicable requirements. Condition: The Organization did not consistently document and retain required monitoring procedures and assessments performed. Cause: The Organization had not developed policies and procedures to ensure compliance with subrecipient risk assessment and monitoring requirements. Effect: The Organization did not comply with 2 CFR 200.332. The lack of effective processes and documentation increases the risk of noncompliance by subrecipients, potential misuse of Federal funds, and questioned costs that could adversely affect current and future Federal funding. Questioned Costs: $0 Recommendation: We recommend the Organization strengthen its internal control framework over subrecipients by developing and implementing written policies and procedures for consistently performing and documenting risk assessments prior to making subawards, establishing clear monitoring protocols such as periodic report reviews, site visits, and follow-up on identified issues, and maintaining evidence of all monitoring activities performed. These steps will help ensure compliance with 2 CFR 200.332, reduce the risk of subrecipient noncompliance, and provide assurance that Federal funds are used for their intended purposes. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. The Organization hired a new Executive Director in the fall of 2024 and has discussed the matter with the Department of Agriculture and legal counsel to ensure compliance requirements are followed.

Finding number 2024-005, material weakness in internal controls over compliance – subrecipient monitoring Federal Agency: U.S. Department of Justice Federal Program: Justice Reinvestment Initiative, ALN 16.827 Criteria: 2 CFR 200.332(a)(1) requires pass-through entities to clearly identify the federal award to the subrecipient, including the FAIN and ALN, in the subaward documents. 2 CFR 200.332(b)-(d) requires pass-through entities to evaluate each subrecipient’s risk of noncompliance to determine appropriate monitoring and to verify that subrecipients expending $750,000 or more are audited as required by the Uniform Guidance. Condition: During our review of subrecipient agreements, we noted that the agreements did not include the Federal Award Identification Number (FAIN) and the Assistance Listing Number (ALN) as required. Additionally, the pass-through entity did not adequately document its risk assessment of subrecipients or verify whether subrecipients were subject to the Single Audit and, if so, whether the required audit was completed and reviewed. Cause: Inadequate procedures to ensure that all required information was included in subrecipient agreements. Inadequate procedures were not followed to perform and/or document subrecipient risk assessments and audit verifications. Effect: Failure to include all required information in subrecipient agreements increases the risk that subrecipients may not be aware of or comply with federal requirements, which could result in noncompliance with federal statutes, regulations and the terms and conditions of the award. This deficiency may also impair the pass-through entity’s ability to properly monitor subrecipient activities and fulfill its responsibilities under the Uniform Guidance. Such omissions may result in audit findings, questioned costs and potential enforcement actions by federal agencies. Questioned Costs: None Recommendation: We recommend that management implement procedures to ensure that all subrecipient agreements include the information required by 2 CFR 200.332. This should include a standardized checklist or template for subaward agreements and periodic reviews to verify compliance. We further recommend the entity implement and document procedures to (1) perform and retain evidence of subrecipient risk assessments and (2) verify and document whether subrecipients are subject to the Single Audit and, if so, obtain and review the audit reports for findings related to the federal program Views of Responsible Officials: Management concurs with this finding. See Corrective Action Plan.

Condition: During our review of subrecipient agreements, we noted that several agreements did not include the assistance listing title and number required by 2 CFR 200.332(b)(1). Criteria: Per 2 CFR 200.332(b)(1), pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and must include specified information in the subaward agreement. Required elements include, among others, the Federal award identification (e.g., Assistance Listing number, award name, Federal agency), period of performance and indirect cost rate. Cause: The Organization has not established a formal process to ensure that all required elements of 2 CFR §200.332 are included in subrecipient agreements. Effect: Failure to include required elements in subrecipient agreements increases the risk that subrecipients are not fully aware of their responsibilities under Federal awards, which could result in noncompliance with Federal requirements. In addition, the Organization is not in compliance with Uniform Guidance requirements for pass-through entities. Questioned Costs: None determined Recommendation: We recommend that the Organization update its subrecipient agreement templates and contract review procedures to ensure that all required elements under 2 CFR §200.332 are included in each agreement. A compliance checklist should be developed and used during the drafting and execution of agreements to verify completeness. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding; see corrective action plan.

Significant deficiency in internal controls over compliance related to subrecipient monitoring. Federal Agency: Department of Labor Program Titles: Workforce Innovation and Opportunity Act Dislocated Worker Program Assistance Listing Number: 17.278 Award Numbers: 24A60CP000141-01-01 Award Periods: April 1, 2024 through September 30, 2025 Criteria Internal controls requirements contained in Title 2 U.S. Code of Federal Regulations (CFR) 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Subpart D requires a pass-through entity to adopt compliance policies to ensure sub-recipients comply with requirements under the award, and evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of such agreements for the purposes of determining appropriate subrecipient monitoring. Condition/Context for Evaluation The Organization does not have a formal subrecipient monitoring policy to implement Subrecipient Monitoring procedures as required by 2 CFR Part 200.332. For the one subrecipient selected for testing, the Organization could not produce documentation of the required subrecipient risk assessment and the subrecipient agreement was missing certain required elements. Questioned Costs None noted Cause The Organization does not have a formal subrecipient monitoring policy that includes retention of a documented subrecipient risk assessment, as well as, use of a standard subaward agreement template including all required subaward agreement elements. Effect Subrecipient Monitoring procedures may not be properly determined without completion of a documented subrecipient risk assessment. In addition, the subaward agreement may not include all subaward terms as required by 200.332(b). Repeat Finding Not Applicable. Recommendation We recommend that management develop and formalize a subrecipient monitoring policy in accordance with 2 CFR Part 200, including use of a documented subrecipient risk assessment, as well as, creation of a Federal subaward agreement template which includes all require elements. Views of Responsible Officials Management agrees that even though subrecipient risk was discussed and considered, the subrecipient risk assessment was not documented in accordance with 2 CFR Part 200. In addition, management agrees that the underlying subaward agreement did not include all elements required by the same Part.

SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS Ref. No. Internal Control over Compliance Findings Questioned Costs: $ -- 2024-001 Missing Signatures - Significant Deficiency Federal Agency: U.S. Department of Housing and Urban Development (HUD) Assistance Listing No.: 14.157; 14.239 Program: Supportive Housing for the Elderly; HOME Investment Parternships Program Criteria: The Uniform Guidance (2 CFR §200.332 - Internal controls) requires the Company to establish, document, and maintain effective internal controls that provide reasonable assurance of compliance with the Department of Housing and Urban Development (HUD) requirements. In order to verify the eligibility of applicants, the property management company’s policy is to complete the “Tenant Income Certification” (TIC) and “Owner’s Certification of Compliance with HUD’s Tenant Eligibility and Rent Procedures” (HUD-50059) form, with signatures from both the property manager and applicant. Condition: During our testing over eligibility, we discovered: • Eight (8) out of 15 samples did not have a property manager signature on the TIC form. • Four (4) out of 15 samples did not have a property manager signature on the HUD-50059 form. Cause: Certain tenant documentation was lost by the prior management company. The new property manager reperformed intake procedures and recreated the TIC and HUD-50059 forms but did not sign the TICs, citing lack of involvement in the original intake process. Effect: Incomplete documentation weakens the audit trail, diminishing confidence in eligibility determinations and potentially exposing the Project to risks such as noncompliance with program requirements and potential errors and disallowance in rent subsidies paid by HUD. Identification as a Repeat Finding, if applicable: Not applicable. Recommendation The Company should consider reevaluating their established procedures and controls currently in place to ensure full compliance with regard to eligibility and proper maintenance of tenant information, including policies for handling missing files during management transitions to ensure compliance with HUD requirements. Views of Responsible Officials and Planned Corrective Action The Company agrees with the finding and the recommendation. See Part V Corrective Action Plan.

2024-004—Subrecipients Awards and Monitoring Type of Finding (F) Significant Deficiency in Internal Control Over Compliance of Federal Awards (G) Instance of Noncompliance related to Federal Awards Funding Agency U.S. Department of Agriculture (“USDA”) Program Partnerships for Climate-Smart Commodities; Award: USDA/NR243A750004G005 (AL 10.937); Period: 11/02/2023 -11/01/2028 Questioned Costs None identified Statement of Condition The Subaward agreement needs to be clear of the type of agreement with grant number, Assistance Listing number and clear programing and financial expectations. Pass-through entities are to provide reasonable assurance that the costs of goods and services charged to federal awards are allowable and charged in accordance with the applicable regulations. During our test work over controls over sub-recipient monitoring, we noted Quivira did not have a financial monitoring tool to require the sub-recipients to provide the primary recipient with a copy of their audit report and the sub-recipient's response to any audit findings, when applicable. Note: Quivira did ask for backup documentation for all expenses Invoices and a programmatic report and documented meeting discussions about sub-recipients. The primary recipient should also follow-up on the audit findings to determine whether the sub-recipient has satisfactorily resolved audit findings. This follow-up should be performed on a timely basis. Criteria 2 CFR §200.332 requires Pass-through-Entities to: issue subawards with complete federal award identification; assess subrecipient risk; monitor programmatic and financial performance; and verify audit requirements and review reports/findings; as well as issue follow up corrective actions as applicable. Some of the specific requirements are as follows: Federal award identification including the AL #, subawards amount, type of agreement (subawards versus contract, etc.) Evaluate each subrecipient fraud risk and risk of non-compliance with the federal awards Monitor the financial and performance reports Verify if the sub-recipient is audited, if required and if they have any findings related to the subaward Effect Without complete and accurate monitoring of sub-recipient expenditures of federal funds, Quivira cannot ensure the costs of goods and services charged to federal awards are allowable and charged in accordance with the applicable regulations. When the entity does not receive and review these audit reports, it may not have complete information about weaknesses identified by the independent auditors. Cause Quivira considered the Independent Contractor agreement and the requests for reimbursement of backup documentation sufficient. Recommendation Quivira should ensure it properly monitors sub-recipients according to the requirements required by the CFR 200 identified under “Criteria”. Views of Responsible Officials and Planned Corrective Action Management agrees with the recommendation. Quivira Coalition will: Action Step Detail Date Responsible Party Update its subrecipient and contractor agreement templates to include information outlined in 2 CFR § 200.332, including more specific federal award identification. 10/31/25 Operations Director Add a clause to the subrecipient and contractor agreement templates to include a requirement to report any significant developments to Quivira Coalition. 10/31/25 Operations Director Build a procedure for evaluating a subrecipient’s fraud risk and risk of non-compliance with the federal awards (as outlined in 2 CFR § 200.332 (c)) during the grant application phase or before engaging in agreements & work with subrecipient. It will continue to follow-up annually with the recipients on fraud risk and risk of non-compliance until the end of the federal award period. 10/31/25 Operations Director; CRI Director & Grants Manager Monitor sub-recipients as required by 2 CFR 200.332(e) 1/31/2026 Operations Director If a subrecipient has significant development during the course of monitoring, institute a tailored monitoring plan as outlined in 2 CFR § 200.332 (e) & (f) and resolve any findings listed as its responsibility under 2 CFR § 200.332 (e). 10/31/25 Operations Director; CRI Director & Grants Manager

Assistance Listing Numbers: 10.001, 10.200, 10.215, 10.307, 10.310, 10.311, 10.443 and 10.912 Name of Federal Program or Cluster: Research and Development Cluster Name of Federal Agency: Department of Agriculture Federal Award Identification Numbers: 58-5090-2-037 2022-38624-38368 2021-38640-34714 A0242501X443G026 2022-38640-37486 2023-51300-40959 2021-68012-35917 2019-68012-29852 2020-68012-31934 2021-49400-35592 NR225F48XXXXG006 Direct Award Periods: August 1, 2022 through July 31, 2027, September 1, 2023 through February 28, 2025, September 29, 2022 through September 30, 2027, September 27 2024 through September 26, 2027 and September 27, 2022 through June 30, 2026 Name of Pass-through Entities and Award Periods: Michigan State University-September 1, 2022 through August 31, 2025; Regents of the University of Minnesota-March 1, 2022 through February 28, 2025, April 1, 2023 through March 31, 2025, and September 1, 2020 through August 31, 2025; Board of Regents of the University of Wisconsin System-January 1, 2022 through December 31, 2026 and September 1, 2018 through August 31, 2024. Criteria or Specific Requirement: In accordance with 2 CFR § 200.331(a) (now 2 CFR § 200.332), a passthrough entity must make a case-by-case determination whether each agreement it makes for the disbursement of Federal funds casts the party receiving the funds in the role of a subrecipient or a contractor. This determination must be based on the substance of the relationship and not the form of the agreement. Condition: During the audit, we noted that the Organization has not established or implemented a formal process to determine whether entities receiving federal funds are subrecipients or contractors. There was no documentation or consistent methodology in place to support classification decisions for entities engaged under federal awards. Cause: The Organization has not developed or adopted policies and procedures to comply with the requirements under Uniform Guidance for distinguishing between subrecipients and contractors. Effect or Potential Effect: Without a formal and documented determination process, there is a risk that entities may be misclassified, leading to inappropriate application of monitoring procedures. For example, entities functioning as subrecipients may not be subject to required subrecipient monitoring, potentially resulting in noncompliance with federal regulations and increased risk of misuse of federal funds. Repeat Finding: No Recommendation: The Organization should develop and implement written policies and procedures to ensure proper determination and documentation of subrecipient versus contractor relationships in accordance with Uniform Guidance. Staff involved in federal program administration should be trained on how to apply these criteria consistently. Views of Responsible Officials: Management agrees with the finding and will implement and train on written policies and procedures to document the determination of subrecipient versus contractor.

Assistance Listing Numbers: 10.001, 10.200, 10.215, 10.307, 10.310, 10.311, 10.443 and 10.912 Name of Federal Program or Cluster: Research and Development Cluster Name of Federal Agency: Department of Agriculture Federal Award Identification Numbers: 58-5090-2-037 2022-38624-38368 2021-38640-34714 A0242501X443G026 2022-38640-37486 2023-51300-40959 2021-68012-35917 2019-68012-29852 2020-68012-31934 2021-49400-35592 NR225F48XXXXG006 Direct Award Periods: August 1, 2022 through July 31, 2027, September 1, 2023 through February 28, 2025, September 29, 2022 through September 30, 2027, September 27 2024 through September 26, 2027 and September 27, 2022 through June 30, 2026 Name of Pass-through Entities and Award Periods: Michigan State University-September 1, 2022 through August 31, 2025; Regents of the University of Minnesota-March 1, 2022 through February 28, 2025, April 1, 2023 through March 31, 2025, and September 1, 2020 through August 31, 2025; Board of Regents of the University of Wisconsin System-January 1, 2022 through December 31, 2026 and September 1, 2018 through August 31, 2024. Criteria or Specific Requirement: 2 CFR section 200.332 state pass-through entities are responsible for ensuring proper oversight of subrecipients to ensure compliance with federal requirements. Specifically:  § 200.332(a) requires subaward agreements to include specific information such as the Federal award identification, CFDA/Assistance Listing number, subaward period of performance, indirect cost rate, and applicable terms and conditions.  § 200.332(f) requires pass-through entities to verify that subrecipients that expend $750,000 or more in federal awards during their fiscal year have met audit requirements under 2 CFR part 200, subpart F.  § 200.332(d)(3) requires pass-through entities to review subrecipient audit reports, identify findings related to their federal awards, and ensure corrective actions are taken, including issuing management decisions if needed. Condition: During our audit of subrecipient monitoring controls, we noted the following deficiencies:  One out of four subrecipients sampled, the Organization did have documentation that verified a single audit was not required. In another instance of the four sampled, only the financial statement audit was obtained. It indicated there were separate reports for yellow book and single audit.  There were no documented procedures or evidence showing that the Organization assessed whether subrecipient audit findings were relevant to its own federal awards, nor that any follow-up or management decisions were issued.  Subaward agreements reviewed were missing several elements required by 2 CFR § 200.332(a), including the Assistance Listing number (formerly CFDA), that the award is for research and development, and closeout terms required by the Uniform Guidance. Cause: The Organization has not implemented adequate internal controls, policies, and procedures to ensure compliance with all subrecipient monitoring and subaward agreement requirements under Uniform Guidance. Effect or Potential Effect: These deficiencies increase the risk of noncompliance with federal program requirements, including the potential for unallowable costs, failure to identify material findings affecting the federal program, and weakened enforcement of subrecipient accountability. Additionally, noncompliant subaward agreements may result in ambiguity or disputes related to federal requirements, allowable costs, and required reporting. Repeat Finding: This is a repeat of Findings 2023-002 and 2023-006. Recommendation: We recommend that the Organization:  Establish and document a formal process to verify whether each subrecipient is subject to the Uniform Guidance single audit requirement and obtain the applicable reports annually.  Implement procedures to review subrecipient audit findings and determine whether they pertain to the Organization’s federal award(s), and issue management decisions when necessary.  Develop a standardized subaward agreement template that incorporates all required elements outlined in 2 CFR § 200.332(a), and ensure staff are trained in its use.  Periodically review subrecipient files to verify compliance with monitoring and documentation requirements. Views of Responsible Officials: Management agrees with the finding and will implement subrecipient monitoring procedures.

2024-004 - Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Control over Compliance (Subrecipient Monitoring) Programs. Environmental and Scientific Partnerships and Programs; U.S. Department of State; ALN Number 19.017; Award Number SAQMIP23CA0021 Criteria. Under 2 CFR Part 200.332(b), a pass-through entity must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information required per the Uniform Guidance. Condition. During subrecipient monitoring testing, the ALN number and award number were not included in the four subrecipient agreements subjected to testing. Additionally, the Organization does not have a policies/procedures in place to evaluate and address subrecipient's fraud risk and risk of noncompliance. Cause. The Organization does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. Although certain subrecipient monitoring activities were performed, the Organization did not comply with all the federal requirements for subrecipient monitoring for pass-through entities. Questioned Costs. None Recommendation. We recommend that the Organization adopts additional policies and procedures related to subrecipient monitoring to ensure compliance with Uniform Guidance. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.

Condition: During our review of the Head Start grant subrecipient monitoring procedures, the Organization was unable to provide documentation to support that monitoring activities were performed for one of the three subrecipients tested during the audit period. Criteria: In accordance with the Uniform Guidance (2 CFR §200.332(d)), pass-through entities are required to monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes and in compliance with applicable laws, regulations, and the terms and conditions of the subaward. Cause: The Organization did not provide documentation to demonstrate that subrecipient monitoring was performed. As a result, it is possible that the required monitoring activities were not conducted during the audit period, or, if they were performed, they were not adequately documented or retained in accordance with federal grant requirements. Effect: Failure to conduct subrecipient monitoring increases the risk that subrecipients may not be complying with federal program requirements, potentially leading to misuse of federal funds, lack of program quality assurance, or uncorrected deficiencies in service delivery. Recommendation: We recommend that the Organization ensure all required subrecipient monitoring activities are performed in accordance with federal guidelines. Additionally, all monitoring procedures—including risk assessments, site visits, performance reviews, and follow-up actions—should be clearly documented and retained to demonstrate compliance with grant requirements.

Criteria: Subrecipient Monitoring - Non-profit entities must follow the requirements for pass-through entities set out at 2 CFR part 200.332. Condition: Lack of documentation of subrecipient monitoring including whether the subrecipient is disqualified. Also, there was no indication of notification of the federal award identification number and amount of federal funds to the subrecipients. Cause: Due to no previous single audit requirement, the Organization has not established a policy of documenting subrecipient monitoring performed or the communication of the federal award identification number and amount of federal funds to subrecipients. Effect: The Organization does not have adequate documentation evidencing subrecipient monitoring procedures were performed or that all required information relating to federal awards was provided to subrecipients. Context: A sample of three disbursements totaling $113,418 were tested from a population of eight transactions totaling $353,835. Questioned costs: No known or likely questioned cost in excess of $25,000. Repeat Finding: No Recommendation: We recommend the Organization establish a formal methodology for documenting subrecipient monitoring and adhere to its policies for communicating federal award identification in accordance with 2 CFR 200.332. Views of responsible officials of the auditee: The Organization concurs with the finding and will implement the following: Develop additional policies and procedures that require documentation of subrecipient monitoring for each subrecipient Ensure all federal subrecipient contracts to include federal award identification number and the amount of federal funds awarded to each subrecipient Distribute policies and procedures and contract templates to all applicable finance and programmatic staff Train staff on the new policies and procedures

2024-001 Improve Controls and Documentation Over Subrecipient Monitoring Federal Program Information Federal Agency: Department of Health and Human Services Award Name(s): Child Care and Development Block Grant Assistance Listing Number(s): 93.575 Award Year: 2022 Compliance Requirement: Subrecipient Monitoring Federal Agency: Department of Health and Human Services Award Name(s): Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.391 Award Year: 2022 Compliance Requirement: Subrecipient Monitoring Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requires that a pass-through entity must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information as required in 2 CFR 200.332(b). Condition and Context During our audit, we tested a sample of one subrecipient under the Child Care and Development Block Grant in order to determine if the subrecipient agreements contained all required elements per 2 CFR 200.332(b) and ensure sufficient subrecipient monitoring procedures were performed. As a result of our testing, it was identified that the agreement tested did not contain the subrecipient’s unique entity identifier, federal award identification number, federal award date, assistance listing title, assistance listing number, dollar amount available under each federal award and assistance listing number at the time of disbursement, and approved indirect cost rate. While assistance listing number 93.391 was not tested as a major federal program in 2024, we have carried forward the finding from the prior year and applied it to this program as it has not yet been resolved. SECTION III - FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (CONTINUED) 2024-001 Improve Controls and Documentation Over Subrecipient Monitoring (Continued) Cause The Organization did not have adequate controls in place to ensure all required elements were included in subrecipient agreements. Effect or Potential Effect Due to the weakness in internal controls and compliance finding noted above, the Organization did not comply with the requirements of the Uniform Guidance regarding communication to subrecipients all the specified elements in 2 CFR 200.332. No questioned costs are reported as this requirement is administrative in nature. Recommendation The Organization should address the weakness noted above and update its subrecipient agreements, policies, and procedures to ensure that all required elements are present to comply with the Uniform Guidance. Views of Responsible Official Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.

Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes, federal award identification, subrecipient name, subrecipient’s DUNS number, federal award identification number (FAIN), federal award date, subaward start and end date, amount of federal funds obligated, total amount of federal award, federal award project description, name of federal awarding agency, Assistance Listing (ALN) number and name, identification of whether the award is R&D and indirect cost rate for federal award. Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal control should include procedures to ensure required information is communicated prior to the issuance of the subaward. Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient. Per 2 CFR 200.332(d) through (f), pass-through entities must monitor the activities of the subrecipient, which includes reviewing financial reports required by the pass-through entity. Condition: During our testing, we noted subrecipients tested had required information omitted from the sub agreements to the subrecipients including Assistance Listing (CFDA) title and number, subrecipient’s DUNS number, Federal Award Identification Number (FAIN), identification of whether the award is research and development, and indirect cost rate for federal award. Subrecipients tested did not have evidence of the County’s evaluation of the risk of noncompliance by the subrecipients, nor was there evidence of monitoring of annual audits for the subrecipients. Internal checklists that aid in compliance were missing for certain subrecipients. Reporting requirements from the subrecipients to the County were also not met. Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient. Questioned costs: None. Context: Five out of the five subrecipients did not include required information in subaward agreements issued to subrecipients and lacked evidence of both the evaluation of risk of noncompliance of the subrecipient and monitoring of annual audits for the subrecipients. Five of the five subrecipients were missing an internal checklist that is signed by the County Manager. Cause: Lack of sufficient controls in place to ensure that subrecipient agreements contain all required information and are monitored appropriately. Effect: Failure to communicate required information and to adequately monitor the subrecipients could result in subrecipients not properly administering the federal programs in accordance with federal regulations. Repeat Finding: Yes, repeat of prior year finding 2023-004. Recommendation: CLA recommends that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient. Views of responsible officials: There is no disagreement with the audit finding.

Finding No: 2024.001 Type: Significant Deficiency - Internal Control: Subrecipient Monitoring Condition: We were not able to substantiate evidence of monitoring grants to others. Criteria: Under 2 CFR 200.332, pass-through entities are required to monitor the activities of subrecipients as necessary to ensure that federal funds are used for authorized purposes in compliance with statutes, regulations, and terms and conditions of the award. This includes evaluating risk of noncompliance, conducting reviews (desk or on-site), following up on deficiencies, and ensuring timely corrective action, as well as resolving audit findings specific to the subaward. Internal control over compliance requirement related to subrecipient monitoring was not evidenced. Amount: not applicable Cause: The nonprofit did not implement sufficient monitoring processes over its subrecipients. Effect or Potential Effect: Failure to monitor subrecipients increases the risk of misused federal funds, nonachievement of performance goals, or uncorrected compliance issues. This can potentially result in questioned costs, the need for repayment of grant funds, reputational damage, and jeopardized future grant eligibility. Repeat Audit Finding: No Recommendations: Establish and implement a risk-based subrecipient monitoring plan that includes documented risk assessments, regular desk and/or on-site reviews, timely followup and resolution of deficiencies, and maintenance of supporting documentation for all monitoring activities. Provide training to staff on subrecipient monitoring requirements and ensure formal procedures comply with 2 CFR 200.332.

Finding 2024-002 – Subrecipient Monitoring US Department of Health and Human Services - Passed through the Pennsylvania Department of Human Services – Foster Care Title IV-E (ALN 93.658) US Department of Health and Human Services - Passed through the Pennsylvania Department of Aging – Aging Cluster (ALNs 93.044, 93.045, and 93.053) Grant Number 4100089721 Condition: The County has internal controls in place to monitor subrecipients of Foster Care Title IV-E and aging funding, however, the policies do not incorporate all required federal compliance requirements. For Aging, the County did not conduct the annual risk assessment prior to the disbursement of funds. The County did not ensure that all Foster Care Title IV-E and aging subrecipients were notified via contract or letter of the subaward ALN and amount that was paid during the year. Additionally, the County only request audits from subrecipients if the county passes over $150,000 federal dollars to the subrecipient. As part of the monitoring process, the County obtained and reviewed annual audit reports for a portion of, but not all of, the subrecipients in a timely manner in order to ensure the subrecipients complied with the Foster Care Title IV-E and Aging requirements. Criteria: In accordance with the federal compliance requirements all pass through entities must ensure that every subaward is clearly identified to the subrecipient and includes specific information as discussed at 2 CFR 200.332(b). Additionally, 2 CFR 200.332(e) and 200.332(g) requires the pass through entity to resolve audit finding specifically related to the subaward and to verify that a subrecipient is audited as required by subpart f of this requirement. Finally, 2 CFR 200.332 (c) requires that the County evaluate all subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate monitoring. Cause: Procedures are in place over subrecipient monitoring, however the procedures to ensure that subrecipients are notified of the requirements listed in 2 CFR 200.332(b) are not adequate. The County also only requires audits and follows up on any deficiencies for subrecipients that they pass through more than $150,000 in federal funding, which is not adequate in accordance with 2 CFR 200.332(e) and 200.332(g). Finally, the county did not perform a timely annual risk assessment for Aging subrecipients in accordance with 2 CFR 200.332 (c). Effect: Subrecipients may have been unaware of the federal nature of their funding, relevant compliance requirements, and the need to prepare for single audit submission as required under federal regulations. Additionally, incomplete monitoring of subrecipient audits may result in noncompliance with federal program requirements and increase the risk of misuse or mismanagement of federal funds. Repeat Finding: This is not a repeat finding Questioned Costs: Unknown Recommendation: We recommend that procedures be implemented to ensure all subrecipients are notified of subaward requirements as outlined in 2 CFR 200.332(b) and the County implement a process to ensure all subrecipients audits are reviewed and deficiencies be followed up on. We also recommend that the County perform annual risk assessments for all subrecipients. Management Response: See corrective action plan.

2024SA-003 Insufficient Subrecipient Monitoring Federal Agency/Passthrough Agency: US Department of Health and Human Services Program: SAMHSA Grant Depression Screening in School based Health Centers Federal Award Number: 43382006L Assistance Listing Number: 93.243 Material Weakness Material Noncompliance – Financial Management Criteria: 2 CFR 200.332 states the recipient should monitor the activities of the subrecipient as necessary to ensure that the subawards are used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR section 200.332 (d) through (f)), in addition to procedures identified as necessary based upon the evaluation of the subrecipient risk or specifically required by the terms and conditions of the award. Condition: The Health Department gave $100,000 to the Community Foundation of East Central IL to help fund new TASK programs at 4 local school districts. Our inquiry regarding subrecipient monitoring determined that no subrecipient monitoring was taking place. Context: From reviews of the County and Health Department’s internal control and accounting procedures along with inquiries made, it was indicated that the Health Department has not gained an adequate understanding of all of the compliance requirements related to federal awards and has not developed necessary internal controls to ensure compliance, including but not limited to subrecipient monitoring. Effect: Potential for misappropriation of funds by the subrecipient due to lack of monitoring. Questioned Costs: None. Cause: There is a systematic problem throughout the County regarding a lack of adequate knowledge of compliance requirements related to federal awards, a lack of documentation of risk assessments being completed, and a continued disregard for establishing and documenting effective internal controls, in particular there is an absence of secondary reviews and monitoring. Repeated Finding: No Recommendation: Review the federal guidelines and requirements related to management of federal awards. Establish and document a plan to ensure compliance with each requirement. In this instance, establish necessary procedures to monitor the subrecipient’s compliance with the federal guidelines. Management’s Response: The Health Department will establish procedurs for subrecipient monitoring.

Criteria In accordance with 2 CFR § 200.332(a) of the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), pass-through entities are required to “clearly identify to the subrecipient” certain information and requirements at the time of subaward, including the Federal award identification, all compliance requirements, and any additional terms and conditions imposed by the pass-through entity. Condition During our audit of the airport improvement program grant awarded to the Town, we noted that the Town did not execute a formal subrecipient agreement with Fishers Island Ferry District, to whom federal funds were passed through during the audit period. Specifically, no written agreement was in place outlining the subrecipient’s responsibilities, applicable compliance requirements, or the terms and conditions of the award. Cause The Town did not have procedures in place to ensure that subrecipient agreements are issued for this program. Effect Without a formal subrecipient agreement, the entity increased the risk that the subrecipient may not fully understand or comply with federal award requirements. This could result in noncompliance with federal regulations, potential misuse of funds, and questioned costs. Additionally, the entity is not in full compliance with Uniform Guidance. Questioned Costs None Recommendation We recommend that the Town develop and implement procedures to ensure that formal written subrecipient agreements are executed prior to the disbursement of federal funds. These agreements should contain all elements required by 2 CFR § 200.332(a), including the identification of the federal award, applicable compliance requirements, and any additional terms and conditions. Views of Responsible Officials The Town agrees with this finding. The absence of subrecipient agreements for the airport improvement program was an oversight. Procedures have since been put in place to ensure that formal written subrecipient agreements are executed prior to the disbursement of federal funds.

Federal Grantor: U.S. Department of Treasury Pass-through Grantor: n/a Assistance Listing No.: 21.027 Program Title: COVID-19 Coronavirus State and Local Fiscal Recovery Funds Award Year: 2024 Compliance Requirement: Subrecipient Monitoring Known Questioned Costs: n/a Criteria: Part 1 of the Compliance and Reporting Guidance, issued by the U.S. Department of the Treasury, states that "SLFRF recipients that are pass-through entities as described under 2 CFR 200.1 are required to manage and monitor their recipients to ensure compliance with requirements of the SLFRF award pursuant to 2 CFR 200.332 regarding requirements for pass-through entities." Additionally, it is stated that pass-through entities are required to clearly identify to the subrecipient any and all compliance requirements for use of SLFRF funds. Condition: The County requires potential recipients of SLFRF funds to complete an application, which clearly identifies any and all compliance requirements for the use of the SLFRF funds. It also advises potential recipients to retain documentation of all uses of the funds and produce those documents to the County upon request. The County awarded SLFRF funds to two subrecipients. For one of the two subrecipients, the County did not ask the subrecipient to produce any documentation of the use of the funds and, therefore, did not perform their duty as a pass-through entity to manage and monitor their recipients to ensure compliance. Additionally, the County did not properly ascertain that any subrecipients expected to be audited as required by the Uniform Guidance, under subpart F, met this requirement (2 CFR 200.331(f)). This verification performed as part of the required monitoring under 2 CFR 200.331(d)(2) is required to ensure that the subrecipient takes timely and appropriate action on deficiencies detected through audits. Cause: Oversight. Effect: The County, as a pass-through entity, is required to manage and monitor their recipients to ensure compliance with requirements of the SLFRF. By failing to manage and monitor one of their subrecipients, the County is in violation of their responsibility as a pass-through entity. Recommendation: We recommend that the County implement procedures for monitoring the spending of SLFRF funds by subrecipients during, and upon completion of their projects to ensure compliance. Management's Response: The County has created a filing system for recipients of SLFRF funds and a calendar set to send reminder notices to get receipts and other information from recipients. The reminders will be set in 3 month increments from the time funds are awarded to recipient. Implementation will begin January 1, 2026 with reminder notices set in calendar.

Finding 2024-002 – Subrecipient Monitoring Federal Agency: Department of Treasury Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds – ALN #21.027 Condition: As part of the monitoring process, the County did not obtain and review the annual audit reports of subrecipients. Criteria: Per 2 CFR Section 200.332 Requirements for pass-through entities, a pass-through entity must: (g) Verify that a subrecipient is audited as required by subpart F of 200.332. In addition, a pass through entity must resolve subrecipient audit findings specifically related to the subaward. Cause: The County does not have procedures in place to adequately review the subrecipient audits received. Effect: Failure to obtain and review subrecipient audit reports increases the risk that subrecipient noncompliance, internal control deficiencies, or questioned costs remain unidentified and unaddressed, which may result in unallowable costs being charged to the federal awards. Repeat Finding: No Recommendation: The County should update written policies and procedures to require timely obtaining and documented review of subrecipient audit reports including documented evaluation of findings relevant to the PTE’s awards and assessment of subrecipient risk. Questioned Costs: Unknown Views of Responsible Official and Planned Corrective Action: Management agrees with the finding. See separate correction action plan.