Findings Citing § 200.332

Finding 2025-103 Federal Program Name Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Awarding Agency U.S. Department of Homeland Security State Agency Department of Military Affairs (department) ALN # 97.036 Grant # 4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001, 4726DRMTP00000001, 4745DRMTP00000001, 4801DRMTP00000001, 4813DRMTP00000001 Compliance Requirement M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.332(a)(1)(xii), requires the pass-through entity to provide the Assistance Listing Number (ALN) to each subrecipient. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked sufficient internal controls to ensure it provided the ALN to all subrecipients as required by federal regulations in fiscal years 2024 and 2025. We identified multiple instances where the ALN was not provided to subrecipients during the audit period. Context: During the first half of the audit period, the department provided the ALN to subrecipients in payment letters accompanying project payments. Recommendation #2023-074 in the prior audit determined that the ALN was not consistently included in those letters, as its inclusion depended largely on which staff member prepared the letter. Beginning with the disaster declared in July 2024, the department adopted subgrant agreements that include the ALN as standard practice. However, the department did not retroactively collect agreements for older projects. Because projects span multiple years, we focused testing on payment letters issued during the audit period for the six open disasters declared before July 2024 and the subgrant agreements for disasters declared after that point. In a nonrandom, nonstatistical sample of 19 of 187 projects, we found five projects where the ALN was missing from at least one payment letter. In three of those projects, the ALN appeared in later letters but not all. However, these items are still considered errors because subrecipients could not have known the ALN at the time of earlier disbursements. One project also had an incorrect ALN in two letters. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023, included recommendation #2023-074 to the department to implement controls to ensure the ALN is communicated to subrecipients when awarding grants, and to communicate the ALN to all subrecipients awarded disaster funds. Effect: By not providing the ALN to all subrecipients, the department is not in compliance with federal subrecipient monitoring requirements. Without the ALN, there is risk the subrecipients are not able to properly report the subaward in their own Schedule of Expenditure of Federal Awards. Cause: Failing to consistently provide the ALN to subrecipients was identified in the prior audit. Recommendation #2023-074 recommended the department to include the ALN in all payment letters. The department was notified of this issue on March 6, 2024, and subgrant agreements incorporating the requirement took effect in July 2024. All payment letters missing the ALN were issued before those milestones. Two letters issued after the milestones contained incorrect ALNs; however, each included at least one ALN, indicating the department had adopted the requirement but was not applying it consistently. Because the department took corrective steps and subgrant agreements we tested contained no errors, recommendation #2023-074 should be resolved if the department continues to follow its new processes, despite the noncompliance noted in the current audit period. Recommendation: We recommend the Department of Military Affairs: C. Continue to follow its improved process to ensure the ALN is provided to all subrecipients as required by federal regulations. D. Comply with federal regulations by providing the ALN to all subrecipients. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-067 Federal Program Name Education Stabilization Fund (ESF) (COVID 19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.425 Grant # S425D200006, S425U210006, S425D210006 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs $944,172 Criteria: Federal regulation, 2 CFR 200.332(e), requires pass-through entities to, “Monitor the activities of the subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award Condition: The office receives ESF funds under the Elementary and Secondary School Emergency Relief (ESSER) fund portion of the grant. The office reimbursed Local Education Agencies (LEAs), which are generally schools or school districts, without receiving sufficient documentation to determine whether claimed costs were allowable under the ESSER program. The office’s internal controls did not ensure adequate documentation was on file before issuing reimbursements. Questioned Costs: We question $944,172 in ESSER reimbursements we tested that were not adequately supported at the time of payment. Additional unsupported reimbursements likely exist in the populations. Context: In FY2024 and FY2025, the office paid over $230 million to schools based on reimbursement requests. We designed a randomly selected, non-statistical sample of 60 items to test controls and 40 items to test allowability. We tested the first 16 items and found 10 instances of non-compliance. Based on this error rate, we concluded there was a material weakness and material non-compliance and did not test the remaining sample items. The 10 items with errors, totaling $770,637, lacked one or more of the following: dates associated with compensation, identification of employees or positions covered, or explanation of how supplies or repairs related to the ESSER program. Absent this information, the office is unable to demonstrate the costs reimbursed are for allowable costs under the grant. The number and consistency of errors indicate a systemic problem. The office also provided funds to schools under ESSER as part of a separate Math Innovations program. Four schools were paid funds under this program during the audit period for a total of $347,095. As this program was new in the audit period, we looked at all the cash requests for the audit period and question an additional $173,535 in costs. These cash requests also lacked adequate documentation to support they were allowable under the grant. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2023-032 from the audit for the two fiscal years ended June 30, 2023. This was originally reported as Single Audit finding 2021-036 in the audit for the two fiscal years ended June 30, 2021. Effect: The office reimbursed schools for ESSER costs that were not adequately supported at the time of reimbursement. The office’s subrecipient monitoring procedures were not sufficient to comply with federal regulations. As a result, the office paid at least $944,172 in claims that could have been for unallowable activities or unallowed costs. Cause: This issue was originally communicated to the office in late fiscal year 2024, leaving only part of the audit period for the office to strengthen controls. Prior to early 2025, the office’s cash request reviews were minimal and focused primarily on comparing requests to budget line items. While budget comparisons provide some assurance of allowability, they are not sufficient on their own. For example, they do not confirm that personal service costs are for individuals who worked on the ESSER grant, or that work occurred within the period of performance of the grant. The office implemented a new cash request review process in early 2025. However, this change came after the audit period and does not address ESSER reimbursements already made. If the office continues to operate under their new procedures, this recommendation should be resolved. Recommendation: We recommend the Office of Public Instruction: C. Enhance internal controls to ensure schools submit adequate documentation with reimbursement requests prior to payment. D. Reimburse schools only when documentation is sufficient to confirm that costs are allowable under the program. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-072 Federal Program Name Education Stabilization Fund (ESF) (COVID 19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.425D and 84.425U Grant # S425D200006, S425U210006, S425D210006 Compliance Requirement F. Equipment and Real Property Management M. Subrecipient Monitoring N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation 2 CFR 200.313(c)(1) requires prior approval from the federal government or the pass-through entity (the office), before equipment is purchased. Federal regulation, 2 CFR 200.439(b)(1) requires capital expenditures to be pre-approved by the federal government or pass-through entity. Federal regulation, 2 CFR 176.190(a) requires laborers and mechanics employed by contractors and subcontractors on projects funded directly with federal funds to be paid prevailing wages. Federal regulation, 2 CFR 200.332(e) requires the office to monitor the activities of subrecipients (schools) to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office receives ESF funds under the Elementary and Secondary School Emergency Relief (ESSER) portion of the grant. The office reimbursed Local Education Agencies (LEAs), which are generally schools or school districts, that included equipment and construction costs. The office did not have adequate controls to ensure compliance with federal regulations, such as preapproval for equipment and construction projects or that schools paid the prevailing wage rate. Additionally, monitoring tools used to ensure subrecipients complied with federal regulations were not always obtained or reviewed adequately to ensure they were fully completed. Context: In fiscal years 2024 and 2025, the office paid over $230 million to schools based on reimbursement requests. We designed a randomly selected a non-statistical sample of 60 items to test controls and 40 items to test allowability out of 3,062 LEA cash requests. We tested the first 20 items and found one or more exceptions for the different required attributes tested. Associated expenditures for these exceptions ranged from approximately $6,000 to over $420,000. Attributes tested included existence of preapproval form for equipment or construction projects, actual approval of the items, acknowledgment of prevailing wage requirements, and existence and completion of a self-assessment tool used to monitor subrecipients. As part of our testing of subrecipients, we also noted three schools with Single Audit reports that contained prevailing wage rate findings in their 2024 audit reports. Based on this error rate, we concluded there was a material weakness and material noncompliance and did not test the remaining sample items. Because we did not identify any equipment or construction that was unallowable per grant regulations, we did not question any costs. Repeat Finding: Recommendation part C of Single Audit finding 2023-032 from the audit for the two fiscal years ended June 30, 2023, is related to the monitoring of subrecipients for compliance with construction and equipment requirements. Effect: Controls were not adequate to ensure the office complied with federal regulations related to subrecipient monitoring or that schools complied with federal regulations. The office is not in compliance with federal regulations. Cause: The office required schools to complete various forms, such as a self-assessment form to ensure compliance with all ESSER federal requirements and a preapproval form if they used ESSER funds for large equipment items or construction items. While these required schools to certify they were aware of and followed prevailing wage rate requirements, it was not adequate to ensure they did. Additionally, while most schools received the self-assessment form, staff did not adequately review it or follow up to ensure all questions were answered. Because the ESSER grant program has ended, no staff members who worked on this portion of the grant were available to explain why the forms were not approved or why the self-assessments were not fully completed. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls over monitoring to ensure subrecipients are complying with all requirements, including that construction and equipment purchases are preapproved and federal regulations related to the prevailing wage rate are followed. B. Monitor subrecipients’ compliance with construction and equipment requirements, including reviewing wage certifications for construction projects, as required by federal regulations. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-076 Federal Program Name Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.323 Grant # NH23IP922574, NU50CK000409, NU50CK000500, NU51CK000366, NUE2EH001420 Compliance Requirement I. Procurement and Suspension and Debarment M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.332(a), (c) and (e) requires non-Federal entities to verify that subrecipients are not excluded or disqualified in SAM.gov, evaluate each subrecipient’s fraud risk and risk of noncompliance, and monitor the activities of a subrecipient to ensure the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the award. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked adequate internal controls to meet federal requirements for conducting risk assessments, verifying debarment and suspension status, and conducting financial and performance monitoring procedures for all of its grants. As a result, the department did not comply with federal regulations. Context: The department awards grants under the ELC program for activities such as wastewater surveillance and support to counties and schools during the COVID-19 pandemic. We tested a nonrandom, nonstatistical sample of 40 of 458 subrecipients that received ELC funds during the audit period. Testing revealed that the department lacked documentation of its control process over subrecipient monitoring for all subrecipients, most of which were grants awarded to counties and health care facilities for COVID-19 pandemic assistance. Based on the department’s internal control processes, for a subrecipient to be adequately monitored, we expected the department to provide the following for each subrecipient: • risk assessment for subrecipients receiving over $50,000 • certification that the subrecipient had not been suspended or debarred • task order, contract, or grant agreement which included required disclosures • approved invoices • approved Acquisition Planning and Implementation form • subrecipient monitoring checklist which included both financial and performance reviews of the subrecipient. For two entities in our sample, the department did not use their subrecipient monitoring checklist or have other controls in place for monitoring. We also noted 13 grants where there was no risk assessment documentation and 17 where there was no verification the subrecipient was not debarred or suspended. A risk assessment is necessary to ensure the proper level of monitoring is put in place for each entity. Although many of these grants are smaller amounts individually, approximately $1.5 million was spent in fiscal year 2024 and 2025 for the subrecipients tested indicating some monitoring procedures should still be in place for all entities. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2023, included findings 2023-053 and 2023-055 related to internal controls over and compliance with completing subrecipient risk assessments and conducting post-award monitoring, respectively. These issues were also reported in Montana’s Single Audit for the two fiscal years ended June 30, 2021, as 2021-052 over subrecipient disclosures, and 2021-062 and 2021-054, both of which addressed adequately monitoring and properly reimbursing subrecipients. Prior audit findings 2023-053 and 2023-055 have not been fully implemented. The department did fully implement the recommendation related to subrecipient disclosures. Effect: The department is not in compliance with federal subrecipient monitoring requirements for many ELC-funded grants, which totaled around $2.4 million in awards during the audit period. This increases the risk of awarding funds to debarred entities or high-risk subrecipients without implementing monitoring procedures to ensure federal funds are spent in accordance with regulations. Cause: The department partially implemented prior audit recommendations for county grants but did not have sufficient time to fully resolve all identified issues before the current audit period started. Some of the grants were awarded through a grant application platform that had no process for completing debarment verifications. If the department continues to operate under their new control processes this recommendation should be resolved. Recommendation: We recommend the Department of Public Health and Human Services: A. Continue to follow its improved process to ensure subrecipient monitoring processes are completed and documented for each ELC subrecipient. B. Conduct and document risk assessments for all subrecipients and verify and document that subrecipients are not debarred or suspended prior to awarding funds. C. Perform monitoring procedures to confirm subrecipients comply with grant requirements, as required by federal regulations. Views of Responsible Officials: The department concurs with the recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-030 Federal Program Name Formula Grants for Rural Areas and Tribal Transit Program (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.509 Grant # MT-2018-011, MT-2020-003, MT-2020-013, MT-2022-019, MT-2022-022, MT-2023-004, MT-2023-005, MT-2023-011, MT-2024-009, MT-2024-012, MT-2024-015, MT-2024-018, MT-2025-005, MT-2025-006 Compliance Requirement M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.332, requires pass-through entities to, among other things, monitor subrecipient activities to ensure subaward funds are used for authorized purposes. This includes issuing a management decision for any audit finding related to the Federal award the pass-through entity provided to the subrecipient. Federal regulation, 2 CFR 200.521, requires that management decisions clearly state whether the audit finding is sustained, the reasons for the decision, and the expected corrective action. If the subrecipient has not completed corrective action, the decision must include a follow-up timetable. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Department controls to verify that subrecipients are audited were insufficient to detect when subrecipients required a Single Audit due to grants from multiple sources. The department also did not comply with federal management decision requirements regarding subrecipient audit findings. Context: The department monitors subrecipient Single Audits across all of its programs by obtaining audit reports from the Federal Audit Clearinghouse and evaluating grant payments it made to subrecipients. However, this process does not account for federal funds a subrecipient may have received directly from the federal government or from other pass- through entities. As a result, the department's process cannot reliably determine whether a subrecipient meets the Single Audit threshold. During the audit, auditors identified a for-profit subrecipient that received minimal grant payments from the department but also received federal subgrants from two other state pass-through entities. That subrecipient's total federal awards were approximately $1.8 million, exceeding the Single Audit threshold. Although federal regulations do not require for-profit subrecipients to obtain a Single Audit, this case demonstrates that the department's internal data alone is not sufficient to assess a subrecipient's Single Audit requirements. Reliable external data sources are available to the department, including USASpending.gov and SAM.gov for federal fund obligations, Montana and other states' government transparency websites, and direct inquiries to subrecipients. After auditors brought this issue to the department's attention, the department began revising its Single Audit monitoring process. Auditors also identified one subrecipient Single Audit report with a finding related to the Formula Grants for Rural Areas program. The department's central Single Audit review process monitors findings, but the department's response did not include the required elements of a management decision. Instead of formally accepting or rejecting the subrecipient's planned corrective action, the department only reviewed subsequent audit reports to check whether the deficiency had been corrected. Effect: The department may fail to identify all subrecipients required to obtain a Single Audit. Single Audits are an important monitoring tool for pass-through entities; without them, material noncompliance at the subrecipient level may go undetected. The department may also put federal grant money at risk by continuing to provide assistance to organizations with known, unresolved deficiencies. Without a formal management decision, the department does not take an active role in resolving subrecipient deficiencies. Timely communication of acceptance of the subrecipient’s corrective action is necessary to resolve deficiencies promptly. Without it, subrecipient control weaknesses and federal noncompliance are likely to persist longer. Cause: The department relied solely on internal data to assess whether subrecipients met the Single Audit threshold, but the information needed to make that determination is not always held internally. While the department reviews Single Audit reports centrally and notifies program staff of relevant findings, it does not issue a formal management decision to the subrecipient that includes the elements required by federal regulations. The department's process is not formally documented, creating gaps in compliance. Recommendation: We recommend that the Montana Department of Transportation: A. Incorporate external data sources when evaluating whether subrecipients meet Single Audit requirements. B. Formalize the subrecipient Single Audit review process by defining roles and responsibilities for complying with federal monitoring regulations. C. Issue formal management decisions to subrecipients that include all elements required by federal regulation. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-085 Federal Program Name Temporary Assistance for Needy Families Federal Awarding Agency U.S. Public Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.558 Grant # 1802MTTANF,1902MTTANF, 2002MTTANF,2102MTTNAF, 2202MTTANF,301MTTANF, 2401MTTANF Compliance Requirement M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal Regulation, 2 CFR 200.332(b)(1), requires pass-through entities to provide federal award identification information specific to the subaward that identifies the federal award to the subrecipient. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department's internal controls did not ensure that subaward contracts included all required federal award identification elements. We identified multiple contracts with unclear elements. Context: The department issued subaward agreements and/or amendments to 13 entities during the audit period, using a standardized template designed to include all 14 federal award identification requirements. In our review, we noted that the department’s subaward agreements frequently list multiple federal awards as the funding source. While the department includes information to identify the federal awards, such as the Federal Award Identification Number (FAIN) and Assistance Listing Number (ALN), the agreements do not specify the award amount for each individual FAIN or ALN. Instead, the agreements report a single combined subaward amount. Because TANF federal awards allow an extended budget period rather than a fixed two-year period of performance, the department lists each FAIN with its award date and period of performance start date using an "until spent" end date. During the current audit period, up to six FAINs are listed per agreement, and some agreements include FAINs for both TANF and non-TANF programs. Based on our review, no subaward agreements issued during the audit period specified the award amount for individual FAINs. The total value of these agreements and amendments was $19.9 million. Effect: Without communicating amounts tied to individual FAINs, subrecipients cannot accurately track, report, or comply with the requirements of each federal award. As noted in finding 25-083, this also contributed to errors in FFATA reporting for the TANF program during the audit period. Cause: The department interpreted the open-ended nature of TANF FAINs as an exemption from the requirement to identify specific award amounts for each FAIN, which is not the case. Recommendation: We recommend the Department of Public Health and Human Services: A. Strengthen internal controls over federal award identification in TANF subaward agreements. B. Specify individual award amounts by Federal Award Identification Number (FAIN) and Assistance Listing Number (ALN) for each TANF subaward and amendment as required by federal regulation. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-058 Federal Program Name Title I Grants to Local Educational Agencies Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.010A Grant # S010A220026, S010A230026, S010A240026 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs $174,111 Criteria: Federal regulation, 2 CFR 200.332 (d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office reimbursed Local Education Agencies (LEA), which are generally school districts or schools, without receiving and reviewing sufficient documentation to determine whether costs were allowable. The schools are subrecipients of the federal Title I funds. Internal controls were not adequate to ensure proper documentation was received before payment. Questioned Costs: We question $174,111 in Title I payments that were reimbursed without adequate support. This represents the total dollar amount of the ten sample items with errors. Based on the number of errors found, the timeframe during which the office was notified of documentation deficiencies, we project total questioned costs exceed $26 million or approximately 25% of the aggregate total for fiscal years 2024 and 2025. Context: We selected a random nonstatistical sample of 60 reimbursements. We tested the first 26 items and found ten exceptions. Because the error rate indicated material noncompliance, we did not test the remaining 34 items. The ten exceptions are mainly related to missing dates associated with when compensation and benefits were earned. The number of errors indicates a systemic problem. The office made 3,111 reimbursement payments totaling $104,414,057 to schools in fiscal years 2024 and 2025. Approximately $99 million of these requests were related to compensation and benefit costs incurred by schools. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2023-038 in the audit for the two fiscal years ended June 30, 2023. Effect: The office reimbursed schools for Title I costs that were not adequately supported at the time of payment. This increases the risk that schools used Title I funds for unallowable activities or costs. Subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: This issue was originally communicated to the office in late fiscal year 2024, leaving only part of the audit period for the office to strengthen controls. The office implemented a new cash request review process in early 2025. Prior to that change, cash request reviews were minimal and limited to comparing the approved budget categories to the school’s cash request. However, the office continues to note that not all schools submit adequate documentation. During the current period, the office continued to distribute funds to schools even when supporting documentation lacked detail to ensure the cash request was for authorized purposes and was reasonably necessary for performance of the Title I program. During testing, we noted some improvement in documentation for fiscal year 2025 salary and benefit costs. Should the office continue to obtain increased documentation for salary and benefit costs, this issue should be resolved. Recommendation: We recommend the Office of Public Instruction: A. Continue to strengthen internal controls to ensure schools submit adequate documentation with reimbursement requests before payment is made. B. Only reimburse schools when documentation is sufficient to demonstrate the cost is for an allowable purpose and was incurred within the subaward period. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-064 Federal Program Name Comprehensive Literacy Development Program (Literacy) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.371 Grant # S371C190012, S371C190012-19A, S371C190012-20, S371C190012-21 Compliance Requirement A. Activities Allowed B. Allowable Costs/Cost Principles M. Subrecipient Monitoring Type of Finding Other Matter: Questioned Costs for a Non-Major Program Questioned Costs $130,752 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to, “Monitor the activities of the subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” Federal regulation, 2 CFR Part 200.403(a) and (g), requires costs to be necessary and reasonable, as well as adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office’s subrecipient monitoring process for the Literacy program lacked sufficient documentation on cash requests throughout the audit period. The prior audit reported this issue; however, new procedures were not fully in place until partway through the audit period. Questioned Costs: We question $130,752 in costs paid to two eligible Local Education Agencies (LEAs), which are generally schools or school districts. While a third school also provided insufficient documentation for reimbursement, that school had already been identified as an ineligible school. We questioned the costs for the entire school in finding 2025-065. Those questioned costs are excluded here to prevent double counting the same expenditures as questioned costs. Context: This program was not audited as a major federal program under the Single Audit, so testing was limited to following up on the prior audit recommendation. Auditors reviewed 10 cash requests, five from each fiscal year. All five fiscal year 2025 requests were adequately documented. Three of the five fiscal year 2024 requests lacked adequate documentation as they were missing time periods, descriptions of services provided, or quantities purchased. Two of the three erroneous payments were made to eligible schools and one was made to an ineligible school. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2023-039 from the audit for the two fiscal years ended June 30, 2023. Effect: Without adequate controls over cash requests, the office may have reimbursed subrecipients for unallowable, unnecessary, or unreasonable expenses. Cause: This issue was originally communicated to the office in late fiscal year 2024, leaving only part of the audit period for the office to strengthen controls. In November 2024, the office updated its procedures to require schools to submit specific details with cash requests. Several of the deficient requests were submitted before this update took effect. Additionally, the internal auditor began sampling cash requests later in the audit period, but that control was also not in place for the full period. If the office continues to operate under their new procedures, this recommendation should be resolved. Recommendation: We recommend the Office of Public Instruction: A. Continue to use enhanced internal control review procedures to ensure subrecipient payment requests are for allowable costs and activities. B. Reimburse subrecipients after obtaining and reviewing support to ensure costs are reasonable, necessary, and adequately documented, as required by federal regulations. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

2025-002 Significant Deficiency in Internal Control over Subrecipient Monitoring Identification of federal program: 64.033 VA Support Services for Veteran Families Program Award 20-AK-152 Department of Veterans Affairs Criteria: In accordance with 2 CFR § 200.332(b), prior to making a subaward, a pass-through entity is required to evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward. This evaluation is intended to determine the appropriate level of subrecipient monitoring necessary throughout the period of performance. The pass-through entity should maintain documentation demonstrating that the required risk assessment was performed. Condition: During our testing of subrecipient monitoring, we noted that Fairbanks Rescue Mission, Inc. did not retain documentation demonstrating that it performed and documented a risk assessment of the subrecipient for two out of three sub awardees selected for testing prior to issuing the subaward. Although management indicated that it considers various factors when selecting and overseeing subrecipients, no documentation was maintained to support that a formal risk assessment was completed or to support the monitoring approach selected. Cause: Fairbanks Rescue Mission, Inc. has implemented controls over documentation retention for the risk assessment over the sub awardees. However, they did not retroactively perform the control for subgrantees who had received awards prior to this finding initially being identified. As such, there are still several subawards for which they do not have a documented audit trail showing that a formal risk assessment was performed. Effect or potential effect: Without documented risk assessments, Fairbanks Rescue Mission, Inc. cannot demonstrate compliance with the requirements of 2 CFR § 200.332. In addition, Fairbanks Rescue Mission, Inc. may not appropriately tailor monitoring activities based on the level of risk presented by individual subrecipients, increasing the risk that noncompliance with Federal requirements may not be identified or addressed in a timely manner. Questioned Costs: None Context: We tested three subaward issued during the audit period. For two of the subawards selected for testing, Fairbanks Rescue Mission, Inc. was unable to provide documentation demonstrating that a risk assessment had been completed and documented prior to issuing the subaward. Identification of Repeat Finding: Finding 2024-003 Recommendation: We recommend that as a part of Fairbanks Rescue Mission, Inc.’s internal control structure over compliance subrecipients that Fairbanks Rescue Mission, Inc. is entering into agreements with, they establish procedures to ensure federal subrecipient risk evaluation is completed and maintained. Views of Responsible Officials: Management agrees with finding. See Corrective Action Plan.

Federal Agency: United States Department of Agriculture (USDA) Federal Program: 10.558 Child and Adult Care Food Program (CACFP) 2024 and 2025 CACFP 2024 and 2025 CACFP-CIL 2024 and 2025 CACFP-SPON State Agency: Department of Health and Senior Services (DHSS) - Bureau of Community Food and Nutrition Assistance (BCFNA) Type of Finding: Internal Control (Material Weakness) and Material Noncompliance Questioned Costs: Unknown Compliance Requirement: Subrecipient Monitoring As noted in our two previous audits, during the year ended June 30, 2025, BCFNA subrecipient monitoring procedures were not in compliance with subrecipient monitoring requirements and were not sufficient to ensure CACFP subrecipient compliance with program requirements. As noted at finding 2025-010, audit sample results show the subrecipient payment error rate continued to increase. The BCFNA has implemented only a few changes to address our prior-year audit findings and strengthen monitoring procedures. During the year ended June 30, 2025, the BCFNA disbursed approximately $69.9 million to over 730 CACFP subrecipients, which consist of child and adult care centers and sponsors of centers. Disbursements to subrecipients represented approximately 98% of the program's expenditures. As part of its pass-through responsibilities, 7 CFR Section 226.6(a)(5), the BCFNA is required to ensure subrecipients effectively operate the program. Regulation 2 CFR Section 200.332(c) requires pass-through entities to evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Regulation 2 CFR Section 200.332(e) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward, and achieves goals and objectives. The BCFNA's subrecipient monitoring process, outlined in the Internal Nutritionist Manual, provides the requirements for monitoring the CACFP facilities/sponsors. The manual provides the planned frequency and type of monitoring activities, monitoring methods, and corrective action requirements. The manual requires the preparation of a risk assessment at the end of each monitoring review that assigns points to the facility/sponsor based on the number and severity of deficiencies and findings, with more deficiencies leading to a higher score. The score determines the required timing of future monitoring reviews of the facility/sponsor. Facilities/sponsors with a score of 0 to 10 points will be next monitored in 3 years, a score of 11 to 25 points within 2 years, a score of 26 to 35 points in 1 year; and facilities/sponsors with a score of 36 or more points are considered "seriously deficient" and are required to submit a Corrective Action Plan (CAP). If the CAP is deemed sufficient, seriously deficient facilities/sponsors will have a CAP verification review in 6 months. A score is not assigned for 6-month CAP verification reviews. During FY25, the BCFNA began performing technical assistance reviews for all new facilities/sponsors. In May 2024, when the BCFNA changed the risk assessment and scoring system, the BCFNA ceased assigning a grade of A, B, B-, or C to each review and widened the score ranges and associated review requirements. DHSS officials indicated the scores assessed by the new system are frequently higher than those assessed under the previous manual system. The impact of these changes on the frequency and effectiveness of the monitoring reviews is unclear. During each monitoring review, BCFNA personnel review documentation supporting a sample of claims during a test month. Any identified errors and associated overclaims/underclaims exceeding established thresholds are recouped/reimbursed in the facility's/sponsor's future claims. When reviews identify noncompliance, facilities/sponsors are required to prepare and submit a CAP to the BCFNA. In addition, as noted at finding number 2025-010, the BCFNA relies on these subrecipient monitoring procedures to prevent and detect meal reimbursement claim errors. Monitoring reviews have identified significant issues and claim errors, including some potentially fraudulent activity, and led to over 15 contract terminations in recent years. To test compliance with subrecipient monitoring requirements, and to evaluate the effectiveness of BCFNA monitoring procedures, we reviewed and analyzed a randomly-selected sample of 60 BCFNA monitoring reviews conducted for 60 CACFP facilities/sponsors during the year ended June 30, 2025. While our review found the sample monitoring reviews were performed in accordance with the policies and procedures outlined in the Internal Nutritionist Manual, we identified areas where these policies and procedures could be strengthened and improved to ensure facilities/sponsors comply with program requirements and submit proper claims. Our review and analysis of the 60 sampled monitoring reviews noted the monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims. Our comparison of the sampled reviews to prior reviews noted deficient facilities/sponsors generally had continued deficiencies and little improvement from prior reviews, as follows: • Of the 58 sampled monitoring reviews assigned a score, 26 (45%) facilities/sponsors had a score of 10 or less, while 32 (55%) had a score of 11 or more. • Of the 29 facilities/sponsors that had a score of 11 or more and had a prior review, 27 (93%) had the same or higher score than the prior review indicating a lack of significant improvement or decline in compliance since the prior review. • Of the 2 facilities/sponsors that had a score of 36 or more and had a prior review, both had higher scores than the prior review. • For 50 of 58 monitoring reviews (86%) for which the BCFNA tested claims and quantified errors (with claims totaling $568,271 during the test months), the BCFNA identified overclaims totaling $72,561 and underclaims totaling $4,275, netting to $68,286, or at least 12% of the reimbursements tested. As noted at finding 2025-010, audit sample results show the subrecipient payment error rate increased from prior years. Our review of BCFNA subrecipient monitoring procedures during the year ended June 30, 2025, noted areas that should be strengthened and improved. Claims testing The Internal Nutritionist Manual and monitoring practices provide for testing of a sample of claims within only 1 test month during each monitoring review, and do not provide for expanded testing when significant errors are identified. For example, 2 facilities had 100% overpayment rates and were assigned scores of 34 and 13; however, additional testing was not performed for either facility. Neither facility was deemed "seriously deficient;" and the facilities were scheduled to be next reviewed in 1 year and 2 years, respectively. BCFNA personnel indicated monitoring reviews are limited to only 1 test month since the USDA Monitoring Handbook does not require expanded testing of records beyond 1 month. However, the USDA Monitoring Handbook suggests testing activities during 1 test month, and also suggests the state agency may determine additional review is warranted and review records beyond the test month to determine the extent of the noncompliance. When significant errors are identified, additional testing would help BCFNA nutritionists determine the extent that instances of noncompliance are isolated versus pervasive. Such information would be valuable to the overall conclusions and points assigned to the review, and in decisions regarding subsequent monitoring. Overclaim recoupment BCFNA subrecipient monitoring procedures do not provide for identification and pursuit of recoupment of all overpayments associated with errors identified during monitoring reviews. When overclaims due to noncompliance with eligibility requirements are identified during monitoring reviews, the BCFNA only identifies and seeks recoupment for the overclaims made during the test month. Overclaims associated with eligibility errors begin at the time the eligibility determination was made and continue until the error is discovered. Although the BCFNA is aware noncompliance occurred during the month(s) before the test month, the BCFNA does not attempt to identify those overclaims. In addition, when a facility/sponsor is terminated, the BCFNA does not always identify or seek recoupment of overclaim amounts. In our sample of 60 monitoring reviews, the contract for 1 sponsor was terminated as a result of a 6-month CAP verification review. For this sponsor, in the review prior to the 6-month CAP verification review, the BCFNA identified and recouped overclaims of $2,879, or 100% of total claims tested. In the subsequent 6-month CAP verification review, significant claim errors were identified in the test month claims paid, which totaled $4,091, and the sponsor was terminated. However, the test month claims were not fully tested, and overclaims were not identified or recouped. Any overclaims not identified and recouped from this sponsor would be considered questioned costs; however, those questioned costs are unknown. BCFNA officials indicated they do not pursue recoupment of overclaims beyond the test month because this practice is allowed by the USDA. They indicated they pursue recoupment of overclaims for facilities/sponsors with terminated contracts on a case-by-case basis, considering various factors. However, 7 CFR Section 226.14 provides that state agencies shall disallow and recover any portion of a claim for reimbursement not properly payable, including claims not made in accordance with recordkeeping requirements. Pursuing full recoupment would hold facilities/sponsors accountable for all overclaims and would serve as a deterrent to future errors, noncompliance, and overclaims. Further, without procedures to identify and recoup all overclaims, there is a risk that significant overclaims will go undetected and unrecouped, and questioned costs could be significant. Conclusions In addition to complying with federal requirements, strong subrecipient monitoring procedures are necessary to ensure facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. Subrecipient monitoring procedures should be designed to prevent future deficiencies and noncompliance. Without strong internal controls, there is increased risk of noncompliance, errors, fraud, waste, and abuse of federal funds. Strong monitoring procedures would ensure facilities/sponsors are held accountable for and correct errors and noncompliance identified. Regulation 2 CFR Section 200.332(h) requires pass-through entities to consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. Further, 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Finding classification This finding is classified as a material weakness in internal control and material noncompliance with the federal subrecipient monitoring requirements. Our audit of the BCFNA's compliance with federal subrecipient monitoring requirements concluded the BCFNA did not materially comply with federal requirements to ensure subrecipients effectively operate the CACFP and to monitor the activities of the subrecipient as necessary to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward, and achieves goals and objectives. This conclusion is based on the facts, deficiencies, and noncompliance stated in the finding, including the following: 1) Disbursements to subrecipients represented approximately 98% of the CACFP expenditures. 2) BCFNA subrecipient monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims; and deficiencies identified often continued for years with little improvement from review to review. The 12% subrecipient payment error rate identified by the BCFNA, which exceeds our audit materiality threshold of 4%, along with the high rate of continued noncompliance, serve as indicators of the ineffectiveness of the BCFNA monitoring process. 3) The BCFNA did not comply with federal subrecipient monitoring requirements regarding disallowing and recovering improper payments. 4) Multiple deficiencies in monitoring procedures were identified. In conducting a Single Audit in accordance with 2 CFR Part 200 (Uniform Guidance), auditors are required by 2 CFR Section 200.514(d)(1)(2), to determine whether the auditee has complied with federal statutes, regulations, and the terms and conditions of federal awards that may have a direct and material effect on each of its major programs, as outlined in the OMB Compliance Supplement. While compliance with the USDA CACFP handbooks was considered in our audit, our conclusion on compliance is based on the BCFNA's compliance with the federal statutes and regulations, as required. Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits, and the AICPA Audit Guide: Government Auditing Standards and Single Audits (Audit Guide). The Audit Guide provides the following definitions regarding internal control deficiencies: A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis. "[A] reasonable possibility exists when the likelihood of the event is either reasonably possible or probable…" Reasonably possible is when "[t]he chance of the future event or events occurring is more than remote but less than likely." Probable means "[t]he future event or events are likely to occur." The failure to design and implement adequate controls and procedures over subrecipient monitoring led to material noncompliance with the subrecipient monitoring requirements. The BCFNA's controls failed to develop an effective subrecipient monitoring process that ensures subrecipients comply with federal statutes, regulations, and the terms and conditions of subawards, and achieve goals and objectives. Because the internal control deficiencies have not been corrected, it is probable that the material noncompliance will continue. For these reasons, the deficiencies are considered a material weakness. Recommendation The DHSS through the BCFNA continue to review, strengthen, and enforce subrecipient monitoring procedures to ensure CACFP facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. The BCFNA should enhance procedures to provide for identification and recoupment of overclaims associated with all errors identified during monitoring reviews, as required by federal regulations; and expand testing when significant errors are identified. The DHSS should identify and recoup the overclaims for the terminated sponsor noted in this finding. Auditee's Response We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement. Auditor's Comment The DHSS Corrective Action Plan (CAP) states the DHSS, for the third year in a row, disagrees with the finding and believes no corrective action is required because (1) they believe subrecipient monitoring, claim recoupment, and risk assessment procedures comply with USDA requirements; and (2) the similar FY23 finding (finding number 2023-013) was closed by the USDA after reviewing the DHSS corrective action plan. The DHSS CAP further states they believe the SAO is holding the DHSS to higher standards than required by federal guidance and regulations and that implementing the SAO's recommendations would cause undue burden on the participants and providers of the program which the USDA warns against. However, in making these statements, the DHSS ignored the noncompliance with specific USDA and Uniform Guidance requirements identified in the finding, and failed to recognize and acknowledge that existing subrecipient reimbursement and monitoring procedures have allowed serious and material subrecipient noncompliance year after year. Furthermore, federal agency closure of a prior year finding does not protect the DHSS from future findings. As of August 2026, the DHSS had received no communication from the USDA regarding the fiscal year 2024 finding. Regarding the finding statement that policies and procedures should be strengthened and improved, the DHSS CAP states the SAO has applied performance audit standards instead of single audit standards. This statement is incorrect. While not required, we have included a finding classification section that outlines the auditor's responsibilities under the single audit, as well as audit guidance followed in making decisions regarding the BCFNA's internal controls and compliance with the federal statutes and regulations. Regarding the finding section pertaining to recoupment of overclaims, the DHSS CAP claims the "BCFNA pursues recoupment of overclaims of only the test month per USDA requirements, although when warranted, additional reviews are conducted beyond the test month. In addition, BCFNA officials pursue recoupment of overclaims for facilities/sponsors with terminated contracts on a case-by-case basis, taking into consideration various factors." While the DHSS makes this claim, in our sample of 60 monitoring reviews, the DHSS did not expand testing beyond the test month for any reviews, and did not seek recoupment of overclaims for the facility/sponsor terminated as a result of the monitoring reviews. As part of its pass-through responsibilities outlined in the federal regulations, the BCFNA is required to ensure subrecipients comply with federal regulations and terms and conditions of the subaward, and effectively operate the program. Given the extent of material subrecipient noncompliance that continues to occur, BCFNA procedures are clearly not sufficient to deter and prevent future noncompliance. The BCFNA has focused on individual components of its systems, but has not holistically evaluated whether the procedures, collectively and in their entirety, comply with the federal requirements intended to ensure subrecipient reimbursements are allowable and supported. The BCFNA continues to strictly follow existing procedures without making adequate adjustments to address and mitigate the serious subrecipient reimbursement problems. Recognizing problems and responding to them are critical components of an effective internal control system designed to ensure compliance with the federal requirements. For three years, the SAO has recommended the BCFNA enhance procedures related to identification and recoupment of overclaims, as required by federal regulations; and expand testing when significant errors are identified. The BCFNA has ignored these recommendations; and as a result, lacks a sufficient method for deterring future noncompliance. While the DHSS argues these recommendations would cause undue burden on the participants of the program and the subrecipients, not implementing these recommendations could cause an undue burden on the DHSS and the subrecipients, since weak consequences or deterrents to noncompliance leads to continued noncompliance, which requires increased monitoring and follow-up efforts. Subrecipient data clearly shows significant subrecipient noncompliance is occurring within the CACFP. These problems cannot be denied and should not be ignored. Until the DHSS recognizes these problems, acknowledges there are weaknesses in its existing procedures, and takes action to strengthen them, significant improper payments to subrecipients will likely continue.

Federal Agency: Department of the Treasury Federal Program: 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds SLFRP4542 State Agency: Office of Administration (OA) Type of Finding: A - Internal Control (Material Weakness) and Material Noncompliance B - Internal Control (Material Weakness) and Material Noncompliance Compliance Requirement: Subrecipient Monitoring As noted in our previous 2 audits, during the year ended June 30, 2025, the OA had not established policies and procedures regarding monitoring subrecipients of the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program. As a result, the OA and 2 other state agencies did not comply with the Uniform Guidance (UG) requirements regarding identifying and monitoring subrecipients of the SLFRF program. The OA is the lead agency responsible for administering the SLFRF program. The purpose of the SLFRF program is to provide funding to respond to the COVID-19 public health emergency (PHE) or its negative impacts; respond to workers performing essential work during the PHE; provide government services, to the extent of the reduction in revenue due to the PHE (revenue replacement); make necessary investments in water, sewer, or broadband infrastructure; provide emergency relief from natural disasters or the negative economic impacts of natural disasters; and finance certain surface transportation and housing projects. The OA and various state agencies designed projects within the various allowable SLFRF program categories, and are responsible for administering the projects. The OA developed the American Rescue Plan Act Grant Management Portal (portal) to serve as the official repository of information and documentation supporting each SLFRF program project. The state agencies upload supporting documentation to the portal, including contracts, payment requests, and other supporting documentation. Most payments are made on a reimbursement basis. The OA reviews each payment request and processes the payments. Some SLFRF program projects are administered through subawards. The OA and various state agencies establish contracts with each subrecipient that outline various SLFRF program requirements, terms, and conditions. In the Schedule of Expenditures of Federal Awards (SEFA), the OA reported that approximately $302 million was passed through to subrecipients of the SLFRF program during the year ended June 30, 2025. This amount represents approximately 41% of the SLFRF program expenditures. These awards were administered through the OA and 8 other state agencies. In response to our prior audit findings, the OA held a training for state agency personnel in August 2024; sent a letter to state agencies in January 2025 covering agency responsibilities related to certain SLFRF program subrecipient monitoring requirements, such as subrecipient determinations, risk assessments, and single audits; and executed interagency agreements with the various state agencies in October and November 2025 (after the current audit period). Of the 8 state agencies that administered subawards reported in the SEFA during the year ended June 30, 2025, 4 administered the majority of the subawards, with payments totaling approximately $272 million, or 90% of the total subrecipient payments reported in the SEFA. These 4 state agencies were the Department of Mental Health (DMH), the Department of Higher Education and Workforce Development (DHEWD), the Department of Natural Resources (DNR), and the Department of Economic Development (DED). Our review and testing of subrecipient monitoring procedures focused on the OA and these 4 state agencies. For the 4 state agencies, a total of 287 recipients were identified as subrecipients in the SEFA. To understand the OA and state agency procedures, and to test compliance with subrecipient monitoring requirements, we randomly selected a sample of payments for 30 subrecipient projects from the 4 state agencies. The 30 subrecipients were awarded a total of approximately $191 million in SLFRF program funding and were paid a total of approximately $53 million during the year ended June 30, 2025. We reviewed records in the portal and requested information from the state agencies to support the subawards. A. Subrecipient Determination During the year ended June 30, 2025, the OA had not established policies and procedures to determine whether recipients of the SLFRF program funds were subrecipients or contractors. As a result, 1 of the 4 state agencies, the DHEWD, had not conducted determinations for any of their subrecipients. Subrecipient monitoring requirements are outlined in the UG. Regulation 2 CFR Section 200.331 states the pass-through entity is responsible for making case-by-case determinations to determine whether the entity receiving federal funds is a subrecipient or a contractor. The classification of a subrecipient is dependent upon whether the entity is responsible for making eligibility determinations for assistance, has its performance measured in relation to whether the objectives of the federal program were met, has responsibility for programmatic decision-making, is responsible for adherence to federal program requirements, and implements a program for a public purpose. The OA did not evaluate each SLFRF program recipient for the UG criteria, and did not make a determination of whether the entity was a subrecipient or contractor. OA officials assigned responsibility for making these determinations and identifying subrecipients to the applicable state agencies, but did not provide clear guidance to the state agencies or ensure the state agencies properly performed and documented the determinations. The DHEWD had not conducted determinations for either of its 2 sampled subrecipients. DHEWD personnel indicated they did not believe they were responsible for performing subrecipient determinations for the SLFRF program. Without adequate procedures over subrecipient or contractor determinations, the OA lacks assurance that its subrecipients have been identified for subrecipient monitoring purposes. B. Subrecipient Monitoring During the year ended June 30, 2025, the OA did not implement an effective subrecipient monitoring program to monitor the SLFRF program subrecipients. As a result, 2 of the 4 agencies reviewed, the DHEWD and the DMH, did not perform sufficient subrecipient monitoring procedures. Regulation 2 CFR Section 200.332(c) states that pass-through entities must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Risk assessments may consider factors such as the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially-changed systems, and the extent and results of any federal agency monitoring. Regulation 2 CFR Section 200.332(e) requires pass-through entities to monitor the activities of a subrecipient as necessary to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must (1) review financial and performance reports; (2) ensure the subrecipient takes corrective action on all significant developments that negatively affect the subaward; (3) issue a management decision for audit findings pertaining only to the federal award provided to the subrecipient from the pass-through entity; and (4) resolve audit findings specifically related to the subaward. To monitor subrecipients of the SLFRF program, the OA relies on its pre-payment monitoring process. During the year ended June 30, 2025, the OA did not perform any post-payment monitoring procedures, and relied on the state agencies to perform these procedures without sufficiently communicating with the state agencies regarding their subrecipient monitoring responsibilities or ensuring the state agencies performed monitoring reviews. Risk assessments The OA did not ensure required risk assessments for subrecipients of the SLFRF program were performed to determine the nature, timing, and extent of monitoring procedures necessary. Two of the 4 state agencies, the DHEWD and the DMH, did not perform any risk assessments for any of the sampled subrecipients. OA officials indicated risk assessment procedures are the responsibility of the state agencies; however, during the year ended June 30, 2025, the OA did not provide clear guidance to the state agencies or ensure the state agencies performed and used risk assessments as required. DHEWD officials indicated they did not perform subrecipient risk assessments because the subrecipients are institutions of higher education, to which the DHEWD distributes annual state funding. However, the UG does not provide for exemptions to the risk assessment requirements for such entities. DMH officials indicated assessments were informally completed; however, the DMH could not provide any documentation of such informal risk assessments or how those risk assessments were considered in monitoring decisions. DMH officials stated they are in the process of developing formal risk assessment tools. In addition to complying with federal requirements, risk assessments are necessary to ensure monitoring reviews are conducted with adequate frequency to help ensure subrecipient compliance with program requirements. The interagency agreements the OA executed with the various state agencies in October and November 2025 (after the current audit period) describe agency responsibilities for monitoring subrecipient compliance with SLFRF program requirements, including risk assessments. OA pre-payment monitoring process The OA has not developed policies and procedures outlining its pre-payment monitoring process and did not always clearly document monitoring performed prior to making payments. In their review and approval of each SLFRF program subrecipient payment request, OA officials stated they thoroughly review supporting documentation uploaded to the portal by the state agencies, including contracts, bid documentation, invoices, and other supporting documentation. OA officials further stated they review for compliance with certain types of SLFRF program compliance requirements, including allowable activities and allowable costs, procurement, and period of performance. However, the OA does not clearly document review procedures performed. For each of the 30 subrecipient projects sampled, the portal included documentation pertaining to some, but not all of the applicable compliance requirements. Without documented policies and procedures and documentation of prepayment monitoring procedures performed, the OA cannot demonstrate subrecipient monitoring procedures were performed. Additional monitoring procedures The OA did not monitor subrecipients beyond the pre-payment monitoring process previously described. OA officials stated post-payment monitoring procedures are the responsibility of the state agencies; however, during the year ended June 30, 2025, the OA did not sufficiently communicate with the agencies regarding subrecipient monitoring responsibilities or ensure the agencies performed monitoring reviews. Our review of subrecipient monitoring procedures at the 4 state agencies noted 2 agencies, the DHEWD and the DMH, had not developed written policies or procedures regarding subrecipient monitoring and did not perform sufficiently documented monitoring procedures. For 4 of 30 subrecipient projects sampled for the 4 agencies (13%), the DHEWD (2 subrecipients) and the DMH (2 subrecipients) could not provide documentation of subrecipient monitoring performed. While DHEWD officials indicated they perform pre-payment monitoring procedures, they could not provide documentation of such reviews for either of the 2 sampled projects. Furthermore, the DHEWD does not perform any additional subrecipient monitoring, such as monitoring subrecipients' compliance with procurement requirements. As a result, the DHEWD was unable to provide documentation to support the bidding of applicable aspects for 1 of 9 DHEWD projects sampled for a review of compliance with procurement requirements. While DMH officials indicated they perform annual billing service reviews to monitor subrecipients, the DMH did not perform such reviews for the 2 DMH projects sampled. In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure sufficient monitoring procedures were performed and documented increases the risk that subrecipient noncompliance will not be prevented or detected timely. The interagency agreements the OA executed with the various state agencies in October and November 2025 (after the current audit period) describe agency responsibilities for monitoring subrecipient compliance with SLFRF program requirements. Conclusions The OA is the lead agency responsible for administering the SLFRF program. OA officials indicated the state agencies were responsible for some of the subrecipient monitoring requirements. However, without clear communication and monitoring of these responsibilities, the OA lacks assurance of compliance with all subrecipient monitoring requirements. Without an established subrecipient monitoring program, the OA cannot provide assurance subrecipients are complying with SLFRF program requirements and there is increased risk that noncompliance with program requirements or subaward terms and conditions will go undetected, or that subaward performance goals will not be achieved. In addition, a subrecipient monitoring program is necessary to demonstrate adequate internal controls over compliance with subrecipient monitoring requirements. Documented policies and procedures are necessary to clearly communicate responsibilities to the state agencies, prevent misunderstandings, and demonstrate adequate internal controls over compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Paragraph 3.10 of the Standards for Internal Control in the Federal Government, also known as the Green Book, states, "[e]ffective documentation assists in management's design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors." Paragraph 12.01 states, "[m]anagement should implement control activities through policies." Recommendations The OA: A. Continue to work with the state agencies to ensure documented determinations are prepared to determine whether all recipients of SLFRF program funds are subrecipients or contractors. B. Develop policies and procedures outlining pre-payment monitoring procedures and document monitoring performed prior to making payments. The OA should also continue to ensure subrecipient monitoring tasks delegated to state agencies are adequately communicated. Procedures should be established to ensure subrecipient monitoring procedures are appropriately completed in accordance with the Uniform Guidance, including performing risk assessments for each subrecipient, monitoring for compliance with federal requirements and subaward terms and conditions, and ensuring subaward goals and objectives are achieved. Auditee's Response A. We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding. B. We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Homeland Security - Federal Emergency Management Agency (FEMA) Federal Program: 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) 2017 - FEMA - 4317 DR-MO 2019 - FEMA - 4435 DR-MO and FEMA - 4451 DR-MO 2020 - FEMA - 4490 DR-MO and FEMA - 4552 DR-MO 2021 - FEMA - 4612 DR-MO and FEMA - 4636 DR-MO 2022 - FEMA - 4665 DR-MO 2023 - FEMA - 4741 DR-MO 2024 - FEMA - 4803 DR-MO 2025 - FEMA - 4855 DR-MO State Agency: Department of Public Safety - State Emergency Management Agency (SEMA) Type of Finding: Internal Control (Material Weakness) and Material Noncompliance Compliance Requirement: Subrecipient Monitoring As similarly noted in our previous audit, during state fiscal year 2025, the SEMA did not fully comply with subrecipient monitoring requirements for the Disaster Grants - Public Assistance (Presidentially Declared Disasters) (DGPA) program. The SEMA did not communicate all required federal award information to subrecipients, completed only 25% of the required number of subrecipient monitoring reviews, and did not perform supervisory reviews of some monitoring reviews. The SEMA disbursed approximately $197 million to 312 DGPA program subrecipients during the year ended June 30, 2025. Regulation 2 CFR Section 200.332(b) requires pass-through entities to ensure every subaward is clearly identified to the subrecipient as a subaward and lists specific information to be communicated to the subrecipient. Regulation 2 CFR Section 200.332(c) requires pass-through entities to evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Regulation 2 CFR Section 200.332(e) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward, and achieves performance goals and objectives. Pass-through entities are required to ensure the subrecipient takes corrective action on all significant developments that negatively affect the subaward, including findings from single audits, site visits, and other means. The SEMA enters into a subaward agreement and provides a grant award form to each DGPA program subrecipient with various information about the grant. The SEMA's tiered monitoring process, outlined in the SEMA's Risk Assessment Form and Recovery Division Monitoring Policy (monitoring policy), requires risk assessments be performed 24 months after the disaster declaration for each subrecipient. Risk assessments are performed to evaluate various risk indicators and categorize each subrecipient as high, medium, or low risk. The risk category determines the type and nature of monitoring required for the subrecipient. The policy requires on-site monitoring reviews for all high-risk subrecipients and desk reviews of 20% of medium-risk subrecipients. No additional action is required for low-risk subrecipients. The monitoring policy requires the SEMA to generate reports listing any deficiencies noted during on-site and desk monitoring reviews. The monitoring report will, if applicable, reflect any notice given to the subrecipient about delinquent reports, failure to submit proper documentation, and issues noted during the review. The monitoring report also identifies the SEMA's and subrecipient's actions and plans to resolve the issue(s) by documenting a brief written plan and timeline for the resolution of the issues identified. When all issues have been resolved, the policy requires a follow-up letter and updated monitoring report to be provided to the subrecipient. The policy requires that the appropriate section specialist and the fiscal manager approve the monitoring reports. Subaward information As similarly noted in a FEMA report summarizing an August 2025 FEMA review, during state fiscal year 2025, the SEMA did not include all required federal award identification information in the grant award forms. The grant award forms lacked the following required information: federal award date; subaward budget period start and end date; amount of federal funds obligated in the subaward; total amount of federal funds obligated to the subrecipient, including the current financial obligation; and total amount of the federal award committed to the subrecipient. When required federal grant award information is excluded from grant award forms, subrecipients can be uninformed about specific requirements pertaining to the subaward and there is increased risk of noncompliance with program requirements. In response to the FEMA review, the SEMA updated the grant award forms to include the missing information effective for grants issued in January 2026. Monitoring reviews During state fiscal year 2025, the SEMA performed risk assessments for all 1,049 subrecipients requiring risk assessments; however, the SEMA performed only 64 of the 259 (25%) monitoring reviews required by the monitoring policy. The following table shows the results of the risk assessments performed for fiscal year 2025, the monitoring reviews required by federal regulation and SEMA policy, the monitoring reviews completed, and the monitoring reviews outstanding at year end. In addition, our randomly-selected sample of 2 of the 17 on-site reviews and 5 of the 47 desk reviews completed during state fiscal year 2025, noted the 2 on-site monitoring reports were not approved by the Section Specialist or the Fiscal Manager, as required by the monitoring policy. SEMA personnel indicated they began performing monitoring reviews in January 2025, in response to the prior audit finding; however, they did not have enough time to complete all required monitoring reviews by the end of the fiscal year. SEMA personnel also explained they did not realize supervisory approval of the on-site monitoring reports was required by SEMA's monitoring policy. When subrecipient monitoring reviews are not performed as required by federal regulation and SEMA policy, there is increased risk that noncompliance with program requirements will go undetected. Without adequate supervisory review of monitoring reports, the SEMA has less assurance the reviews were performed adequately and in accordance with the monitoring policy. Conclusions Without adequate internal controls over subrecipient monitoring requirements, there is increased risk of noncompliance, errors, fraud, waste, and abuse of federal funds. Adherence to policies and procedures is necessary to ensure compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The SEMA continue to strengthen controls and procedures to communicate federal award information to DGPA program subrecipients and monitor subrecipients in accordance with the monitoring policy. In addition, the SEMA should ensure supervisory reviews of monitoring reports are performed, as required. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

FINDING 2025-223 The Division did not complete sufficient subrecipient monitoring for the Homeland Security Grant during fiscal year 2025. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Homeland Security Grant Program Assistance Listing Number: 97.067 Federal Award Number: EMW-2021-SS-00082-S01; EMW-2022-00109-S01; EMW-2023-SS-00078-S01; EMW-2024-SS-05016 Program Year: September 1, 2021 – August 31, 2024; September 1, 2022 – August 31, 2025; September 1, 2023 – August 31, 2026; September 1, 2024 – August 31, 2027 Federal Agency: Department of Homeland Security Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that non-federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Specific requirements for pass-through entities in 2 CFR 200.332(c) states that pass-through entities must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate level of subrecipient monitoring to be completed. Further requirements at 2 CFR 200.332(e) indicate the pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and condition of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: 1. Review financial and performance reports. 2. Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. 3. Issue a management decision for audit findings pertaining to the federal award. 4. Resolve audit findings specifically related to the subaward. Condition: The Division’s subrecipient monitoring procedures include desk reviews and site visits. The Division also completes a risk assessment for each subrecipient prior to issuing a subaward and annually thereafter. The frequency of site visits and desk reviews vary depending on the assessed risk level. The Division strives to complete a desk review or site visit for every subrecipient at least once every five years. Subrecipients assessed at higher risks receive a site visit or desk review more frequently. The Division uses a worksheet to track risk assessments & monitoring activities of the 65 subrecipients. Based on our review, the tracking worksheet indicated that 34 subrecipients should have had monitoring completed in fiscal year 2025. However, there were no site visits or desk reviews completed in fiscal year 2025. Further, the Division’s tracking worksheet indicates that there are 26 subrecipients that have not been monitored in over 5 years and another 5 subrecipients that have not been monitored in over 10 years. In addition, the Division did not have support documentation for 1 of 14 (7 percent) of the pre-award risk assessment completed. Cause: There were challenges with staff turnover, budget holdbacks, and changes to the grant management system that strained the resources available to complete the subrecipient monitoring. However, the Division has not implemented appropriate procedures to ensure monitoring is completed at a sufficient level to be compliant with federal program requirements. In addition, the Division’s procedures failed to provide the guidance or emphasis to ensure pre-award risk assessment forms are completed and retained for each subrecipient as part of the monitoring requirements. Effect: Monitoring of subrecipients is a critical requirement in accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other federal guidelines provided by the grantor. Lack of monitoring increases the risk that subrecipients may not comply with federal statues, regulations, and grant terms. Completing no reviews in a fiscal year creates a significant backlog and overdue burden on future fiscal years to sufficiently monitor all subrecipients within the 5-year period of time. Recommendation: We recommend that the Division implement appropriate procedures to ensure that site visits and desk reviews are completed based on the appropriate level of risk assessed for every subrecipient within the 5-year period of time. We further recommend that the Division implement controls to ensure that subrecipient pre-award risk assessments are completed and retained for each subrecipient award. Management’s View: The agency agrees with the issue identified. Limited formal monitoring occurred in FY 25. IOEM does have evidence of extensive subrecipient communication regarding project eligibility, allocability and allowability through email correspondence, grants management system records, meetings and discussions. IOEM monitoring activity was strained in FY 25 due to FEMA reimbursement delays, federal government shutdown (during which no reimbursements were made), staffing turnover, budget holdbacks and a new grants management system. MilDiv leadership implemented a ‘pause’ on activities incurring costs during the federal government shutdown and the Division of Financial Management issued the MilDiv a line of credit to continue paying staff during the time when FEMA was not processing reimbursements for grant expenditures. This impacted IOEM as well as county and Tribal emergency management programs. Corrective Action: Resolution- IOEM has codified a monitoring protocol, meeting agenda template, and is currently scheduling monitoring for subrecipients identified on the risk assessment tool in September and October 2026. IOEM leadership determined that from Memorial Day to Labor Day no monitoring will take place due to the demands on local emergency management programs during fire season. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

Material weakness in internal controls over compliance and instances of noncompliance related to subrecipient monitoring. Federal Agency: Department of Treasury Program Title: Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Award Numbers: HCS-23-AR-2110-048, SLFRP0194 Project Period: November 1, 2021 - March 31, 2025 Criteria 2 U.S. Code of Federal Regulations (CFR) 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) Subpart D requires a recipient to adopt compliance policies to ensure sub-recipients comply with requirements under the award, and evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of such agreements for the purposes of determining appropriate subrecipient monitoring. Condition/Context for Evaluation During the audit for the year ending June 30, 2025, the Agency did not have a subrecipient monitoring policy and did not conduct monitoring over subrecipients awarded under the program. Cause The Agency did not have a subrecipient monitoring policy that included all the required provisions outlined in 2 CFR 200.332. Effect or Potential Effect The Agency did not fully comply with the requirements regarding subrecipient monitoring. Questioned Costs Not applicable as finding relates to a policy not being in place. Repeat Finding Yes, see finding 2024-002. Recommendation We recommend that the Agency develop a subrecipient monitoring policy that meets the required provisions outlined in 2 CFR 200.332 and ensure a risk assessment is performed over all subrecipients. Views of Responsible Officials of Auditee Management concurs with the finding and has provided the accompanying management corrective action.

Subrecipient Monitoring Federal Agency: U.S. Department of Labor Federal Program Title: WIOA Cluster (WIOA Adult Program; WIOA Youth Activities; WIOA Dislocated Worker Formula Grants) ALN: 17.258, 17.259, 17.278 Award Identification Number: 23A55AY000015; AA-38542-22-55-A-32; AA-36332-21-55-A-32, 23A55AT000046; 23A55AW000038; 23A55AY000015 Pass-Through Agency: State of Nevada, Department of Employment, Training and Rehabilitation (DETR) Pass-Through Award Number and Period: PY23-A-01-WIOA; PY24-A-01-WIOA; PY23-Y-01-WIOA; PY24-Y- 01-WIOA; PY23-DY-01-GR; PY23-DW-01-WIOA; PY24-DW-01- WIOA (All for the period 4/1/2023 – 6/30/2026) Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: As a pass-through entity, Nevadaworks is required by 2 CFR 200.332 (Requirements for pass-through entities) to monitor the activities of each subrecipient as necessary to ensure the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved (2 CFR 200.332(d)). WIOA oversight requirements at 20 CFR 683.410 and 683.420 reinforce monitoring of subrecipients and 2 CFR 200.303 requires effective internal control over federal awards. Condition: Audit procedures included selecting 5 of 8 subrecipients that received WIOA funding during fiscal year 2025 and testing management’s monitoring activities. Management was unable to provide evidence that monitoring procedures had been performed for three of the five subrecipients tested. Specifically, no monitoring reports, desk reviews, site visit documentation, risk assessments, corrective action follow-up, or other monitoring evidence was maintained for these subrecipients during the fiscal year. Subsequent inquiries with management identified that no monitoring procedures were performed for the three remaining subrecipients not selected. Although management monitored two subrecipients that remained active throughout the year, no procedures were performed over six subrecipients whose agreements terminated earlier in the fiscal year. As a result, management could not demonstrate that federal funds provided to those organizations were subject to oversight sufficient to ensure compliance with applicable federal requirements. Questioned costs: None. Context: The population consisted of eight subrecipients receiving WIOA funding during fiscal year 2025. Approximately $3.7 million in federal funding was passed through to subrecipients during the fiscal year. Monitoring deficiencies affected six of eight subrecipients, representing a substantial portion of Nevadaworks’ pass-through activity. Cause: Management's subrecipient monitoring process did not include procedures addressing subrecipients whose agreements terminated during the fiscal year. Because several contracts closed early in the year, management did not perform monitoring activities before closeout. In addition, there was no formal monitoring schedule or risk assessment process to ensure monitoring requirements were satisfied regardless of the duration of the award. Effect: Without documented monitoring activities, management lacked adequate assurance that federal funds were expended for authorized purposes, that program performance objectives were achieved, and that subrecipients complied with applicable laws, regulations, and grant requirements. The absence of monitoring procedures constitutes material noncompliance with pass-through entity responsibilities under Uniform Guidance. Repeat Finding: No. Recommendation: Management should establish and implement a formal risk-based subrecipient monitoring program consistent with 2 CFR 200.332. Monitoring activities should include documented risk assessments, periodic reviews of financial and performance information, monitoring procedures for terminated awards, and documented follow-up of identified issues. Monitoring requirements should apply to all subrecipients, including those with short-term agreements or agreements closed during the fiscal year. Views of responsible officials: There is no disagreement with the audit finding. Nevadaworks will implement a formal subrecipient monitoring process that includes documented policies, monitoring procedures applicable to all subrecipients, and monitoring activities incorporated into subaward closeout procedures.

State Agency: Illinois Governor’s Office of Management and Budget (GOMB) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Labor (DOL), U.S. Department of Transportation (DOT), U.S. Department of Education (USDE), U.S. Department of Health and Human Services (USDHHS), U.S. Department of Homeland Security (USDHS), Program Name: Special Supplemental Nutrition Program for Women, Infants and Children, Child and Adult Care Food Program, WIOA Cluster, Highway Planning and Construction (Federal-Aid Highway Program), Title I Grants to Local Educational Agencies, Special Education Cluster, Twenty-First Century Community Learning Centers, Supporting Effective Instruction State Grants, COVID-19 – Education Stabilization Fund, Aging Cluster, COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases, Temporary Assistance for Needy Families, Child Support Services, Low-Income Home Energy Assistance Program, Child Care and Development Fund Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse, Disaster Grants – Public Assistance (Presidentially Declared Disasters), Homeland Security Grant Program ALN and Program Expenditures: 10.557 ($211,116,030), 10.558 ($173,768,929), 17.258/17.259/17.278 ($146,186,461), 20.205 ($2,484,312,831), 84.010A ($841,918,401), 84.027/84.173 ($635,413,724), 84.287C ($44,018,938), 84.367A ($83,612,375), 84.425C/D/U/V/W ($968,653,091), 93.044/93.045/93.053 ($67,630,897), 93.323 ($73,439,961), 93.558 ($593,881,225), 93.563 ($146,728,300)93.568 ($215,662,419), 93.575/93.596 ($424,695,722), 93.667 ($53,464,167), 93.959 ($102,558,387), 97.036 ($317,860,132), 97.067 ($80,821,527) Finding 2025-003: Inadequate Monitoring of Subrecipient Single Audit Reviews Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Condition Found: The State of Illinois did not establish adequate controls to monitor the completion and documentation of the review of single audit reports for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Child and Adult Care Food Program (CACFP), WIOA Cluster, Highway Planning and Construction (Federal-Aid Highway Program) (Highway Planning), Title I Grants to Local Education Agencies (Title I), Special Education Cluster, Twenty-First Century Community Learning Centers (21st Century), Supporting Effective Instruction State Grants (SEISG), COVID-19 Education Stabilization Funds (ESF), Aging Cluster (Aging), COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families (TANF), Child Support Services (CSS), Low-Income Home Energy AssistanceProgram (LIHEAP), Child Care and Development Fund Cluster (CCDF Cluster), Social Services Block Grant (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Public Assistance) and Homeland Security Grant Program (Homeland Security) programs in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of GATA on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in Federal awards during the fiscal year and, if required, submit their single audit reporting packages to the Federal Audit Clearinghouse (FAC). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, assigning, any findings attributable to amounts passed through to the subrecipient(s) by the State to the applicable state agency, and working with program personnel to issue management decisions on findings. The State utilizes a contractor to perform the centralized functions of obtaining the single audit report, verifying the report meets the requirements, and assigning findings to the applicable State agency. During our testing of subrecipient single audit desk review files for our 2025 major programs, we noted instances where single audit desk reviews were still in process and had not been finalized within GATA ARRMS as of the date of our testing (April 30, 2026). Upon further review of data contained within GATA ARRMS, we identified 750 single audit reviews were identified as incomplete in GATA ARRMS for grantees who: (1) reported expenditures under fiscal year 2025 major programs, (2) had an audit report with a FAC acceptance date between January 2, 2024 and January 2, 2025 (requiring the report to be reviewed during fiscal year 2025) and (3) were not sanctioned (placed on the Illinois Stop Payment List) by the State for noncompliance with reporting requirements. These 750 reviews were in varying stages of completion with the majority (651 audits) pending documentation supporting the issuance of a final completion letter by the cognizant agency. The remaining 99 audits (13.2%) were pending receipt of documentation, pending a review, or had another error requiring follow-up. These 750 audits included 337 audits (44.9%) with one or more findings potentially requiring a management decision to be issued. We noted the cognizant agencies for the 750 incomplete single audit reviews in GATA ARRMS were as follows: "See full report for chart/table." The 750 incomplete single audit reviews in GATA ARRMS pertained to subrecipients of the following major programs: "See full report for chart/table." While in many instances there was evidence the State agencies had completed the necessary procedures outside of GATA ARRMS, the primary purpose of GATA ARRMS is to reduce the duplication of effort across State agencies and to provide a single submission point for the State’s subrecipients. The lack of monitoring controls around this centralized process may result in noncompliance with subrecipient single audit desk review requirements. The State’s subrecipient expenditures under the federal programs for the year ended June 30, 2025 were as follows: "See full report for chart/table." Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure the Federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. Further, 2 CFR 200.332(e)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on audit findings within six months of acceptance of the audit report by the FAC and ensure that the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include implementing procedures to monitor whether single audit reports are reviewed, management decision letters are issued, and single audit desk review files are closed out in GATA ARRMS in a timely manner. Cause: In discussing these conditions with GOMB officials, they stated that while GATU established the ARRMS platform, individual State agencies did not consistently prioritize documenting and finalizing their subrecipient audit reviews within the centralized system. GOMB officials further indicated that prior year corrective action plans have not fully resolved this issue due to resource constraints allowing backlogs from previous audit periods to carry forward. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in GATA ARRMS in a timely manner may result in noncompliance with the State’s obligation as a pass-through entity to appropriately monitor its subrecipients. This lack of centralized tracking prevents the State from ensuring that corrective action plans are implemented timely, which could lead to undetected subrecipient noncompliance and unallowable Federal expenditures. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-002. (Finding Code 2025-003, 2024-002, 2023-002). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend GOMB establish and enforce rigorous monitoring procedures to ensure that all State agencies timely complete and document subrecipient single audit reviews within GATA ARRMS. Specifically, GOMB should: • Establish mandatory, time-bound milestones for cognizant agencies to finalize desk reviews and issue management decisions within the six-month federal window. • Implement a monthly reconciliation and exception-reporting process to identify and escalate delinquent reviews to agency leadership. • Provide targeted training and administrative support to cognizant agencies to eliminate the historical backlog of unfinalized files. Views of GOMB Officials: GOMB agrees with the finding. GOMB implemented a monthly summary of outstanding reviews as of June 2025, met with agencies who had high volumes of outstanding reviews and worked with them to develop plans to reduce the backlog. GOMB has provided training on Chief Accounting Officer calls to ensure agency staff have the knowledge to complete the reviews.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: Highway Planning and Construction (Federal-Aid Highway Program) ALN and Program Expenditures: 20.205 ($2,484,312,831) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-008 Inadequate Review of Subrecipient Single Audit Reports Condition Found: IDOT did not adequately review single audit reports received from its subrecipients for the Highway Planning and Construction (Federal-Aid Highway Program) (Highway Planning) program on a timely basis. The State of Illinois established the Grant Accountability and Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal and State programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $1,000,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State. As a State agency, IDOT is responsible for reviewing the reports assigned to them by GATU and determining whether Federal funds reported in the consolidated year-end financial report (CYEFR) reconcile to IDOT records. Additionally, as the cognizant State agency, IDOT is responsible for issuing management decisions on findings reported and applying sanctions to subrecipients who do not comply with reporting requirements (i.e. stop pay process). During our testing of a sample of single audit desk review files for 24 subrecipients (with expenditures of $57,137,691 in the fiscal year), we noted the following: • For five subrecipients (with expenditures totaling $1,034,141), IDOT did not issue a management decision letter within required timeframes. The delays in issuing management decision letters ranged from one to 30 days beyond the required timeframe. • For four subrecipients (with expenditures of $1,348,055), the subrecipient single audit reporting package was not submitted by the subrecipients within the required timeframe. The delays in the submission of the subrecipient reporting packages for these subrecipients ranged from 19 to 81 days after the required timeframe, and IDOT did not follow-up with the subrecipient or invoke the stop pay process. IDOT has not established controls over subrecipient single audit desk reviews at an adequate level of precision to ensure single audit reporting requirements, including obtaining and reviewing single audit reporting packages, issuing management decision letters, and invoking stop payment actions, are performed within required timeframes. IDOT passed through $134,639,907 to subrecipients of the Highway Planning program during the year ended June 30, 2025. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statues, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(e)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure Single Audit reports are obtained and reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with IDOT officials, they stated delays in following up on late single audits and untimely issuance of management decisions was the result of human error. Additionally, IDOT has not been using the State’s Grantee Compliance Enforcement System (Stop-Pay), which has limited the effectiveness of enforcement activities for late subrecipient single audit reports. Possible Asserted Effect: Failure to obtain, complete, and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Additionally, failure to issue management decisions within six months of acceptance of the single audit report by the FAC results in noncompliance with federal regulations. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-008) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOT establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Additionally, IDOT should implement procedures to ensure timely issuance of management decision letters and initiation of the stop pay process. Views of IDOT Officials: IDOT agrees with the finding and recommendation. The Audit Compliance Unit recently changed the process of issuing Provisional Federal Compliance Letters. A report is still being run each week, to determine which Grantees may need a Provisional Federal Compliance Letter, but instead of just issuing letters that are due within the week, the letters are issued for the entire month. The implementation date was July 27, 2026. IDOT staff are reviewing and planning to resume the stop pay notification process. The estimated implementation date is December 31, 2026.

State Agency: Illinois Emergency Management Agency and Office of Homeland Security (IEMA-OHS) Federal Agency: U.S. Department of Homeland Security (USDHS) Program Name: Disaster Grants – Public Assistance (Presidentially Declared Disasters) ALN and Program Expenditures: 97.036 ($317,860,132) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-020 Inadequate Process for Subrecipient Single Audit Report Desk Reviews Condition Found: IEMA-OHS has not established effective internal controls or documented procedures to ensure subrecipients of the Disaster Grants - Public Assistance (Presidentially Declared Disasters) (Public Assistance) program perform audits required by the Uniform Guidance. IEMA-OHS coordinates Public Assistance program disaster requests with the USDHS Federal Emergency Management Agency (FEMA) related to disasters declared by the Governor and approved by the President. Local governments, non-profits, and other organizations receiving Public Assistance program funding are considered subrecipients of the State and are legally required to obtain single audits when federal expenditures exceed the established threshold under the Uniform Guidance. The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of State's Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and, if required, submit their single audit reporting packages to the Federal Audit Clearinghouse (FAC). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, assigning any findings attributable to amounts passed through to the subrecipient(s) by the State to the applicable state agency, and working with program personnel to issue management decisions on findings. The State utilizes a contractor to perform the centralized functions of obtaining the single audit report, verifying the report meets the requirements, and assigning findings to the applicable State agency. While GATU has exempted Public Assistance program subrecipients from certain state-specific GATA filing requirements, these subrecipients remain subject to federal Uniform Guidance requirements. Many of these subrecipients receive other federal pass-through funding from the State and submit their single audits through GATU's centralized process. However, the centralized state process does not absolve IEMA-OHS of its primary federal responsibilities as the direct pass-through entity. During our audit procedures over IEMA-OHS' subrecipient monitoring and desk review processes, we noted that IEMA-OHS did not have documented policies, procedures, or established internal controls to: • Identify subrecipients subject to the Single Audit requirements contained in Subpart F of the Uniform Guidance and determine whether required Single Audit reporting packages were timely submitted; • Review Single Audit reports submitted by subrecipients to identify findings, questioned costs, modified opinions, or other compliance matters related to Federal programs administered by IEMA-OHS and document any required follow-up actions; • Verify that Federal expenditures attributable to IEMA-OHS-administered awards were accurately reported by subrecipients within their schedules of expenditures or federal awards (SEFA) and Data Collection Forms submitted to the FAC; and • Reconcile expenditures reported by subrecipients for IEMA-OHS pass-through awards to agency records, • award documentation, and other supporting information to determine whether reported amounts were complete, accurate, and consistent with IEMA-OHS' records. As a result of these deficiencies, IEMA-OHS could not demonstrate whether its subrecipients complied with Uniform Guidance audit requirements, nor could it verify whether required management decisions on subrecipient audit findings were issued within the federally mandated timeframes. Criteria or Requirement: 2 CFR 200.332(e) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. This monitoring must include: 1. Verifying that every subrecipient that is expected to have a single audit performed meets the requirements of Subpart F of this part. 2. Reviewing the results of the subrecipient's audit and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award. 3. Issuing a management decision for audit findings that relate to the Federal awards it makes to subrecipients as required by 2 CFR 200.521. 2 CFR 200.521(d) states that the pass-through entity is responsible for issuing a management decision on subrecipient findings within six months of acceptance of the audit report by the FAC. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include implementing procedures to monitor whether single audit reports are obtained and reviewed, and management decision letters are issued within required timeframes. Cause: In discussing these conditions with IEMA-OHS officials, they stated the failure to monitor and conduct the compliance reviews were caused by the lack of an official procedure. Possible Asserted Effect: Failure to establish robust subrecipient monitoring controls significantly increases the risk that subrecipient noncompliance with Federal requirements, internal control deficiencies, questioned costs, and modified audit opinions will go undetected and unaddressed. Furthermore, without systematic procedures to verify and reconcile expenditures reported by subrecipients in their SEFAs, IEMA-OHS lacks assurance that its pass-through awards are being accurately reported at the subrecipient level. Consequently, unreported compliance issues, inaccuracies in federal reporting, and potential questioned costs may remain undetected, impairing IEMA-OHS' ability to effectively oversee Federal funds and increasing the risk of federal sanctions, including the potential withholding of future Public Assistance funding. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-020) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IEMA-OHS establish and implement comprehensive policies and procedures to strengthen its subrecipient monitoring process and ensure compliance with 2 CFR § 200.332. At a minimum, these procedures should require IEMA-OHS to: Establish a Tracking Mechanism: Develop and maintain a tracking log of all active subrecipients to monitor the submission status of their Single Audit packages to the FAC. Consideration should be to differentiate IEMA-OHS’ procedures for those subrecipients who are subject to GATA reporting requirements and those that are not. Formalize Desk Reviews: Establish a formal process for program personnel to review subrecipient Single Audit reports, document the evaluation of audit findings affecting the Public Assistance program, and ensure management decisions are issued within the required six-month timeframe. Implement Reconciliation Procedures: Implement procedures to verify and reconcile expenditures reported on subrecipients' SEFAs to IEMA-OHS’ internal award records.Retain Monitoring Documentation: Maintain centralized, audit-ready documentation of all subrecipient monitoring activities, including completed checklists, correspondence, and management decision letters. Views of IEMA-OHS Officials: IEMA-OHS agrees with the finding and recommendations. The Accountability Office will, with the assistance of the relevant grant programs, develop and implement clear and consistent procedures to ensure compliance with 2 CFR 200.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($67,630,897) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-023 Inadequate Review of Subrecipient Single Audit Reports Condition Found: IDOA did not issue management decision letters for single audit report findings for subrecipients of the Aging Cluster program within required timeframes.The State of Illinois established the Grant Accountability and Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal and State programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State. IDOA staff are responsible for reviewing the reports assigned to them by GATU and determining whether: (1) federal funds reported in the schedule of expenditures of federal awards reconcile to IDOA records; (2) issuing management decisions on findings reported within required timeframes; and (3) applying sanctions to subrecipients who do not comply with reporting requirements (i.e. stop pay process). During our testing of a sample of single audit desk review files for seven subrecipients (with expenditures of $40,522,841 in the fiscal year), we noted IDOA did not issue a management decision letter within 180 days for six subrecipients (with expenditures totaling $22,839,932). The delays in issuing management decision letters ranged from 708 to 803 days beyond the required timeframe. IDOA has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure single audit reporting requirements and the issuance of management decision letters are performed within required timeframes.IDOA passed through $65,974,847 to subrecipients of the Aging Cluster program during the year ended June 30, 2025. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(e)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure Single Audit reports are reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with IDOA officials, they stated the delays resulted from a combination of factors, including limited staffing capacity and the absence of automated workflow tools needed to process audit assignments at the level of precision required under the Uniform Guidance. Furthermore, management indicated the prior year corrective action plan was not sufficient to mitigate the conditions identified in this finding. Possible Asserted Effect: Failure to timely issue management decisions on subrecipient single audit findings results in noncompliance with federal regulations and prevents IDOA from ensuring that subrecipients implement prompt corrective action. When resolution is delayed by more than two years, there is a significantly increased risk that subrecipients may not comply with federal requirements across multiple subsequent grant periods without detection or remediation. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-049. (Finding Code 2025-023, 2024-049) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample.Recommendation: We recommend IDOA establish procedures to ensure management decision letters are issued for all findings affecting its federal programs in accordance with the Uniform Guidance. Such procedures should address how the State will address any remaining backlog of unresolved subrecipient single audit findings requiring management decisions. Views of IDOA Officials: IDOA is committed to bringing all audit reviews current and will meet timelines outlined in 2 CFR 200.521(a) going forward. IDOA accepts this finding and will create a comprehensive corrective action plan that includes additional staff capacity, development of standard operating procedures, staff training, and ongoing tracking to prevent this finding in the future.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse, ALN and Program Expenditures: 93.558 ($593,881,225), 93.575/93.596, ($424,695,722), 93.667 ($53,464,167), 93.959 ($102,558,387) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Subrecipient Monitoring Finding 2025-035 Failure to Follow Established Program Subrecipient Monitoring Procedures Condition Found: IDHS did not follow its established program monitoring policies and procedures for subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care Development Fund Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. IDHS has implemented procedures whereby program staff perform periodic program on-site and desk reviews of IDHS subrecipient compliance with regulations applicable to the federal programs administered by IDHS. IDHS also has implemented procedures whereby staff perform periodic on-site and desk reviews of IDHS subrecipient compliance with fiscal and administrative requirements applicable to multiple State and federal programs. Generally, these reviews are formally documented and include the issuance of a report of the review results to the subrecipient summarizing the procedures performed, results of the procedures, and any findings or observations for improvement noted. IDHS’s policies require the subrecipient to respond to each finding by providing a written corrective action plan. Additionally, IDHS program staff perform reviews of expenditure reports submitted by subrecipients. IDHS subrecipient monitoring procedures are subject to the review and approval of a supervisor. During our test work over program on-site review procedures performed for 81 subrecipients of the TANF, CCDF, SSBG, and SAPT programs, we noted IDHS did not follow its established program monitoring procedures as follows: We tested the program on-site review procedures and fiscal administrative review procedures performed by IDHS during the year ended June 30, 2025 for a sample of subrecipients of the TANF, CCDF, SSBG, and SAPT programs comprised of the following: "See full report for chart/table." We noted the following exceptions in our testing of program on-site reviews performed during the year ended June 30, 2025: IDHS did not perform on-site monitoring reviews of subrecipients in fiscal year 2025 in accordance with IDHS’ planned monitoring schedule and/or could not provide support for the review. Specifically, we noted the following exceptions: "See full report for chart/table." IDHS did not provide timely notification (within 60 days) of the results of the programmatic on-site reviews. We noted the following exceptions: "See full report for chart/table." IDHS did not complete their quality review on a timely basis (within 60 days). We noted the following exceptions: "See full report for chart/table." IDHS did not receive a corrective action plan from the subrecipient after findings were identified during the review. We noted the following exceptions: "See full report for chart/table." IDHS personnel were unable to provide support for management review of the program review tool. We noted the following exceptions: "See full report for chart/table." In addition, we noted the SAPT program requires subrecipients to submit periodic reports to allow IDHS to monitor certain programmatic performance metrics. These reports are reviewed quarterly by IDHS program personnel. Any subrecipients who meet less than 80% of the performance metrics reported are also required to submit a corrective action plan to IDHS. During our testing, we noted IDHS was unable to provide documentation evidencing monitoring of the quarterly program reports as follows: "See full report for chart/table." We also noted for one subrecipient tested under the CCDF Cluster (with expenditures of $707,862), the IDHS monitoring review documented an income calculation error within its sample of child care subsidy payments. While IDHS asserted the error did not affect the beneficiary’s underlying eligibility for services or the final subsidy amount paid, IDHS failed to perform a root cause analysis or expand its sample size to evaluate the potential financial impact and prevalence of errors across the broader population. Further, IDHS did not have adequate policies or procedures to ensure fiscal and administrative reviews were completed timely to detect potential non-compliance. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. According to 2 CFR 200.332(c), a pass-through entity must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring on-site program procedures and expenditure reviews are performed in a timely manner and adequate documentation is maintained. Cause: In discussing these conditions with IDHS officials, they stated the deficiencies identified result from a combination of factors including operational constraints due to staffing, oversight, system transitions, and a need to strengthen governance over timeliness, monitoring, and documentation controls. Furthermore, management indicated that implementation of prior year corrective action plans was delayed as a result of these factors. Possible Asserted Effect: Failure to adequately perform and document program on-site monitoring reviews of subrecipients and notify subrecipients of findings in a timely manner may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Failure to properly review subrecipient expenditures may result in inaccurate payments or unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-007. (Finding Code 2025-035, 2024-007, 2023-010, 2022-008, 2021-017, 2020-015, 2019-013, 2018-012, 2017-013, 2016-012, 2015-011, 2014-008, 2013-009, 12-07, 11-09) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS ensure programmatic on-site and expenditure report reviews are performed and documented for subrecipients in accordance with established policies and procedures. In addition, we recommend IDHS review its process for reporting and following up on program findings relative to subrecipient on-site reviews to ensure timely corrective action is taken. Views of IDHS Officials: The Department accepts the recommendation. IDHS will work to ensure programmatic on-site and expenditure report reviews are completed and documented in accordance with policies and procedures and will review its process for reporting and follow up on program findings resulting from on-site reviews. IDHS will continue to work to fill vacancies, administer training programs, increase oversight, develop automated processes, implement tracking tools, and review and revise procedures to improve internal controls over these functions.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA) U.S. Department of Health and Human Services (USDHHS) Program Name: WIC Special Supplemental Nutrition Program for Women, Infants, and Children, Temporary Assistance for Needy Families, Child Care Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 10.557 ($211,116,030), 93.558 ($593,881,225), 93.575/93.596 ($424,695,722), 93.667 ($53,464,167), 93.959 ($102,558,387) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Subrecipient Monitoring Finding 2025-037 Inadequate Process to Communicate Award Information to Subrecipients Condition Found: IDHS does not have an adequate process in place to ensure required award information is accurately communicated to subrecipients of the WIC Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Temporary Assistance for Needy Families (TANF), Child Care Development Fund Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. IDHS is responsible for coordinating program funding across several Federal and State programs through its program and administrative divisions, bureaus, and offices. While IDHS uses a standard contract document for its agreements with subrecipients, the specific award information is manually input into each contract by program contracting personnel. During our testing of WIC, TANF, CCDF, SSBG, and SAPT subrecipient contracts under which federal funds were expended during the year ended June 30, 2025, we noted IDHS did not accurately communicate all required information to its subrecipients. Specifically, we noted the award communication included incorrect details as follows: "See full report for chart/table." We noted the review of contract documents did not include verifying the FAIN and ALN agreed to award documents between the State and the respective federal agencies. While the instances of noncompliance identified in this finding only pertain to CCDF, SSBG, and SAPT, we noted the processes and deficient internal control pertain to contracts for all of IDHS’ major programs with subrecipient expenditures. Details of the subrecipient payments selected in our samples are as follows: "See full report for chart/table." Criteria or Requirement: According to 2 CFR 200.332(b), a pass-through entity is required to identify Federal awards made by informing each subrecipient of required information. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures in place to ensure required information is properly communicated. Cause: In discussing these conditions with IDHS officials, management stated that the exceptions noted are due to inaccuracies in the manual entry of subawards. Additionally, not all awards were being identified through the existing information process flow. Possible Asserted Effect: Failure to communicate required award information may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-037) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS implement additional procedures to ensure award information communicated to subrecipients is reviewed for completeness and accuracy. Views of IDHS Officials: The Department accepts the recommendation. The Office of Contract Administration (OCA) staff coordinated with IDHS Fiscal Services, Bureau of Federal Reporting staff and the Illinois Department of Innovation and Technology (DoIT) staff in 2024 and 2025 to create an Application Programming Interface (API) between the IDHS grant making system and the IDHS accounting system to perform a coding validation look-up that autopopulates the award coding information which is designed to eliminate end user manual entry errors.

Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Child Support Services ALN and Program Expenditures: 93.563 ($146,728,300) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-052 Failure to Communicate Award Information to Subrecipients Condition Found: DHFS did not communicate required information in its award documents to subrecipients of the Child Support Services (CSS) program. During our testing of the award communications for our sample of subrecipients, we selected the contracts under which funds were disbursed during fiscal year 2025 to review for compliance with federal award communication requirements. During our review of the award communication files for our sample of 3 awards (related to subrecipient expenditures of $9,542,471), we noted the following information was not communicated in the subrecipient award agreement for any of the subrecipients sampled: Federal Award Identification Number (FAIN) Subrecipient’s Unique Entity Identifier (UEI) Federal award date Additionally, we noted DHFS has not established internal controls at a sufficient level of precision to detect whether all required information has been communicated to each subrecipient in accordance with federal regulations. Amounts passed through to subrecipients under the CSS program totaled $11,760,786 during the year ended June 30, 2025. Criteria or Requirement: According to 2 CFR 200.332(b), a pass-through entity is required to identify Federal awards made by informing each subrecipient of required information In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures in place to ensure required information is properly communicated. Cause: In discussing these conditions with DHFS management, they stated they stated that the omission of this subrecipient award information was an oversight due to a misinterpretation of the communication requirements related to these contracts. Possible Asserted Effect: Failure to communicate required award information may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-052) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS implement additional procedures to ensure award information communicated to subrecipients is reviewed for completeness and accuracy. Views of DHFS Officials: DHFS accepts the recommendation. DHFS will ensure that future communications with subrecipients comply with all federal requirements. The services contracted from these three subrecipients are supported by intergovernmental agreements dating from 2020 through 2024. These agreements each contain reference to the applicable requirements of Title IV-D of the Social Security Act, the applicable CFDA number, start and end dates of the award period and maximum expenditure amounts by year. DHFS also sends an annual verification of the actual funds expended to each entity for audit pu rposes. DHFS adopted a policy beginning July 1, 2025 that these agreements are of a vendor arrangement instead of a subrecipient relationship and therefore will not require the elements discussed in the finding. However, the fiscal year 2025 audit period falls before this policy change.

Finding 2025-003 (Material Weakness) Program: Housing Opportunities for Persons with AIDS Federal Agency: United States Department of Housing and Urban Development (HUD) AL #: 14.241 Federal Award Identification Number and Year: Various – See SEFA Pass-through Entity: N/A Type of Compliance Finding: M) Subrecipient Monitoring Criteria Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). Condition The City did not provide evidence supporting compliance with this requirement. Cause The City failed to 1) evaluate the results of subrecipient’s previous audits including whether or not the subrecipient received a single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward was audited as a major program; and 2) have the Subrecipient address the identified findings in the contract monitoring report according to the response timeframe outlined in the report; to ensure quality programming that benefits the clients. Effect The City may not be compliant with HUD, which could result in the City not receiving federal assistance or repayment of grant funds. Questioned Costs None Context N/A Is the finding a repeat finding No Recommendations We recommend the City ensure Subrecipients respond to all corrective action plans by the required timeframes outlined and ensure all subrecipients are monitored as stated in the Federal regulations and City’s policy. Views of Responsible Officials / Planned Corrective Actions Management agrees with the finding. See Corrective Action Plan on Organization’s letterhead.

2025 – 003 Subrecipient Monitoring Federal Award Identification: Coronavirus State and Local Fiscal Recovery Funds (SLFRF)(ALN 21.027) Criteria: Under 2 CFR §200.332, pass-through entities are required to monitor the activities of subrecipients as necessary to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Such monitoring includes reviewing Single Audit reports, considering whether audit findings relate to the pass-through entity's subawards, and ensuring that subrecipients take timely and appropriate corrective action on deficiencies pertaining to Federal awards provided by the pass-through entity. Condition: The City passed through portions of SLFRF funding to a nonprofit organization. The City also provided Homeowners Assistance Fund Program (HAF) funds to that same organization. The City did not document that it had obtained the subrecipient's Single Audit reports, nor did it document its review of amounts reported in the SEFA and its evaluation of a finding reported by the subrecipient related to the SLFRF program with an assessment of corrective actions taken by the subrecipient. The subrecipient’s SEFA for June 30, 2025, did not properly identify the City as a passthrough entity of HAF funding. Rather, the expenditures appeared to be direct funding from Treasury due to the lack of passthrough agency identification. The City did not document timely inquiry, review, or follow-up regarding the omission of HAF expenditures from the subrecipient's SEFA, despite the City having provided HAF funding to the nonprofit during the period. Cause: The City's subrecipient monitoring procedures were not adequately designed or implemented to ensure that subrecipient Single Audit findings were formally reviewed and followed up on, and discrepancies identified in subrecipient reporting were investigated and resolved. Effect: Failure to evaluate and follow up on subrecipient audit findings and reporting discrepancies may allow noncompliance to remain unresolved, increase the risk of improper use of Federal funds, impair the City's ability to identify potential questioned costs, and result in noncompliance with Uniform Guidance subrecipient monitoring requirements. As a result, the City lacked additional assurance that its subawards were administered in accordance with applicable Federal requirements. Questioned Costs: Undeterminable Recommendation: We recommend that the City strengthen its subrecipient monitoring procedures to: • Document its review of subrecipient Single Audit reports; • Evaluate whether reported audit findings relate to City-funded subawards; • Follow up on corrective actions for applicable findings and maintain supporting documentation of that review; and • Investigate and resolve discrepancies in subrecipient Federal award reporting, including omissions identified on the SEFA. • Amend its existing grants administration policy to include a section related to subrecipient monitoring responsibilities Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding. The City will establish and document formal subrecipient-monitoring procedures consistent with 2 CFR §200.332.

Assistance Listing Numbers: 21.027 Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Pass-Through Agencies: Maricopa County Pass-Through Grantor Identifying Number: None Award Year: November 1, 2021 through September 30, 2026 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR 200.332 (e) & (g) - pass-through entities must monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Condition: While AACHC performed several of the required subrecipient monitoring tasks, AACHC's system of internal controls did not include a process to monitor the subrecipients' financial and performance reports by verifying that subrecipients are audited if they meet the single audit criteria and ensure that subrecipients take corrective action on single audit findings. Questioned Costs: N/A Context: In a population of five subrecipients, we noted that for all five subrecipients, while AACHC performed several of the required subrecipient monitoring tasks, AACHC did not monitor subrecipient activity through reviewing financial and performance reports, verify that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. This is deemed to be a material weakness in internal control over compliance. Effect: The system of internal controls was not properly designed to include a process to review financial and performance reports, verifying that subrecipients are audited if the meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Cause: AACHC was not aware of the requirements within the Uniform Guidance for pass-through entities to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Identification of Repeat Finding: Not a repeat finding. Recommendation: AACHC should update their subrecipient monitoring policies and procedures to specifically include a process to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. We also recommend AACHC regularly attend trainings on the Uniform Guidance to ensure they are knowledgeable of the required compliance procedures. Views of Responsible Officials and Planned Corrective Actions: Management of AACHC concurs with the finding. See Corrective Action Plan.

Assistance Listing Numbers: 93.332 Program: Cooperative Agreement to Support Navigators in Federally-Facilitated Exchanges Federal Agency: Department of Health and Human Services Pass-Through Agencies: N/A Pass-Through Grantor Identifying Number: NN/A Award Year: August 27, 2021 through August 26, 2024; August 27, 2024 through August 26, 2027 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR 200.332 (e) & (g) - pass-through entities must monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Condition: While AACHC performed several of the required subrecipient monitoring tasks, AACHC's system of internal controls did not include a process to monitor the subrecipients' financial and performance reports by verifying that subrecipients are audited if they meet the single audit criteria and ensure that subrecipients take corrective action on single audit findings. Questioned Costs: N/A Context: In a population of twelve subrecipients, we noted that for all twelve subrecipients, while AACHC performed several of the required subrecipient monitoring tasks, AACHC did not monitor subrecipient activity through reviewing financial and performance reports, verify that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. This is deemed to be a material weakness in internal control over compliance. Effect: The system of internal controls was not properly designed to include a process to review financial and performance reports, verifying that subrecipients are audited if the meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Cause: AACHC was not aware of the requirements within the Uniform Guidance for pass-through entities to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Identification of Repeat Finding: Not a repeat finding. Recommendation: AACHC should update their subrecipient monitoring policies and procedures to specifically include a process to monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. We also recommend AACHC regularly attend trainings on the Uniform Guidance to ensure they are knowledgeable of the required compliance procedures. Views of Responsible Officials and Planned Corrective Actions: Management of AACHC concurs with the finding. See Corrective Action Plan.

2025-001 - Internal Control over Compliance and Compliance with Subrecipient Monitoring Requirements Information on the Federal Program: United States Department of Treasury Assistance Listing Number: 21.027 Assistance Listing Name: Coronavirus State and Local Fiscal Recovery Fund Pass-Through Entity: Prince George’s Country Maryland Pass-Through Entity Number: 52-6000-998 Award Period: February 28, 2024 through June 30, 2025 Criteria– In accordance with §200.303(a), Internal Controls, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §180.300, Suspension and Debarment, non-federal entities cannot enter into awards, subawards, or contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Non-federal entities must either check for exclusions in the System for Award Management (SAM); collect a certification from the entity, or add a clause or condition to the covered transaction with the entity prior to entering into a covered transaction with a non-federal entity. In addition, in accordance with §180.415(b), non-federal entities cannot renew or extend covered transactions (other than no-cost time extension) with any excluded person, or under which an excluded person is a principal, unless the non-federal entity obtains an exception under §180.135. 2 CFR §200.332(b), Requirements for pass-through entities, indicates that pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and that the subaward document includes the best available information provided within 2 CFR §200.332(b)(1). Condition – During our testing of the two subrecipients under this program, we noted that management did not determine whether the subrecipients were suspended or debarred prior to entering into the agreement with the subrecipients or when the subaward agreements were amended. Additionally, the agreements between The Community Foundation and the subrecipients did not contain certain key information, such as the assistance listing number, as required by 2 CFR §200.332(b)(1). Context – During our review of The Community Foundation’s compliance with the Uniform Guidance requirements, we noted that there were two subrecipients under the applicable federal program. Both subrecipients were selected for testing, resulting in a 100% examination rather than a sample-based approach. Upon identification of compliance errors, management subsequently verified the status of the subrecipients in the System for Award Management (“SAM”) to confirm that neither was suspended nor debarred. We reviewed supporting documentation from SAM and confirmed that both subrecipients were not suspended or debarred. Following the audit procedures, which identified missing data elements required by 2 CFR §200.332(b)(1), management issued communications to each subrecipient, providing the relevant information that had initially been omitted from the subaward agreements. Cause - The Community Foundation’s policies include requirements to determine whether vendors/subrecipients are suspended are debarred when working on Federal programs. The individuals executing the agreements between The Community Foundation and the two subrecipients did not properly follow the procurement policy with respect to checks for suspension and debarment. In addition, the individuals executing the agreements with the two subrecipients did not properly review the regulations and did not identify the need to include the information in 2 CFR §200.332(b)(1). Effect or Potential Effect - The lack of adherence to the established internal control policies and procedures can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements which could ultimately lead to disallowed costs for the major federal program. Questioned Costs - There are no questioned costs. Repeat Finding - This is not a repeat finding from prior year. Recommendation - We recommend that The Community Foundation ensure consistent adherence to its policies and procedures. Given that federal funding is not received on a recurring basis, certain policies and procedures may become outdated. We further recommend that, upon receipt of federal funding in the future, management designate an individual with appropriate knowledge and experience to review applicable federal regulations and update policies and procedures as necessary to maintain compliance. Views of Responsible Officials – Management agrees with the finding and has implemented corrective actions, including verifying subrecipients’ eligibility in SAM.gov before awarding or amending federal subawards, updating subaward templates to meet federal requirements, and revising procurement and cash management policies for compliance. The Controller will act as Compliance Coordinator for future federal funding, overseeing regulation review, staff training, and quarterly compliance checks, with any deficiencies reported to the CFO for prompt resolution. These measures aim to ensure ongoing adherence to federal grant requirements.

2024-001 Significant Deficiency in Internal Controls over Compliance and Compliance, Other Matter – Procurement (suspension and debarment) Agency: U.S. Department of the Interior Program(s) and Federal Award Listing Number(s): Partners for Fish and Wildlife ALN: 15.631 FAIN: FA22AC02756, FA23AC02476 New or Repeat: New Criteria: Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Per 2 CFR Part 180, as referenced in 2 CFR Part 1400, for any contract expected to total $25,000 or more, a recipient of federal funds must confirm that the contractor is not suspended or debarred from receiving federal funds. Per 2 CFR 200.332, a pass-through entity must verify that the subrecipient is not suspended, debarred, or otherwise excluded from receiving federal funds in accordance with 2 CFR 180.300. Condition: SAWC was not able to provide supporting documentation indicating that it had verified that contractors and subrecipients were not suspended or debarred prior to contracting with, or making a subaward to, the entities. Cause: Internal controls were designed, but not sufficiently implemented to ensure that documentation of the check for suspension and debarment was retained. Effect: SAWC could have contracted with, or made a subaward to, an entity that was suspended or debarred. Context: We tested 100% of the procurement population. For three of the three contractors/subrecipients tested, we were not able to verify that SAWC confirmed the contractor/subrecipient was not suspended or debarred prior to entering into the transaction. Questioned costs: There are no questioned costs associated with this finding. Recommendation: We recommend SAWC consider either collecting a certification regarding suspension and debarment from contractors/subrecipients or adding a suspension and debarment clause or condition to contracts and subawards. View of responsible officials: Management concurs with this finding, see corrective action plan.

2024-001 Significant Deficiency in Internal Controls over Compliance and Compliance, Other Matter – Procurement (suspension and debarment) Agency: U.S. Department of the Interior Program(s) and Federal Award Listing Number(s): Partners for Fish and Wildlife ALN: 15.631 FAIN: FA22AC02756, FA23AC02476 New or Repeat: New Criteria: Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Per 2 CFR Part 180, as referenced in 2 CFR Part 1400, for any contract expected to total $25,000 or more, a recipient of federal funds must confirm that the contractor is not suspended or debarred from receiving federal funds. Per 2 CFR 200.332, a pass-through entity must verify that the subrecipient is not suspended, debarred, or otherwise excluded from receiving federal funds in accordance with 2 CFR 180.300. Condition: SAWC was not able to provide supporting documentation indicating that it had verified that contractors and subrecipients were not suspended or debarred prior to contracting with, or making a subaward to, the entities. Cause: Internal controls were designed, but not sufficiently implemented to ensure that documentation of the check for suspension and debarment was retained. Effect: SAWC could have contracted with, or made a subaward to, an entity that was suspended or debarred. Context: We tested 100% of the procurement population. For three of the three contractors/subrecipients tested, we were not able to verify that SAWC confirmed the contractor/subrecipient was not suspended or debarred prior to entering into the transaction. Questioned costs: There are no questioned costs associated with this finding. Recommendation: We recommend SAWC consider either collecting a certification regarding suspension and debarment from contractors/subrecipients or adding a suspension and debarment clause or condition to contracts and subawards. View of responsible officials: Management concurs with this finding, see corrective action plan.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

Lack of Subrecipient Monitoring Activities Finding Type. Immaterial Noncompliance; Significant Deficiency in Internal Controls over Compliance. Federal program(s) U.S. Department of Housing and Urban Development - Home Investment Partnerships Program (ALN 14.239); Direct award and Pass-through: Michigan State Housing Development Authority; All project numbers. Criteria. Under 2 CFR Part 200.332(e), the pass through-entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition. The County performed financial monitoring procedures during the year and obtained and reviewed subrecipient single audit reports from those subrecipients who were required to have single audits performed under 2 CFR 200 Subpart F. However, the County could not provide evidence that programmatic or performance monitoring to ensure that the stated goals and objectives of the subaward program were achieved during the year, and as such did not comply with all necessary subrecipient monitoring requirements during the year as required in 2 CFR Part 200.332(e). Cause. The County does not have the proper internal controls in place to ensure all aspects of subrecipient monitoring were performed in accordance with the requirements of the Uniform Guidance. Effect. The County did not follow all federal requirements for subrecipient monitoring and as a result has not completed all monitoring requirements for pass-through entities. Questioned Costs. None. Recommendation. We recommend that the County review its procedures for subrecipient monitoring to ensure compliance with Uniform Guidance. In the past, the County has had established procedures which included desk reviews and documented program monitoring of subrecipient programs, and it appears that not all of those procedures have remained in place due to staff turnover. The County should review, update, and implement procedures to ensure that those required elements of internal control are carried out by the responsible County department.

2024-001 Research and Development Cluster – Education Innovation and Research (formerly Investing in Innovation (i3) Fund – Validation Grants) Assistance Listing No. 84.411A Criteria: 2 CFR 200.332 notes, “All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; …” Condition: For both subawards selected for testing, the identification of the contact information for the awarding agency was incorrect. The contact information was Education Analytics, Inc., the Organization’s grantor, but should have been Future Forward, Inc. Further, one of the two subawards selected for testing had information missing from the subaward including all requirements for the award to be used in accordance with Federal statutes, regulations and terms and conditions of the Federal award. We consider this condition to be an instance of noncompliance relating to the Subrecipient Monitoring compliance requirement. Statistical sampling was not used in making sample selections. Questioned Costs: N/A Cause and Effect: Without communication of the required information, subrecipients may overspend award amounts or incur unallowable expenses towards the grant as well as report the incorrect grantor on their schedule of expenditures of federal awards. Recommendation: We recommend the Organization evaluates policies and procedures to ensure all required information is communicated with the subrecipient. Views of Responsible Officials: Management agrees with this Single Audit Finding and response is included in the Corrective Action Plan.

2024-002 Significant Deficiency in Internal Control and Compliance over Major Programs Funding Agency: Department of Treasury ALN: 21.027 Criteria Internal controls and other compliance knowledge should provide adequate subrecipient monitoring under federal awards. Per 2 CFR 200.332(d), pass-through entities should "monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations and the terms and conditions of the subaward; and that subaward performance goals are achieved." This would include site monitoring visits during the grant's period of performance. Condition The Organization provided funds to subrecipients under its direct award from the Department of Treasury. Payments to subrecipients are made on a reimbursement basis. Context During our subrecipient monitoring testing, we noted one of the three subrecipients tested did not receive a site visit during the grant agreement period. Per our discussion with management, the Organization was unable to schedule a monitoring visit during the grant agreement period. The Organization was also unable to provide sufficient documentation that supported adequate monitoring activities were in place during the grant agreement period. Cause The error was caused by the Organization's negligence to conduct any monitoring activity during the grant agreement period. Effect Unallowable activities or cost principles could be charged to the Department of Treasury. Repeat Finding No.Auditor's Recommendation It is recommended that the Organization reevaluates its internal controls over subrecipient monitoring to ensure that proper monitoring is occurring during the grant agreement period. The Organization should also consider who is responsible for the monitoring activity, and if necessary, assign those responsibilities to an employee who has a more flexible schedule that can accommodate the scheduled monitoring visits.

2024-002 Significant Deficiency in Internal Control and Compliance over Major Programs Funding Agency: Department of Treasury ALN: 21.027 Criteria Internal controls and other compliance knowledge should provide adequate subrecipient monitoring under federal awards. Per 2 CFR 200.332(d), pass-through entities should "monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations and the terms and conditions of the subaward; and that subaward performance goals are achieved." This would include site monitoring visits during the grant's period of performance. Condition The Organization provided funds to subrecipients under its direct award from the Department of Treasury. Payments to subrecipients are made on a reimbursement basis. Context During our subrecipient monitoring testing, we noted one of the three subrecipients tested did not receive a site visit during the grant agreement period. Per our discussion with management, the Organization was unable to schedule a monitoring visit during the grant agreement period. The Organization was also unable to provide sufficient documentation that supported adequate monitoring activities were in place during the grant agreement period. Cause The error was caused by the Organization's negligence to conduct any monitoring activity during the grant agreement period. Effect Unallowable activities or cost principles could be charged to the Department of Treasury. Repeat Finding No.Auditor's Recommendation It is recommended that the Organization reevaluates its internal controls over subrecipient monitoring to ensure that proper monitoring is occurring during the grant agreement period. The Organization should also consider who is responsible for the monitoring activity, and if necessary, assign those responsibilities to an employee who has a more flexible schedule that can accommodate the scheduled monitoring visits.

2024-002 Significant Deficiency in Internal Control and Compliance over Major Programs Funding Agency: Department of Treasury ALN: 21.027 Criteria Internal controls and other compliance knowledge should provide adequate subrecipient monitoring under federal awards. Per 2 CFR 200.332(d), pass-through entities should "monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations and the terms and conditions of the subaward; and that subaward performance goals are achieved." This would include site monitoring visits during the grant's period of performance. Condition The Organization provided funds to subrecipients under its direct award from the Department of Treasury. Payments to subrecipients are made on a reimbursement basis. Context During our subrecipient monitoring testing, we noted one of the three subrecipients tested did not receive a site visit during the grant agreement period. Per our discussion with management, the Organization was unable to schedule a monitoring visit during the grant agreement period. The Organization was also unable to provide sufficient documentation that supported adequate monitoring activities were in place during the grant agreement period. Cause The error was caused by the Organization's negligence to conduct any monitoring activity during the grant agreement period. Effect Unallowable activities or cost principles could be charged to the Department of Treasury. Repeat Finding No.Auditor's Recommendation It is recommended that the Organization reevaluates its internal controls over subrecipient monitoring to ensure that proper monitoring is occurring during the grant agreement period. The Organization should also consider who is responsible for the monitoring activity, and if necessary, assign those responsibilities to an employee who has a more flexible schedule that can accommodate the scheduled monitoring visits.

2024-002 Significant Deficiency in Internal Control and Compliance over Major Programs Funding Agency: Department of Treasury ALN: 21.027 Criteria Internal controls and other compliance knowledge should provide adequate subrecipient monitoring under federal awards. Per 2 CFR 200.332(d), pass-through entities should "monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations and the terms and conditions of the subaward; and that subaward performance goals are achieved." This would include site monitoring visits during the grant's period of performance. Condition The Organization provided funds to subrecipients under its direct award from the Department of Treasury. Payments to subrecipients are made on a reimbursement basis. Context During our subrecipient monitoring testing, we noted one of the three subrecipients tested did not receive a site visit during the grant agreement period. Per our discussion with management, the Organization was unable to schedule a monitoring visit during the grant agreement period. The Organization was also unable to provide sufficient documentation that supported adequate monitoring activities were in place during the grant agreement period. Cause The error was caused by the Organization's negligence to conduct any monitoring activity during the grant agreement period. Effect Unallowable activities or cost principles could be charged to the Department of Treasury. Repeat Finding No.Auditor's Recommendation It is recommended that the Organization reevaluates its internal controls over subrecipient monitoring to ensure that proper monitoring is occurring during the grant agreement period. The Organization should also consider who is responsible for the monitoring activity, and if necessary, assign those responsibilities to an employee who has a more flexible schedule that can accommodate the scheduled monitoring visits.

2024-002 Significant Deficiency in Internal Control and Compliance over Major Programs Funding Agency: Department of Treasury ALN: 21.027 Criteria Internal controls and other compliance knowledge should provide adequate subrecipient monitoring under federal awards. Per 2 CFR 200.332(d), pass-through entities should "monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations and the terms and conditions of the subaward; and that subaward performance goals are achieved." This would include site monitoring visits during the grant's period of performance. Condition The Organization provided funds to subrecipients under its direct award from the Department of Treasury. Payments to subrecipients are made on a reimbursement basis. Context During our subrecipient monitoring testing, we noted one of the three subrecipients tested did not receive a site visit during the grant agreement period. Per our discussion with management, the Organization was unable to schedule a monitoring visit during the grant agreement period. The Organization was also unable to provide sufficient documentation that supported adequate monitoring activities were in place during the grant agreement period. Cause The error was caused by the Organization's negligence to conduct any monitoring activity during the grant agreement period. Effect Unallowable activities or cost principles could be charged to the Department of Treasury. Repeat Finding No.Auditor's Recommendation It is recommended that the Organization reevaluates its internal controls over subrecipient monitoring to ensure that proper monitoring is occurring during the grant agreement period. The Organization should also consider who is responsible for the monitoring activity, and if necessary, assign those responsibilities to an employee who has a more flexible schedule that can accommodate the scheduled monitoring visits.

Subrecipient Monitoring Prior Year Finding Number: N/A Year of Finding Origination: 2024 Type of Finding: Internal Control Over Compliance and Compliance Severity of Deficiency: Significant Deficiency and Other Matter Federal Agency: U.S. Department of the Treasury Program: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Award Number and Year: SLT0790; 2021 Pass-Through Agency: N/A – Direct Criteria: Title 2 U.S. Code of Federal Regulations § 200.303 states that the auditee must establish and maintain effective internal control over the federal award that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 U.S. Code of Federal Regulations § 200.332 includes requirements such as evaluating the subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the award. Condition: The City did not have documentation of risk assessment procedures performed for two of the four subrecipients tested. Questioned Costs: None. Context: The City of Minneapolis has documented the subaward and subrecipient procedures that its staff are expected to follow. These procedures include the completion of a pre-award risk assessment form and for the form to be maintained in the contract file of the subrecipient. The sample size was based on guidance from Chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Effect: The City is not in compliance with federal regulations. Cause: City staff were not aware of the requirement to perform pre-award risk assessments with subrecipients. Recommendation: We recommend the City ensure that the City’s employees follow its procedures for completing risk assessments when contracting with subrecipients. View of Responsible Official: Concur

Criteria: 2 CFR 200.332 establishes requirements for pass-through entities. Included in these requirements is to monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. Condition: The City did have procedures in place to monitor allowable costs and activities of its subrecipients. However, while conducting a review of expenditures through the monitoring of the Appalachia Community Grant (ACG), the Ohio Department of Development (ODOD), noted that a subrecipient of the City had made unallowable expenditures for the grant. This demonstrates a control weakness in the subrecipient monitoring controls conducted by the City. Context: The City, ODOD, and the subrecipient are working on a way to recover any questioned costs associated with this and these do not represent questioned costs of the City. Effect: There is a significant deficiency in the subrecipient monitoring controls of the City that could allow future unallowable costs or activities at subrecipients, if not improved. Recommendation: We recommend that the City implement stronger monitoring controls including vendor verification and review of invoices for the draw down requests that they receive from their subrecipients.

FINDING 2024-001 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Subrecipient Monitoring Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Other Matters INDIANA STATE BOARD OF ACCOUNTS 13 HANCOCK COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Condition and Context The County received an allocation of the COVID-19 - State and Local Fiscal Recovery Funds (SLFRF) from the U.S. Department of the Treasury to support its response and recovery from the novel coronavirus. A portion of the County's allocation was then used to subaward funds to another entity (i.e., the subrecipient) to carry out an eligible use. The subaward was provided to the subrecipient via two different subaward agreements. Both subaward agreements were selected for testing. The County, as the pass-through entity, is to clearly identify the subaward and the terms and conditions of the award in the agreement with the subrecipient. During review of the two subaward agreements, it was determined that the Assistance Listings Number (ALN) and Federal Award Identification Number (FAIN) were not included as required. Additionally, the County as the pass-through entity, is to monitor the activities of the subrecipient to ensure that the subaward is used for authorized purposes in compliance with federal statutes, regulations, and terms and conditions of the subaward and that performance goals are achieved. Part of the monitoring requirements include verifying the subrecipient received an audit as required so as to be able to issue management decisions on any findings, as applicable. The County did not have a process in place to obtain and review audits received by the subrecipient. Therefore, the County would not have been able to issue management decisions or ensure timely and appropriate action by the subrecipient. The lack of internal controls and noncompliance were systemic throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: "(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states in part: "All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); INDIANA STATE BOARD OF ACCOUNTS 14 HANCOCK COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date . . . of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the passthrough entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R & D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is used charged) per § 200.414. . . . (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 of this part and in program regulations." Cause The County did not have adequate processes or procedures in place to ensure all of the proper information about the grant was provided to the subrecipient and all required monitoring activities were being conducted. Effect Not providing award identification information to subrecipients could result in the subrecipient not properly reporting the grant on their Schedule of Expenditures of Federal Awards. Furthermore, due to the absence of policies and procedures to monitor the activities of subrecipients, subrecipients could be spending federal funds for unauthorized purposes without the County's knowledge. As such, the County cannot ensure proper accountability and compliance with the program requirements. INDIANA STATE BOARD OF ACCOUNTS 15 HANCOCK COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that the County strengthen its system of internal controls to ensure that the County verifies that all subrecipients of federal awards receive an audit and that the County receives and reviews any audit reports of the subrecipients. Additionally, we recommended that the County strengthen its system of internal controls to ensure that subaward agreements include all required information that should be known to the subrecipient. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Criteria or specific requirement: Per 2 CFR 200.303(a), the County must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the ”Standards for Internal Control in the Federal Government” issued by the Comptroller General of the Untied States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Under Uniform Grant Guidance, the County must: • Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain required information including but not limited to: Federal and subaward information, indirect cost rate, and the subrecipient’s unique entity identifier (UEI). (2 CFR 200.332 (b)) • Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. (2 CFR 200.332 (c)) • Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. (2 CFR 200.332 (e)) • Verify that a subrecipient is audited as required by 2 CFR 200.501. (2 CFR 200.332 (g))Condition: Subaward agreement was expired and did not include all required information, nor did the subrecipient have the required UEI. Subaward requirements were not communicated to the subrecipient; therefore, monitoring activities were not effective. Documentation of subrecipient risk assessment or audit verification not available for audit.Questioned Costs: None noted.Context: Audit procedures included testing of the one subrecipient who received a subaward during the year. There were no other subrecipients.Cause: The County’s procedures were not sufficient to ensure the subawards were issued or monitored in compliance with Federal requirements. Internal controls did not prevent or detect the errors.Effect: Failure to properly document required contract information, perform the necessary risk assessments, and document the review of the subrecipient’s single audit may result in noncompliance with grant terms and conditions. Subrecipients may have incomplete Schedules of Expenditures of Federal Awards, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance.

Federal Program Name: Research and Development Cluster: Uniformed Services University Medical Research Projects Federal Agency: U.S. Department of Defense Federal Assistance Listing Number: 12.750 Criteria or Specific Requirement: Subrecipient Monitoring Condition: During testing of subrecipient monitoring, it was noted that the Organization awarded three awards to subrecipients during the year and did not inform these subrecipients of the federal nature of the award at the time of the subaward. Specifically, the required federal award information was not included in the subaward documentation. Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance with federal requirements. Questioned Costs: None Context: In accordance with 2 CFR section 200.332(a), pass-through entities are required to clearly identify to the subrecipient the federal award information at the time of the subaward. This includes the federal award identification number, the federal awarding agency, the assistance listing number (ALN), and the amount of federal funds obligated. This information was not communicated to the subrecipients Cause: The Organization did not have adequate procedures in place to ensure that all required federal award information was communicated to subrecipients. Repeat Finding: No Recommendation: We recommend that the Organization implement procedures to ensure that all required federal award information is included in subaward agreements and communicated to subrecipients at the time of the award. Views of Responsible Officials and Planned Corrective Action: The Organization agrees with the comment and will revise policies to communicate all required federal award information to subrecipients.

Federal Program Name: Research and Development Cluster: Uniformed Services University Medical Research Projects Federal Agency: U.S. Department of Defense Federal Assistance Listing Number: 12.750 Criteria or Specific Requirement: Subrecipient Monitoring Condition: During testing of subrecipient monitoring, it was noted that the Organization awarded three awards to subrecipients during the year and did not inform these subrecipients of the federal nature of the award at the time of the subaward. Specifically, the required federal award information was not included in the subaward documentation. Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance with federal requirements. Questioned Costs: None Context: In accordance with 2 CFR section 200.332(a), pass-through entities are required to clearly identify to the subrecipient the federal award information at the time of the subaward. This includes the federal award identification number, the federal awarding agency, the assistance listing number (ALN), and the amount of federal funds obligated. This information was not communicated to the subrecipients Cause: The Organization did not have adequate procedures in place to ensure that all required federal award information was communicated to subrecipients. Repeat Finding: No Recommendation: We recommend that the Organization implement procedures to ensure that all required federal award information is included in subaward agreements and communicated to subrecipients at the time of the award. Views of Responsible Officials and Planned Corrective Action: The Organization agrees with the comment and will revise policies to communicate all required federal award information to subrecipients.