Findings Citing § 200.521

FINDING 2025-003 Subject: Teacher and School Leader Incentive Grants – Subrecipient Monitoring Federal Agency: Department of Education Federal Program: Teacher and School Leader Incentive Grants Assistance Listings Number: 84.374 Federal Award Numbers and Years (or Other Identifying Numbers): Year 2-3, Year 3-4 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Modified Opinion Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, material noncompliance related to the Teacher and School Leader Incentive Grants (TSL) funds passed through to subrecipients. The School Corporation received and passed through to subrecipients $6,143,393 of TSL funds. The School Corporation is to clearly identify the award and applicable requirements to the subrecipients, evaluate the risk of noncompliance related to the subrecipients to determine appropriate monitoring of the subaward, and monitor the activities of the subrecipients to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. The School Corporation did not enter into an agreement with the subrecipients. As such, there is no agreement between the School Corporation and the subrecipients that clearly identifies the award as a subaward or includes all the required data elements. In addition, the School Corporation did not have any policies or procedures in place to evaluate the subrecipients' risk of noncompliance or to monitor the activity of the subrecipients. Per inquiry of the School Corporation, it was determined an evaluation of the risk of noncompliance for the subrecipients was not completed, nor did the subrecipients' files support any such evaluation. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 19 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states: "All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the passthrough entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; INDIANA STATE BOARD OF ACCOUNTS 20 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; (4) (i) An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the pass-through entity must determine the appropriate rate in collaboration with the subrecipient, which is either: (A) The negotiated indirect cost rate between the pass-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass-through entity is not required to collect information justifying this rate, but may elect to do so; (B) The de minimis indirect cost rate. (ii) The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). (5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and (6) Appropriate terms and conditions concerning closeout of the subaward. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; INDIANA STATE BOARD OF ACCOUNTS 21 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. INDIANA STATE BOARD OF ACCOUNTS 22 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 of this part and in program regulations." Cause The School Corporation's management was not aware of the requirements for subrecipient and subaward monitoring compliance. Thus, the School Corporation had not implemented its system of internal controls, which would include appropriate segregation of duties that would likely be effective in preventing, or detecting and correcting, noncompliance related to the Subrecipient Monitoring compliance requirement. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the School Corporation establish a proper system of internal controls, including segregation of duties, to evaluate the subrecipients' risk of noncompliance and adequately monitor the subrecipients. Additionally, policies and procedures should be implemented to ensure appropriate reviews, approvals, and oversight are taking place, as needed, to evaluate and monitor its subrecipients. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2025-046 Compliance with Subrecipient Monitoring for Disaster Grants The Federal Emergency Management Agency (FEMA) Disaster Grants program [ALN 97.036] provides supplemental assistance to recipients to assist communities with responding to and recovering from major disasters or emergencies. The program also provides funding for hazard mitigation measures to help communities implement hazard mitigation projects that can protect them from future disasters. The Disaster Grants program is based on a partnership between FEMA, the recipient (in this case, the Department), and, as applicable, the subrecipient (local governments). FEMA is responsible for managing the Disaster Grants program, approving grants, and providing technical assistance to the state, local, tribal, and territorial governments. The Department, as a recipient of Disaster Grants program funds, is responsible for providing technical advice and assistance to eligible subrecipients, providing support for damage survey activities, ensuring that all potential applicants are aware of funding assistance available, and submitting documents necessary for grant awards. A subrecipient is defined in federal regulations [2 CFR 200.1] as an entity, usually but not limited to non-federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through entity (such as the Department) to an entity (subrecipient) to carry out part of a federal grant award received by the pass-through entity. Specifically for this program, the subrecipient is expected to request assistance, as needed; identify the damaged facilities; provide information to support its funding requests; maintain accurate documentation; and perform other work, as necessary. As part of its subrecipient monitoring process, the Department should complete an annual risk assessment to determine the extent of its subrecipient monitoring activities. The risk assessment should include considerations of financial risk factors, such as financial implications of operational and compliance failures; operational risk factors, such as risks resulting from inadequate internal controls; and compliance risks, such as violations with laws, regulations, and internal policies. In addition, the Department should be using monitoring tools to track the status of whether the subrecipient underwent a Single Audit, if applicable, and whether that audit has been reviewed by Department staff and any resulting management decisions issued by those staff to the subrecipient, if applicable, that address the Department’s assessment and planned actions to address any findings or issues identified in the audit During Fiscal Year 2025, the Department passed approximately $76.0 million to 66 subrecipients for responses to various disasters covered by the Department’s Disaster Grants program. In addition, the Department reported that it approved no new subawards during Fiscal Year 2025. All funds passed through to subrecipients by the Department were related to reimbursements for prior period expenses. In total, the Department reported that it had passed through Disaster Grant funding to another 68 subrecipients in prior years who did not receive funding passed through from the Department during Fiscal Year 2025; many of these subrecipients had multiple open projects that had been completed in prior years but were awaiting final approval and close-out from FEMA. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to determine whether the Department had adequate internal controls in place over, and complied with, subrecipient monitoring requirements over the Disaster Grants program during Fiscal Year 2025. Another purpose of the audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendation to review all subrecipients’ federally-required Single Audit reports, as required. The Department agreed with the recommendation and planned to implement it by June 2025. As part of our audit work, we performed testwork to determine whether the Department obtained its subrecipients’ Single Audit reports and issued a management decision, if applicable. We also determined whether the Department performed risk assessments on the subrecipients as required by federal regulations. Finally, we performed this testing over a random sample of 9 of 68 subrecipients that received pass-through funding in the current year. How were the results of the audit work measured? We measured the results of our audit work against the following requirements: • Federal regulations [2 CFR 200.332] require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate level of subrecipient monitoring based on the Department’s assessment of risk posed by the subrecipients. Additionally, it requires the Department to verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, Audit Requirements, which sets forth the federal regulations around Single Audit threshold requirements for subrecipients. It also covers the federal regulations to consider whether the results of the subrecipient’s audits indicates conditions that necessitate adjustment to the passthrough entity’s—in this case, the Department’s—own records. Further, federal regulations [2 CFR 200.521] require the Department to issue a management decision, which is defined as the Department’s written determination of the adequacy of the subrecipient’s proposed corrective action to address any findings in the subrecipient’s Single Audit reports within 6 months of the federal audit clearinghouse’s acceptance of the audit report. • The Department’s Division of Homeland Security and Emergency Management’s (DHSEM) Subrecipient Monitoring policy states that it “…will perform an annual evaluation of Subrecipient’s risks prior to the start of each State fiscal year, analyzing active awards and assessing Subrecipients for the upcoming year to determine the financial status of each Subrecipient and which subrecipients will receive on-site monitoring which may include desk reviews.” The policy further goes on to indicate that each subrecipient will receive an overall risk score that is used to determine which subrecipients will undergo monitoring review during the fiscal year based on the quantitative and qualitative data used for the assessment inputs. • The DHSEM Subrecipient Monitoring policy also states that “DHSEM will perform reviews of single audit results for Subrecipients who have expended Federal grant funds in excess of $750,000 of which some portion is passed through DHSEM.” • Federal regulations [2 CFR 200.329] stipulate that the non-federal award recipient—in this case the Department—is responsible for oversight of the operations of its federal award-supported activities. The regulations further state that the “non-federal entity” must monitor its activities under federal awards to assure that compliance with applicable federal requirements and performance expectations is being achieved. What problems did the audit work identify? Based on our audit work, we determined that the Department did not fully implement our prior audit recommendation by its planned implementation date of June 30, 2025, and did not complete required subrecipient monitoring activities for its Disaster Grants program. Specifically, we found that the Department did update the risk assessment policies for the 2025 risk assessment and fully assessed risks for subrecipients for Fiscal Year 2025. However, there was one subrecipient that had not yet issued a finalized audit report and, therefore, the Department’s subrecipient monitoring process was pending completion. Why did these problems occur? Although the Department designated staff to obtain and review Single Audit reports for all of its subrecipients, Department staff stated that they were not able to complete their reviews of previously unreviewed Single Audit reports during Fiscal Year 2025, as letters were still being processed for execution and distribution under the updated policies. The Department also subsequently stated that some of these reviews were incomplete due to the subrecipients not yet finalizing their Single Audits with their auditors. Why do these problems matter? By failing to complete all of its reviews of subrecipients’ Single Audit reports, the Department is out of compliance with both federal requirements and with its policy to complete monitoring reviews for each subrecipient. This could result in the Department not timely identifying enforcement actions that may be needed against noncompliant subrecipients and then making revisions, as applicable, to its monitoring risk assessment for the subrecipient. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-046 The Department of Public Safety (Department) should continue to implement its subrecipient monitoring policy and ensure the Department is in compliance with federal regulations to review all subrecipients’ Single Audit reports in a timely manner. This should also include the Department completing its reviews of the subrecipients’ prior year’s Single Audit reports and issuing the management decision letters for those reports. Response Department of Public Safety Agree Implementation Date: June 2026 The Department will continue to follow the current Policy and Procedure related to the Single Audit reviews and has allocated an individual to review the Single Audits. This includes issuing a management decision letter if required, in accordance with the timeline established in federal guidance.

Program: AL 93.575 – COVID-19 Child Care and Development Block Grant – Period of Performance Grant Number & Year: 2101NECDC6, FFY 2021 Federal Grantor Agency: U.S. Department of Health and Human Services Criteria: Per 45 CFR § 98.60(d) (October 1, 2024): The following obligation and liquidation provisions apply to States and Territories: (1) Discretionary Fund allotments shall be obligated in the fiscal year in which funds are awarded or in the succeeding fiscal year. Unliquidated obligations as of the end of the succeeding fiscal year shall be liquidated within one year. Per the Federal Notice of Award for 2101NECDC6, “ARP CCDF Discretionary funds must be obligated by September 30, 2023, and liquidated by September 30, 2024.” A good internal control plan requires procedures to ensure compliance with Federal regulations. Condition: Expenditures were charged to the American Rescue Plan Act (ARPA) grant after the period of performance. A similar finding was noted in the prior audit. Repeat Finding: 2024-047 Questioned Costs: $2,829,758 known Statistical Sample: No Context: ARPA Child Care and Development Fund (CCDF) Discretionary funds must be obligated by September 30, 2023, and liquidated by September 30, 2024. Expenditures for the ARPA grant included two journal entries for claims originally paid with State funds from April 2024 through June 15, 2024. The claims were for the service period January 2024 through May 2024, which is after the obligation period. There was no obligation to pay these claims as of September 30, 2023, as services had not been provided. See Schedule of Findings and Questioned Costs for chart/table. Cause: The Agency had verbal discussions with the Federal grantor and believed, based on those discussions, that the expenditures were allowable. Effect: Noncompliance with Federal regulations. Recommendation: We recommend the Agency improve procedures to ensure expenditures charged are within the allowed time period. Management Response: The Agency disagrees. Federal Partners approved this process in writing, which was provided to the APA. These costs are allowable and in the federally allowed period for these grants. APA Response: To support its position, the Agency relies upon a cursory email response from its Federal Partners. That generic, one-sentence message lacked the detail necessary to address our finding. Additionally, an almost identical finding in the prior year’s audit required a management decision by the cognizant Federal agency per Title 2 CFR § 200.521(a); however, we have yet to receive it.

Program: AL 21.027 – COVID-19 – Coronavirus State and Local Fiscal Recovery Funds – Subrecipient Monitoring Grant Number & Year: SLFRP1965, March 3, 2021, through December 31, 2024 Federal Grantor Agency: U.S. Department of the Treasury Criteria: 2 CFR § 200.332 (January 1, 2024) states, in relevant part, the following: All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. * * * * (ii) Subrecipient’s unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date . . . . * * * * (x) Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; * * * * (5) A requirement that the subrecipient permit the pass-through entity and auditors to access the subrecipient’s records and financial statements for the pass-through entity to fulfill its monitoring requirements; and (6) Appropriate terms and conditions concerning the closeout of the subaward. * * * * (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the passthrough entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the passthrough entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward . . . . * * * * (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. 2 CFR § 200.318 (January 1, 2024) states, in relevant part, the following: (a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non-Federal entity’s documented procurement procedures must conform to the procurement standards identified in §§200.317 through 200.327. * * * * (i) The non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. 2 CFR § 180.300 (January 1, 2024) requires that the pass-through entity take specific steps to document that subrecipients are not suspended or debarred, as outlined below: When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM.gov Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. 2 CFR § 200.430(i) (January 1, 2024) states the following in relevant part: (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: * * * * (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities (for IHE, this per the IHE’s definition of IBS); * * * * (vii) Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (viii) Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards[.] Good internal controls and sound business practices require policies and procedures to ensure that adequate monitoring is performed to verify that subrecipients are using funds in accordance with all Federal and grant requirements. Condition: The State lacked procedures to ensure that: • Subrecipient use of funds was monitored to ensure compliance with all Federal and grant requirements. • Subrecipients obtained audits required by Federal requirements, and those audits were obtained and reviewed in a timely manner. Repeat Finding: No Questioned Costs: None Statistical Sample: No Context: The State paid $172,943,444 to subrecipients for 143 subawards during the fiscal year ended June 30, 2025. We selected 17 subrecipients to test. Additionally, we reviewed the single audit tracking procedures for all State agencies acting as pass-through entities. We noted the following: Insufficient Subrecipient Monitoring Procedures For 5 of 17 subawards tested, the APA noted that subrecipient monitoring was insufficient to ensure that the subrecipient complied with all Federal and grant requirements. Additionally, for one of the subawards tested, the APA noted that the pass-through entity did not have documentation on file to support it verified the subrecipient was not suspended or otherwise debarred. Deficiencies noted included the following: • One $86,650,000 subaward tested was issued by the Military Department (Military) to the University of Nebraska Board of Regents (University). During testing, the APA noted that the only monitoring performed by the Military was a review of the University’s single audit for fiscal year ended June 30, 2024. A total of $47,533,117 was paid to the University for the fiscal year ended June 30, 2025. • During our audit, we observed that for two subawards, one issued by the Department of Natural Resources (DNR) and one by the Department of Health and Human Services (DHHS), each valued at $2,000,000 for capital riverfront improvements and the construction of a youth activity center, respectively, significant disbursements were used to cover construction costs. However, neither pass-through entity could provide documentation supporting that subrecipient monitoring performed or planned included adequate procedures to ensure that the subrecipient had followed its written procurement policies, and procurement procedures were adequately documented. These subrecipients were paid $1,362,909 and $841,446, respectively, during the fiscal year ended June 30, 2025. • For one subaward tested, issued by the Department of Correctional Services (Corrections) for $1,505,826 to implement a transitional living and vocational skills program for former inmates, the APA did not observe any documentation supporting that Corrections had verified the subrecipient was not suspended or otherwise debarred from receiving Federal funds. Additionally, the APA noted that the subaward included significant costs for subrecipient payroll and benefit costs. For those salaried employees who had only a portion of their payroll coded to the grant, Corrections relied on budget estimates submitted at the beginning of the subaward to ensure the cost allocation was proper. The APA observed that six salaried employees had payroll costs coded to the grant, ranging from 2% - 98% of their total salaries. During the fiscal year ended June 30, 2025, the total paid to the subrecipient for this subaward was $204,302. • For one subaward issued by DHHS for $4,000,000 to be used towards increasing childcare license capacity, the APA noted that DHHS failed to perform the subrecipient monitoring procedures outlined in their monitoring policy. The monitoring policy for the subaward indicated that 10% of all expenses would be reviewed. DHHS claimed to have reviewed 10% of all reimbursements between July 2023 – April 2024; however, the APA observed $628,610 of reimbursed costs after April 2024, all of which was disbursed in August 2024 for which no review was performed. Additionally, the APA noted DHHS did not obtain appropriate documentation to support $387 of payroll costs coded to the grant. A total of $627,110 was paid to this subrecipient during the fiscal year ended June 30, 2025. Failure to Communicate all Required Subaward Information During our review of subrecipient monitoring, the APA noted that, for 4 of 17 subawards tested, the subaward did not contain all required information or contained erroneous information, as follows: • In two instances of subawards issued by DHHS, the subaward listed the Federal Award Identification Number (FAIN) as SLFRP3145; however, the primary CLSFRF award to the State of Nebraska was SLFRP1965, while the SLFRP3145 award merely passed through the State to various Non-Entitlement Units (NEU’s) in the State that were the primary recipients. • One subaward issued by DNR and one subaward issued by Corrections lacked required information, as noted below. Neither department could provide documentation showing that this information had otherwise been communicated to the subrecipient. See Schedule of Findings and Questioned Costs for chart/table. Single Audit Tracking Procedures During our review of single audit tracking procedures implemented by the State, we noted the following: • DNR and the Department of Labor (DOL) lacked procedures for determining if subrecipients were required to have a single audit or obtain and review such audits. DOL had 10 subrecipients who had received cumulative payments as of June 30, 2025, ranging from $1,000 to $318,669. DNR had 13 subrecipients that received cumulative payments as of June 30, 2025, ranging from $12,557 to $32,256,022. Three of DNR’s subrecipients have received payments over $750,000 as of June 30, 2025. In reviewing the Federal Audit Clearinghouse (FAC), two of these subrecipients had single audits for the subrecipients’ fiscal year 2024, which listed CSLFRF (ALN 21.027) as a major program and reported no findings. • During testing, the APA identified three instances of DHHS failing to obtain and review subrecipient single audits due to errors in that agency’s tracking procedures. The three subrecipients had received $2,209,137 in CSLFRF funds as of June 30, 2025. The APA obtained the fiscal year 2024 single audits for all three subrecipients from the FAC and noted that ALN 21.027 was listed as a major program on all three audits. None of the audits noted any program-related findings. Cause: Inadequate procedures to ensure that subrecipients complied with all Federal and grant requirements or to ensure that subrecipients obtained single audits when required. Effect: Without adequate monitoring and review procedures, there is an increased risk of Federal awards being used for unallowable costs. Recommendation: We recommend the State strengthen procedures to ensure that subrecipient monitoring is designed properly to ensure compliance with all Federal and grant requirements. We also recommend the State strengthen procedures to ensure that subrecipient single audit requirements are tracked properly, and all single audits are reviewed in a timely manner. Management Response: Military Department The Department of Military disagrees with this finding. The subrecipient submitted an independent audit on 4/1/2025. The independent auditor employed auditing standards generally accepted in the United States (GAAS). Major federal programs included COVID-19, Coronavirus State and Local Fiscal Recovery Funds, Assistance Listing Number 21.027. The independent auditor concluded there were no significant deficiencies or material weaknesses. The auditee was deemed “low risk.” In NEMA’s risk evaluation, it considers two separate University of Nebraska offices whose responsibility includes work to monitor and ensure compliance with Federal regulations. When determining risk appetite and risk tolerance, the “…cost of internal control should never exceed anticipated benefits. Thus, an entity must accept a certain level of risk.” Findings by the independent auditor and Auditor of Public Accounts exceed any benefit that might have been gained by additional subrecipient monitoring. In October 2025, the Agency formally adopted the Subrecipient Monitoring policy and procedure it has informally used the last several years. APA Response: 2 CFR § 200.332(d)(4) (January 1, 2024) requires pass-through entities to perform subrecipient monitoring, which includes obtaining and reviewing subrecipient Single Audit reports. Subsection (d)(4) of this regulation states: If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant audit agency or cognizant oversight agency to perform audit follow-up . . . . Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Department of Natural Resources While DNR conducted general subrecipient monitoring activities, documentation did not sufficiently demonstrate that monitoring procedures included a review of subrecipient procurement practices for compliance. DNR communicated the required federal award information to the subrecipient through other means, it was not consistently incorporated into the formal subaward agreement as required. While DNR does require Single Audits per their contracts, they did not have formalized, written procedures to consistently determine whether subrecipients met the Single Audit threshold, to ensure timely receipt and review of Single Audit reports when required. The Department acknowledges that documented procedures are necessary to ensure compliance with applicable federal regulations and to strengthen subrecipient oversight. Department of Health and Human Services Agency agrees with finding. Department of Correctional Services Management agrees with the finding.

Various Agencies Finding 2025 – 014: ALN 10.565, 10.568, and 10.569 – Food Distribution Cluster ALN 66.458 – Clean Water State Revolving Fund ALN 84.425C – COVID-19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID-19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID-19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID-19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID-19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID-19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, and 93.053 – Aging Cluster (including COVID-19) A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2024-015) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), 241PA445Q2204 (10/01/2023 – 9/30/2024), 238PA000I1003 (5/25/2023 – 6/30/2025), 251PA825Y8105 (10/01/2024 – 9/30/2025), 42000124-0-CS (7/01/2024 – 9/30/2026), 95324301-0-4C (7/01/2023 – 6/30/2023), 95325401-0-4X (7/01/2023 – 6/30/2030), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021 – 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PASTPH (1/01/2022 – 9/30/2025), 2301PAOACM (10/01/2022 – 9/30/2025), 2301PAOAHD (10/01/2022 – 9/30/2025), 2301PAOASS (10/01/2022 – 9/30/2025), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2501PAOASS (10/01/2024 – 9/30/2026), 2501PAOACM (10/01/2024 – 9/30/2026), 2501PAOAHD (10/01/2024 – 9/30/2026), 2501PAOANS (10/01/2024 – 9/30/2026) Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2025 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2024 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2025. We also evaluated the Commonwealth’s review of 47 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2025 and required management decisions by Commonwealth agencies. Finding 2025 – 014: (continued) Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have adequate procedures in place for tracking and making management decisions on findings timely. The time period for making management decisions on findings was approximately 13.4 months to over 19 months after the FAC acceptance date for four out of four audit reports with findings. For the four items selected for testing, PDOA had not completed SEFA reconciliations or performed alternative procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): The time period for making a management decision on findings was approximately eight months to over 15 months after the FAC acceptance date for four out of six audit reports with findings. There were also delays in PDA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. In addition, our testing disclosed that PDA subgranted federal funds of approximately $8.9 million to one subrecipient during fiscal year ended June 30, 2024, for which the Single Audit was not submitted to the FAC as of our February 2026 testing date. This was over 10 months after the March 31, 2025 due date. • Department of Education (PDE): The time period for making a management decision on findings was approximately 6.9 months to over 12 months after the FAC acceptance date for nine out of 30 audit reports with findings selected for testing. Three of the 30 audits reports were improperly classified on PDE’s audit tracking list as not having federal award findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Pennsylvania Infrastructure Investment Authority (PENNVEST): The time period for making a management decision on findings was over 15.9 months after the FAC acceptance date for one out of three audit reports with findings. For one out of three items selected for testing, PENNVEST had started but had not yet completed reconciling the SEFA to ensure the subrecipient SEFA was accurate so that major programs were properly determined and subject to audit. Criteria: 2 CFR Section 200.332, Requirements for pass-through entities, states in part: A pass-through entity must: (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (g) Verify that a subrecipient is audited as required by Subpart F [Audit Requirements] of this part. (h) Consider whether the results of a subrecipient’s audit, site visits, or other monitoring necessitate adjustments to the pass-through entity’s records. Finding 2025 – 014: (continued) (i) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR Section 200.512, Report submission, states in part: (a) General. (1) The audit, the data collection form, and the reporting package must be submitted within 30 calendar days after the auditee receives the auditor's report(s) or nine months after the end of the audit period (whichever is earlier). The cognizant agency for audit or oversight agency for audit (in the absence of a cognizant agency for audit) may authorize an extension when the nine-month timeframe would place an undue burden on the auditee. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR Section 200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments or take other action. (d) Time requirements. The Federal agency or pass-through entity responsible for issuing a management decision must do so within six months of the FAC’s acceptance of the audit report. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR Section 200.505, Remedies for audit noncompliance, states: In cases of continued inability or unwillingness of a non-federal entity to have an audit conducted in accordance with this part, Federal agencies or pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR Section 200.339, Remedies for noncompliance, states in part: The Federal agency or pass-through entity may implement specific conditions if the recipient or subrecipient fails to comply with the U.S. Constitution, Federal statutes, regulations, or terms and conditions of the Federal award. See §200.208 for additional information on specific conditions. When the Federal agency or pass-through entity determines that noncompliance cannot be remedied by imposing specific conditions, the Federal agency or pass-through entity may take one or more of the following actions: (a) Temporarily withhold payments until the recipient or subrecipient takes corrective action. (b) Disallow costs for all or part of the activity associated with the noncompliance of the recipient or subrecipient. (c) Suspend or terminate the Federal award in part or in its entirety. (d) Initiate suspension or debarment proceedings as authorized in 2 CFR Part 180 and the Federal agency’s regulations, or for pass-through entities, recommend suspension or debarment proceedings be initiated by the Federal agency. (e) Withhold further Federal funds (new awards or continuation funding) for the project or program. (f) Pursue other legally available remedies. Finding 2025 – 014: (continued) To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: a. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (7) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Finding 2025 – 014: (continued) Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Regarding the late and outstanding audit report submission, PDA did not take timely remedial action steps in accordance with 2 CFR Section 200.339 and Commonwealth Management Directive 325.08 in order to ensure compliance with federal audit submission requirements. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Finally, additional federal pass-through funds may be unaudited in the future without timely and effective remedial action from Commonwealth agencies to enforce compliance. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. Commonwealth agencies should promptly pursue outstanding audits and implement remedial action steps on a timely basis in accordance with 2 CFR Section 200.339 and Commonwealth Management Directive 325.08. PDA Response: PDA agrees with the finding. PDOA Response: PDOA agrees with the finding. PDE Response: PDE agrees with the finding. PENNVEST Response: PENNVEST agrees with the finding. Questioned Costs: The amount of questioned costs cannot be determined.

Department of Labor and Industry Finding 2025 – 009: ALN 93.558 – Temporary Assistance for Needy Families Department of Labor and Industry Did Not Perform Adequate Monitoring of Temporary Assistance for Needy Families Subrecipients (A Similar Condition Was Noted in Prior Year Finding 2024-009) Federal Grant Number(s) and Year(s): 2401PATANF (10/01/2023 – 9/30/2024), 2301PATANF (10/01/2022 – 9/30/2023), 2201PATANF (10/01/2021 – 9/30/2022), 2101PATANF (10/01/2020 – 9/30/2021) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Compliance Requirement: Subrecipient Monitoring Condition: During the fiscal year ended June 30, 2025, the Department of Labor and Industry (L&I) paid $26.9 million in Temporary Assistance for Needy Families (TANF) funding to 22 subrecipients within the Youth Employment and Training (E&T) appropriation (or 6.7 percent) out of total federal TANF expenditures of $403.4 million reported on the June 30, 2025 Schedule of Expenditures of Federal Awards (SEFA). Our testing of L&I’s during-the-award monitoring of subrecipients for the fiscal year ended June 30, 2025, disclosed that L&I did not conduct on-site monitoring or perform desk reviews of the TANF Youth Development Program (TANF YDP) for three out of five subrecipients selected for testing. Although L&I performed monitoring of these subrecipients specific to another federal program, the monitoring did not include a review of the performance of the subrecipients’ TANF YDP programs. The TANF YDP operations transitioned from the Bureau of Workforce Development Administration (BWDA) to the Bureau of Workforce Partnership and Operations (BWPO) in December 2023. During the fiscal year ended June 30, 2025, BWPO began onsite monitoring of the TANF YDP program on a limited basis by developing a pilot program that BWPO used to monitor the TANF YDP program for three subrecipients. BWPO developed a written TANF YDP Monitoring Plan that outlines plans to expand the monitoring to other TANF YDP subrecipients; however, the plan was not fully implemented as of June 30, 2025. Criteria: 2 CFR Section 200.332, Requirements for pass-through entities, states: A pass-through entity must: (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. Finding 2025 – 009: (continued) (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in §200.425. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: L&I recognized the need to perform during-the-award monitoring procedures for TANF funds passed through for the Youth E&T program, but the updated monitoring procedures were not fully incorporated during the fiscal year ended June 30, 2025. Effect: TANF subrecipients could be operating in noncompliance with federal regulations without timely detection and correction by L&I management. Recommendation: L&I should continue to strengthen controls to ensure during-the-award monitoring is being performed for all TANF subrecipients and that the monitoring includes procedures to ensure that subrecipients are in compliance with applicable federal regulations. This should include examining subrecipients’ financial records and ensuring that all required Single Audits were obtained by L&I subrecipients. Agency Response: L&I agrees with this finding. TANF YDP operations transitioned from BWDA to BWPO in January 2023. Due to this transition, BWPO did not conduct on site monitoring of the TANF YDP program in Program Year (PY) 22. BWPO did begin monitoring in PY 23 on a limited basis as a pilot with 3 local areas in September of 2024. BWPO expanded monitoring efforts in 2025 by conducting PY 24 TANF YDP monitoring in alignment with the WIOA Common Measures Data Validation cycle. This enhanced desk review monitoring effort concluded by January 2026. PY is defined as July 1st to June 30th. BWPO will further expand annual monitoring of TANF YDP in alignment with the requirement to monitor all TANF YDP grant subrecipients for PY 25 and moving forward. L&I does ensure single audits are obtained from the TANF YDP sub-recipients as a part of our single audit review. Finding 2025 – 009: (continued) Questioned Costs: The amount of questioned costs cannot be determined.

Department of Human Services Finding 2025 – 008: ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Department of Human Services’ Program Monitoring of the Social Services Block Grant Subrecipients (A Similar Condition Was Noted in Prior Year Finding 2024-008) Federal Grant Number(s) and Year(s): 2501PASOSR (10/01/2024 – 9/30/2026), 2401PASOSR (10/01/2023 – 9/30/2025) Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Compliance Requirements: Cash Management, Subrecipient Monitoring Condition: Our examination of the Department of Human Services’ (DHS) procedures for monitoring Social Services Block Grant (SSBG) subrecipients revealed that DHS did not adequately risk assess and monitor the SSBG Mental Health, Homeless Assistance, and Child Welfare subrecipients to ensure that SSBG awards are used in compliance with laws and regulations, which include allowable costs, period of performance, and other requirements. Although DHS performed risk assessments of these subrecipients, the risk assessments did not include a consideration of all of the items outlined in 2 CFR Section 200.332 (c) (1)-(4). Further, the risk assessments did not define the course of action to be taken for each assigned risk level. DHS program personnel indicated that they performed on-site monitoring of eight subrecipients with seven final monitoring reports issued and one report in progress. The remaining 67 subrecipients were not monitored during the audit period. Expenditures for Mental Health, Homeless Assistance, and Child Welfare subrecipient programs not monitored totaled $21.7 million (or approximately 23.2 percent) of total SSBG program expenditures of $93.6 million reported on the Schedule of Expenditures of Federal Awards (SEFA). While we noted that DHS monitored eight of the 75 Mental Health County/County Joinder subrecipients which included Mental Health, Homeless Assistance and Child Welfare services, this coverage was not adequate. In addition, our review of the risk assessments completed for all of the aforementioned subrecipients identified several instances where subrecipient monitoring was warranted but was not conducted, including several subrecipients assessed as high risk for which no monitoring procedures were performed. In addition, for the compliance requirement related to cash management, we noted that DHS advanced funds to SSBG subrecipients in four of nine program areas, representing $34.0 million (or approximately 36.3 percent) of SSBG program expenditures, without adequately monitoring the reasonableness of the subrecipient cash balances. In particular, for the program areas related to Mental Health, Intellectual Disabilities, Homeless Assistance, and Child Welfare, DHS advanced funds to subrecipients on a quarterly basis. Our inquiries with applicable DHS program administrators disclosed that DHS did not adequately monitor the four program areas’ subrecipients for cash management compliance either at the time of payment or at any other time during the fiscal year ended June 30, 2025. Furthermore, while Single Audits of SSBG subrecipients may be conducted each year, this auditing activity does not compensate for the lack of during-the-award program monitoring, since the timing, focus, and scope of subrecipient auditing activities after year end are different than compliance monitoring to be performed by program officials during the year. Criteria: 2 CFR Section 200.332, Requirements for pass-through entities, states: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: Finding 2025 – 008: (continued) (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Finding 2025 – 008: (continued) 2 CFR Section 200.305 (b)(1), applicable for recipients and subrecipients, states in part: …Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: DHS management indicated that risk assessment and monitoring documents were created for use during on-site monitoring of SSBG subrecipients. However, due to staffing issues, on-site monitoring was not performed for all SSBG subrecipients. Consistent with prior year audits, DHS management noted that there have been no changes to the payment methodology for the Homeless Assistance, Mental Health, Intellectual Disabilities, and Child Welfare components of SSBG. These programs provide subrecipients with advances to comply with Commonwealth law and also to ensure that adequate funds are available to provide services to participants on a timely basis. DHS officials believe that their in-house payment review procedures for the SSBG program are as efficient as administratively feasible and that controls exist in each of the program areas. Without on-site program monitoring visits by funding agency officials, we consider DHS’s limited in-house reviews of subrecipient status reports or other documents to be insufficient to detect potential subrecipient noncompliance, including excess cash violations. DHS does not adjust payments to the subrecipients based on in-house reviews. Effect: Since DHS does not adequately perform during-the-award monitoring of subrecipients, including the monitoring of subrecipient cash on hand, subrecipients may not be complying with applicable grant requirements and federal regulations, including cash management standards. Recommendation: DHS should perform risk based during-the-award monitoring procedures for all SSBG subrecipients to ensure timely compliance with all applicable federal regulations. On-site monitoring visits by state officials should be supported by documentation to show the monitoring performed, areas examined, conclusions reached, and that the monitoring was performed in compliance with applicable regulations. As recommended in previous Single Audits and supported by the United States Department of Health and Human Services, DHS should either consider changing their current subrecipient payment procedures from advancement basis to reimbursement basis or establish procedures to adequately monitor subrecipient cash on hand to ensure it is limited to immediate needs, but no longer than one month. The implementation and strengthening of these controls should provide DHS with reasonable assurance as to compliance with cash management requirements at the subrecipient level. Agency Response: DHS agrees with this finding. Questioned Costs: The amount of questioned costs cannot be determined.

Federal program: AL 21.027, COVID-19 Coronavirus State and Local Fiscal Recovery Funds; Federal agency: U.S. Department of Treasury; Award year: 2025; Criteria: Per the 2025 Office of Management and Budget (OMB) Compliance Supplement, part 4, requirement M, Subrecipient Monitoring, pass-through entities are required to perform monitoring of their subrecipients. This is further described in Uniform Guidance 2 CFR 200.332 which states "A pass-through entity must...(e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The passthrough entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports, (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the passthrough entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the passthrough entity as required by § 200.521. (4) Resolve audit findings specifically related to the subaward...".; Condition: Evidence was not retained of monitoring subrecipients’ financial and single audit reporting or of any follow up actions as a result of monitoring.; Cause: The cause appears to be attributable to a lack of consistently applied procedures for retention of data files supporting the performance of subrecipient monitoring. If the review was performed, it was retained within the employee’s emails and not through use of an ARPA/SLFRF shared folder. The employee performing the review is no longer with the County and the review documentation could not be located. It is undeterminable if this monitoring was performed.; Effect or potential effect: Without adequate review of the subrecipient’s financial and single audit reporting related to program expenditures incurred, the control environment, compliance with laws, regulations, and program requirements, errors or misappropriation of assets could exist without the County's knowledge.; Questioned costs: No known or estimated questioned costs identified.; Context: Out of a population of 14 subrecipients, six were selected for testing for which no evidence was retained indicating the County’s review of financial and single audit reporting of the subrecipients.; Repeat finding: No.; Recommendation: The County should develop and implement policies and procedures to ensure that all subrecipient monitoring is performed and retained.; Views of responsible officials: The County understands and concurs with the finding.

Finding 2025-001 Monitoring of Subrecipients Research and Development Cluster National Aeronautics and Space Administration (ALN 43.001) Grant Number: 80NSSC23K1013 Statistically Valid Sample: No, and it was not intended to be Prior Year Finding: Not a repeat finding. Finding Type: Significant Deficiency and Noncompliance Criteria: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subawards, and that the subaward performance goals are achieved, Accordingly, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure single audit reports are reviewed and completed in a timely manner, and management decisions are issued within required timeframes. Condition and Context: The Garden performs a comprehensive risk assessment for all subrecipients and has established monitoring procedures which are applied to each of their four subrecipients throughout the life of the grant. These procedures include a detailed review of invoices submitted for reimbursement by the subrecipient and communication with the subrecipient as needed throughout the year. While the Garden obtained a copy of the subrecipients’ single audit report during the initial risk assessment process, the Garden did not obtain or review the most recently issued single audit report for each subrecipient during 2025 to determine if there were any findings related to their federal awards which would require the Garden to issue a management decision on audit findings. Cause: Management had a control in place to obtain the subrecipient single audit reports upon entering into the subaward agreements. However, the control was not properly designed to obtain subrecipient single audit reports annually in the subsequent years the agreement was still in place.. Effect: Failure to obtain and review the subrecipient single audit reports in a timely manner may result in the Garden not being aware of a material noncompliance by a subrecipients and the Garden not documenting management’s decision timely in accordance with the guidance. Questioned Costs: No questioned costs were noted as a result of the audit procedures performed. Recommendation: We recommend the Garden establish procedures to ensure subrecipient single audit report are obtained and reviewed on an annual basis. In addition, the Garden should document whether a management decision was prepared or whether it is not required based on review of the findings, if any. Views of Responsible Officials: Management agrees with the finding. Subsequent to year end, Management has obtained and reviewed Single Audit filings for all its Subrecipients from the Federal Audit Clearinghouse. In their review of the Subrecipient Single Audit Reports, they did not note any findings related to its Federal programs. Management has implemented a control to continue to obtain and review the Single Audit filings for its Subrecipients on an annual basis.

(2025-071) Title: Internal control over DG – PA program subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 2 CFR 200.521 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow up and ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. The Department must issue a management decision for audit findings that relate to Federal awards provided to the subrecipient within 6 months of acceptance of the audit report by the Federal Audit Clearinghouse (FAC). Condition: The Maine Emergency Management Agency (MEMA) administers the Disaster Grants – Public Assistance (DG – PA) program for the State. MEMA is required to verify and document that Single Audits have been completed in the FAC and issue a management decision for audit findings related to awards to subrecipients. The Office of the State Auditor (OSA) tested 4 DG – PA program subrecipients subject to Single Audit requirements and found that documentation of review for 2 subrecipients could not be provided. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department expended $160.5 million in DG – PA program funds, of which $154.6 million was provided to 27 subrecipients. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients not complying with Federal statutes, regulations, or the terms and conditions of subawards may not be implementing appropriate corrective action in response to audit findings. Recommendation: We recommend that the Department enhance policies and procedures to ensure that adequate documentation is maintained and that subrecipient audits are received, reviewed, and appropriate action is taken in response to audit findings. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. The Department will publish and implement an updated subrecipient monitoring procedure to require more extensive and narrative documentation of the single audit review process, including: - a list of subrecipients required to file a single audit report for a given audit year - whether or not an audit had been filed as of the review date - analysis of audit findings as relevant - summary of required actions per the subrecipient monitoring procedure, and/or updates on actions/communications since the prior review period as relevant Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-05)

2025-002 – Subrecipient Monitoring – Internal Control and Compliance over Subrecipient Monitoring (Material Weakness) Identification of the Federal Program: Assistance Listing Number: 21.027 Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: Department of Treasury Pass-Through Entity: N/A Federal Award Number and Award Year: N/A Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): C.F.R. § 200.332 prescribes that the pass-through entity must conduct monitoring activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Passthrough entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. 3. Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. 4. The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. The City’s Subrecipient Monitoring Policy and Procedures, effective April 17, 2024, requires departments to monitor subrecipients to ensure compliance with Uniform Guidance. The policy requires that prior to award, the department shall evaluate the subrecipient’s risk of noncompliance with the Uniform Guidance, and the terms and conditions of the subaward, which risk assessment shall be documented, 2 CFR § 200.332(b). The policy also states that the City shall monitor subrecipients on a quarterly basis (90 days) throughout the term of the agreement (department should establish a regular monitoring schedule and document all monitoring), to ensure all subrecipients comply with the Uniform Guidance, that the subaward is used for authorized purposes, and that the subaward performance goals are achieved, as follows 2 CFR § 200.332(d):  Reviewing subrecipient’s financial and performance reports.  Ensuring subrecipients provide timely reports and information, as required by the federal awards.  Following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies as detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings.  Issuing a management decision on Audit Findings, as required by 2 CFR § 200.521 (Management Decision). Condition: During the review of subrecipient monitoring records, we tested all two (2) existing subrecipients during the fiscal year ended June 30, 2025, and noted the following:  The fully executed subrecipient agreements were not provided. One subrecipient agreement was executed via internal resolution and email approval; another subrecipient’s agreement does not have sufficient identification and award details, omitting key funding terminology.  The documentation of the review of Financial and Performance Reports, the Pre-Award Risk Assessments, or the performance of the required subrecipient monitoring procedures were not provided. Cause: These conditions resulted from staffing capacity constraints, which led to subrecipient monitoring procedures not being performed consistently since the implementation of the City’s new Monitoring Policy on April 17, 2024. Additionally, formal documentation processes were not fully established, resulting in informal approvals and incomplete documentation of Pre-Award Risk Assessments. Effect or Potential Effect: The City’s insufficient monitoring of the necessary subrecipient activities resulted to internal control and compliance requirement finding. Questioned Costs: None. Context: See condition above for context of the finding. Identification as a Repeat Finding, If Applicable: Yes. See prior year finding 2024-003. Recommendation: We recommended the City to fully implement its Monitoring Policy by formalizing subrecipient agreements, strengthening internal controls, and establishing consistent processes for documenting Pre-Award Risk Assessments and Financial and Performance Reports. Views of Responsible Officials: Management concurs.

2025-002 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D”) Sponsoring Agency: Various – All R&D awards with subrecipients from 1 campus Award Name: Various - All R&D awards with subrecipients from 1 campus Award Number: Various Assistance Listing Title: Various – All R&D awards with subrecipients from 1 campus Assistance Listing Number: Various - All R&D awards with subrecipients from 1 campus Award Year: 2024-2025 Pass-through entity: All pass-through awards for 1 campuses with subrecipients Criteria 2 CFR 200.332(e) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(g) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Condition Through testing of subrecipient monitoring activities across four campuses, we identified that one campus does not have a documented process to determine whether subrecipients obtained a Uniform Guidance audit, as required, nor a process to follow up on audit findings or issue management decisions when applicable, in accordance with 2 CFR 200.233(e) and (g). While the campus performs a detailed pre-award risk assessment prior to executing subaward agreements — which includes review of available Uniform Guidance audit reports — ongoing monitoring procedures do not consistently include a review of the most recent Uniform Guidance audit report during the period of performance. Subaward agreements at this campus are generally limited to one year; however, when agreements are continued without a formal renewal or monetary amendment, a subsequent risk assessment is not required. As a result, updated Uniform Guidance audit reports are not consistently obtained or reviewed to determine whether (1) the subrecipient met audit requirements, (2) findings exist that impact the federal program, and (3) a management decision is required. Specifically, of 25 subawards tested at this campus, 9 did not have evidence that the most recent Uniform Guidance audit report was obtained and reviewed during the award period. In instances where audit reports were reviewed, documentation indicates the review was performed for risk assessment purposes rather than to satisfy the ongoing monitoring and management decision requirements under 2 CFR 200.232(e) and (g). Cause The campus’ monitoring procedures rely on subrecipients to communicate applicable audit findings rather than requiring the campus to independently obtain and review the most recent Uniform Guidance audit reports on an annual basis. Although review of Uniform Guidance reports is incorporated into the prescribed subrecipient risk assessment process, the risk assessment is not consistently required throughout the period of performance. As a result, procedures do not ensure that updated audit reports are obtained, evaluated, and documented in accordance with the requirements of 2 CFR 200.233(e) and (g). Effect As a result of not performing and documenting an annual review of subrecipients’ Uniform Guidance audit reports, the campus may not identify audit findings that impact its federal programs or ensure that appropriate follow-up and management decisions are issued within the required timeframe. This increases the risk of noncompliance with 2 CFR 200.233(e) and (g) and may result in unaddressed deficiencies or questioned costs related to federal awards. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the campus revise its subrecipient monitoring policies and procedures to require the timely review of subrecipients’ Uniform Guidance audit reports throughout the period of performance. Procedures should ensure that audit reports are reviewed at least annually to (1) determine whether the subrecipient met audit requirements, (2) identify findings that impact the campus’ federal programs, and (3) document follow-up actions and issuance of management decisions, as required by 2 CFR 200.233(e) and (g). Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings.

Reference Number: 2025-002 Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds Federal Assistance Listing Number: 21.027 Federal Agency: U.S. Department of Treasury Pass-Through Entity: N/A Federal Award Number and Year: Fiscal Year 2024-25 Name of Department with Finding: Department of Consumer and Business Affairs Name of Departments with No Findings: Chief Executive Office Aging and Disabilities Executive Office of the Board of Supervisors Department of Public Health Department of Economic Opportunity Internal Services Justice Care and Opportunities Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance; Instance of Noncompliance Criteria In accordance with Title 2 U.S. Code of Federal Regulations (CFR) § 200.332(c)(e)(f), all pass-through entities must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Condition During our audit of the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program, we selected twenty one (21) subrecipients with active contracts with the County during FY 2024-25. We noted that the Department of Consumer and Business Affairs (DCBA) did not perform subrecipient monitoring for four (4) contracts administered by the department, of which one (1) contract did not have a risk assessment performed during FY 2024-25. In addition, we selected two (2) subrecipients with total expenditures of $19,217,030 that were subjected to subrecipient monitoring compliance requirements; however, it was determined that the selected subrecipients were vendors and inadvertently included in the subrecipient population. In the SEFA, the passed through to subrecipients column for this grant was reduced by $19,217,030 to reflect this correction. This is a repeat finding of 2024-002 as it relates to the subrecipient monitoring portion of the Condition. Cause Due to limited resources, the department needed more time to complete risk assessment, monitor the CSLFRF subrecipients and document the reviews in accordance with subrecipient monitoring requirements. Effect Failure to document risk assessment and monitoring results is noncompliance with the subrecipient monitoring requirements 2 CFR § 200.332 (c)(e)(f). Questioned Costs Questioned costs were not determinable. Context Of the twenty one (21) subrecipients selected for testing, which totaled $192,086,158, from a population of ninety-seven (97) subrecipients with expenditures totaling $282,469,393, the department did not perform an annual risk assessment for one (1) subrecipient and they did not have documentary evidence supporting the monitoring of four (4) subrecipients with expenditures totaling $5,917,341. However, the department retained copies of the subrecipients’ single audit reports. The misclassification of vendors was corrected by removing them from the subrecipient expenditures, which decreased subrecipient expenditures from $301,686,423 to $282,469,393. DCBA had 7 subrecipients with total expenditures of $99,128,273 out of the total of 97 subrecipients with total expenditures of $282,469,393. The sample was not a statistically valid sample. Recommendation We recommend the County perform risk assessments and monitor the activities of its subrecipients as necessary to ensure that subawards are used for authorized purposes and maintain appropriate records for monitoring subrecipients in accordance with subrecipient monitoring requirements set forth in 2 CFR § 200.332 (c)(e)(f).

2025-004 SUBRECIPIENT MONITORING – WOIA (REPEATED) Funding agency: U.S. Department of Labor Title: Workforce Investment Act Cluster ALN Number: 17.258, 17.259, 17.278 Type of Finding: Significant Deficiency in Internal Control over Compliance; Other Non-compliance Compliance Area: Subrecipient Monitoring Award Year: Program Year 2023-2024 Question Costs: None Condition During prior year audit testing, we noted that the Department had been behind on performing monitoring controls such as quarterly desk reviews, annual on-site evaluations, and remote reviewing and testing of cost documentation. The Department had not completed fiscal or programmatic monitoring relating to Program Year 2023-2024 activity for any of its subrecipients. Due to staffing vacancies at the beginning of the fiscal year, as of January 2024, the Department had fallen approximately 2 years behind. By the beginning of fiscal year 2025, they had just completed Program Year 2022-2023 monitoring, and were thus out of compliance for a portion of the current year under audit. During the fiscal year, the Department made significant progress towards corrective action in compliance and controls over compliance for Subrecipient Monitoring over the WIOA program. Fiscal and programmatic monitoring for Program Year 2024 was substantially complete around June of 2025. We also noted that risk assessments are now being performed by the Department, rather than as selfassessments by the subrecipients. As a result of these improvements, we have lowered the type of finding from a Material Weakness to a Significant Deficiency in internal control over compliance, and from Material Non-Compliance to Other Non-Compliance. Criteria §200.332 Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the passthrough entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 Management Decision. Effect The lack of internal controls over this compliance requirement provides an opportunity for federal grant noncompliance at the subrecipient level. For monitoring controls to be wholly effective, they must be performed timely. Potential costs outside the scope of work as well as overall effective project management at the subrecipient level. There is higher risk of material misstatement, fraud, noncompliance, or errors. Cause The Department had previously not established internal controls and procedures over financial grant management to ensure compliance with applicable compliance requirements. The Department had experienced staffing turnover during prior years. These causes have since been rectified

FINDING 2024-003 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Subrecipient Monitoring Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): SLFRP1096 Compliance Requirement: Subrecipient Monitoring Audit Finding: Material Weakness INDIANA STATE BOARD OF ACCOUNTS 19 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Condition and Context Subrecipients associated with the City's Non-profit, Affordable Housing, and Homeless Initiatives activities funded by the COVID-19 - Coronavirus State and Local Fiscal Recovery Funds were required to submit reports on program activities either quarterly or monthly. The City did not have adequate internal controls in place designed to ensure that these reports were reviewed. Responsibility for reviewing these reports rested primarily with one employee. For two of three subrecipients tested, we were not able to determine that there was a second employee involved that would ensure that the reports submitted by the subrecipients were reviewed by the City. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states: "All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and include the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward notification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; INDIANA STATE BOARD OF ACCOUNTS 20 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the passthrough entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the passthrough entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports. (4) (i) An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the passthrough entity must determine the appropriate rate in collaboration with the subrecipient, which is either: (A) The negotiated indirect cost rate between the pass-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass through entity is not required to collect information justifying this rate, but may elect to do so; (B) The de minimis indirect cost rate. (ii) The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). INDIANA STATE BOARD OF ACCOUNTS 21 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and (6) Appropriate terms and conditions concerning closeout of the subaward. . . . (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. INDIANA STATE BOARD OF ACCOUNTS 22 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program related matters; and (2) Performing on-site reviews of the subrecipient's program operations. (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 of this part and in program regulations." Cause A system of internal controls to include oversite and review of the quarterly or monthly reports prepared by the subrecipients was not in place. One individual was primarily responsible for reviewing the subrecipient reports. Effect Not having procedures in place for oversite and review of the monitoring reports could lead to noncompliance with the requirements for subrecipient monitoring. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the City. INDIANA STATE BOARD OF ACCOUNTS 23 CITY OF ANDERSON SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the City establish a proper system of internal controls to include oversite and review to ensure that the subrecipient report reviews are reviewed/approved by a second party. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Noncompliance with Subrecipient Monitoring Requirements and Material Weakness in Internal Control over Subrecipient Monitoring Assistance Listing Number: 21.027 Name of Federal Program or Cluster: COVID-19: Coronavirus State and Local Fiscal Recovery Funds Name of Federal Agency: Department of Treasury Name of Pass-Through Entities: State of Wisconsin Department of Administration Subrecipient Monitoring 2 CFR§200.332 requirements for pass-through entities: The Code of Federal Regulations (CFR) Section 200.332(e) requires a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. 2 CFR§200.303 requires the Organization to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The organization did not perform subrecipient monitoring procedures as listed in the criteria above for the subrecipient of the COVID-19: Coronavirus State and Local Fiscal Recovery Funds. In addition, the Organization’s internal controls over subrecipient monitoring did not prevent or detect noncompliance with subrecipient monitoring requirements. The Organization did, however, confirm with SAM.gov that the subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal Funds; included the required information in the subaward agreement, and performed the required risk assessment. The Organization has policies and procedures related to subrecipient monitoring in its fiscal procedures manual. However, management did not monitor to ensure that the requirements listed in its policies and procedures manual as well as the Uniform Guidance are being followed. Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Recommendation: We recommend that Organization management monitor their compliance with their subrecipient monitoring procedures to ensure that the required subrecipient monitoring is occurring. No WRTP has reviewed the organization’s fiscal policy manual including all subsections regarding monitoring responsibilities. Additional training has been provided and completed by management and staff. Management has reviewed all monitoring with the subrecipient in good faith efforts.

Noncompliance with Subrecipient Monitoring Requirements and Material Weakness in Internal Control over Subrecipient Monitoring Assistance Listing Number: 21.027 Name of Federal Program or Cluster: COVID-19: Coronavirus State and Local Fiscal Recovery Funds Name of Federal Agency: Department of Treasury Name of Pass-Through Entities: State of Wisconsin Department of Administration Subrecipient Monitoring 2 CFR§200.332 requirements for pass-through entities: The Code of Federal Regulations (CFR) Section 200.332(e) requires a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. 2 CFR§200.303 requires the Organization to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The organization did not perform subrecipient monitoring procedures as listed in the criteria above for the subrecipient of the COVID-19: Coronavirus State and Local Fiscal Recovery Funds. In addition, the Organization’s internal controls over subrecipient monitoring did not prevent or detect noncompliance with subrecipient monitoring requirements. The Organization did, however, confirm with SAM.gov that the subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal Funds; included the required information in the subaward agreement, and performed the required risk assessment. The Organization has policies and procedures related to subrecipient monitoring in its fiscal procedures manual. However, management did not monitor to ensure that the requirements listed in its policies and procedures manual as well as the Uniform Guidance are being followed. Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Recommendation: We recommend that Organization management monitor their compliance with their subrecipient monitoring procedures to ensure that the required subrecipient monitoring is occurring. No WRTP has reviewed the organization’s fiscal policy manual including all subsections regarding monitoring responsibilities. Additional training has been provided and completed by management and staff. Management has reviewed all monitoring with the subrecipient in good faith efforts.

Noncompliance with Subrecipient Monitoring Requirements and Material Weakness in Internal Control over Subrecipient Monitoring Assistance Listing Number: 21.027 Name of Federal Program or Cluster: COVID-19: Coronavirus State and Local Fiscal Recovery Funds Name of Federal Agency: Department of Treasury Name of Pass-Through Entities: State of Wisconsin Department of Administration Subrecipient Monitoring 2 CFR§200.332 requirements for pass-through entities: The Code of Federal Regulations (CFR) Section 200.332(e) requires a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. 2 CFR§200.303 requires the Organization to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The organization did not perform subrecipient monitoring procedures as listed in the criteria above for the subrecipient of the COVID-19: Coronavirus State and Local Fiscal Recovery Funds. In addition, the Organization’s internal controls over subrecipient monitoring did not prevent or detect noncompliance with subrecipient monitoring requirements. The Organization did, however, confirm with SAM.gov that the subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal Funds; included the required information in the subaward agreement, and performed the required risk assessment. The Organization has policies and procedures related to subrecipient monitoring in its fiscal procedures manual. However, management did not monitor to ensure that the requirements listed in its policies and procedures manual as well as the Uniform Guidance are being followed. Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Recommendation: We recommend that Organization management monitor their compliance with their subrecipient monitoring procedures to ensure that the required subrecipient monitoring is occurring. No WRTP has reviewed the organization’s fiscal policy manual including all subsections regarding monitoring responsibilities. Additional training has been provided and completed by management and staff. Management has reviewed all monitoring with the subrecipient in good faith efforts.

2024-001: Subrecipient Monitoring Criteria: The Code of Federal Regulations 2 CFR 200.332 states that all pass-through entities (PTE) must: Identify the Award and Applicable Requirements - Clearly identify to the subrecipient: (1) the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.331(a)(1); (2)all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.331(a)(3)). Evaluate Risk - Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). Monitor - Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: (1) Reviewing financial and programmatic (performance and special reports) required by the PTE. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Condition: The Organization did not clearly communicate the required federal award information and applicable requirements to the subrecipients. The Organization did not evaluate the risk of non-compliance of the subrecipients in order to identify the appropriate monitoring procedures. Cause: The Organization has not implemented policies or procedures, to the degree necessary, to ensure that federal award monitoring compliance requirements are being met. Effect: The Organization did not perform adequate monitoring procedures on the subrecipients. Without communication of required information, subrecipients may overspend award amounts or incur unallowable expenses towards the grant. Questioned Costs: N/A Statistical Sampling: Statistical sampling was not used in making sample selections. Recommendation: We recommend that management of the Organization implement policies, procedures, and internal controls to evaluate the subrecipient risk of noncompliance to ensure subrecipients are being appropriately monitored in compliance with federal regulations. Views of Responsible Officials: Management agrees with this finding and their response is included in the corrective action plan.

Finding No. 2024-002 – Subrecipient Monitoring | Identification of the Program: | Program Name: Research and Development Cluster: Basic Scientific Research, Department of Defense Awarding Office, 12.431; NSF Technology, Innovation and Partnerships, National Science Foundation, 47.084 | Criteria or Specific Requirements (Including Statutory, Regulatory, or Other Citations): 2 CFR 200.303 requires that a non-Federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” According to page 3-M-1 of the 2024 OMB Compliance Supplement, management is responsible for monitoring activities designed to evaluate subrecipient risk as required by the terms and conditions of the award. Such activities include: reviewing financial reports; following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies detected through audits, on-site reviews, and other; issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. | Section III— Federal Award Findings and Questioned Costs (continued) | Condition: During our testing of 2024 subrecipient monitoring activities, we selected five subrecipients for testing noting that there was no evidence of management’s evaluation of each subrecipient or management’s review of the specific monitoring procedures performed. Through inquiry, management acknowledged that they complete an evaluation form for each subrecipient prior to contracting with the subrecipient although an evaluation of the risk of the subrecipient is not included on the form. Management also informed us that they review all expenditures and related supporting documentation provided by the subrecipient prior to paying their invoices, although evidence of performing such a review is not documented. | Cause: Internal controls over the review and approval of the subrecipient monitoring were not effective. | Effect or Potential Effect: This could result in granting subawards to and paying subrecipients who are of higher risk for compliance and/or subrecipients who have not been properly monitored to ensure they are complying with the grant terms. | Questioned Costs: None. | Context: As the sample size is small, we selected 5 subrecipients for testing out of a total of 5 subrecipients. | Identification as a Repeat Finding: N/A – This is a first year Uniform Guidance audit.

Subrecipient Monitoring Federal Department – U.S. Department of Justice Pass-through Illinois Criminal Justice Information Authority Federal Award Identification Number and Year: 15JOVW-21-GG-00543-STOP and 2021 15JOVW-22-GG-00422-STOP and 2022 Violence Against Women Formula Grants, Federal Assistance Listing #16.588 County Department – State’s Attorney Office Finding 2024 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4)Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. CONDITION During the current audit period, the Cook County State’s Attorney Office (SAO) did not adequately comply with its subrecipient monitoring requirements as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding was an inadequate understanding of sub-recipient monitoring policies and best practices. While the Department believed at the time that they were in compliance with the applicable monitoring requirements, they now recognize that their efforts did not fully meet the necessary standards. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in the inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of two (2) subrecipients (of a population of 4 subrecipients), we noted the following:  For both subrecipients, we noted documentation was not maintained to support SAO’s evaluation of the subrecipients’ risk of noncompliance and the frequency of monitoring to be conducted by SAO based on the assessed risk.  We also noted for both subrecipients, no documentation was provided to verify whether the subrecipients were required to have a Single Audit conducted, including SAO’s review of the report, and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.332e(3).  The SAO utilized a “Subrecipient Monitoring Checklist” (Checklist) to conduct and document its monitoring of subrecipients. Based on review, we noted the Checklist does not include evidence of who completed the monitoring, the date the actual monitoring was performed nor the subrecipient personnel with whom the monitoring results were discussed during the site visit. Also, the Checklist appears to be inaccurately completed. Specifically, we noted the Checklist noted that the results include expected corrective actions and dates for resolution. However, there was no finding or issues noted in the formal letter submitted to the subrecipient(s) after the site visit(s). IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend SAO implement procedures to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance and review of the Single audit report, as required by Federal regulations. Also, we suggest that the Checklist be accurately prepared and updated to include evidence of who completed the monitoring, the date the actual monitoring was performed, and the subrecipient personnel with whom the monitoring results were discussed during the site visit. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 38-39.

Subrecipient Monitoring Federal Department – U.S. Department of Justice Pass-through Illinois Criminal Justice Information Authority Federal Award Identification Number and Year: 15JOVW-21-GG-00543-STOP and 2021 15JOVW-22-GG-00422-STOP and 2022 Violence Against Women Formula Grants, Federal Assistance Listing #16.588 County Department – State’s Attorney Office Finding 2024 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4)Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. CONDITION During the current audit period, the Cook County State’s Attorney Office (SAO) did not adequately comply with its subrecipient monitoring requirements as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding was an inadequate understanding of sub-recipient monitoring policies and best practices. While the Department believed at the time that they were in compliance with the applicable monitoring requirements, they now recognize that their efforts did not fully meet the necessary standards. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in the inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of two (2) subrecipients (of a population of 4 subrecipients), we noted the following:  For both subrecipients, we noted documentation was not maintained to support SAO’s evaluation of the subrecipients’ risk of noncompliance and the frequency of monitoring to be conducted by SAO based on the assessed risk.  We also noted for both subrecipients, no documentation was provided to verify whether the subrecipients were required to have a Single Audit conducted, including SAO’s review of the report, and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.332e(3).  The SAO utilized a “Subrecipient Monitoring Checklist” (Checklist) to conduct and document its monitoring of subrecipients. Based on review, we noted the Checklist does not include evidence of who completed the monitoring, the date the actual monitoring was performed nor the subrecipient personnel with whom the monitoring results were discussed during the site visit. Also, the Checklist appears to be inaccurately completed. Specifically, we noted the Checklist noted that the results include expected corrective actions and dates for resolution. However, there was no finding or issues noted in the formal letter submitted to the subrecipient(s) after the site visit(s). IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend SAO implement procedures to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance and review of the Single audit report, as required by Federal regulations. Also, we suggest that the Checklist be accurately prepared and updated to include evidence of who completed the monitoring, the date the actual monitoring was performed, and the subrecipient personnel with whom the monitoring results were discussed during the site visit. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 38-39.

FINDING 2024-028 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Subrecipient Monitoring - Subrecipient Audits See Schedule of Findings and Questioned Costs for chart/table. Condition LEO, MSF, and EGLE did not properly monitor their subrecipients to ensure they complied with the Uniform Guidance. We noted: a. LEO and MSF did not have a process to identify or document if their subrecipients required a single audit. Therefore, LEO and MSF did not monitor these subrecipients to ensure the status or submission of their single audit reports and did not determine whether a management decision letter was needed. b. EGLE did not identify or document if its subrecipients required a single audit for 8 (67%) of 12 sampled subrecipients. We reviewed the federal audit clearinghouse (FAC) and noted 2 of the 8 subrecipients had single audit reports submitted to the FAC in fiscal year 2024. Criteria Federal regulation 2 CFR 200.501 requires nonfederal entities who expend $750,000 or more in federal awards during their fiscal year to obtain a single audit for that fiscal year. Also, federal regulation 2 CFR 200.332(f) requires the pass-through entity to verify these subrecipients are audited as required by Subpart F of the Uniform Guidance, Audit Requirements, when it is expected the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the $750,000 threshold. In addition, federal regulation 2 CFR 200.521(d) requires the pass-through entity to issue a management decision letter on the appropriateness of all audit findings related to its federal awards and the subrecipient's corrective action plan within six months of acceptance by the FAC. Cause For part a., LEO indicated because of limited staff resources it did not have a process in place to monitor subrecipient single audits. MSF indicated it believes its current process was sufficient because it requires the subrecipients to notify MSF upon completion of their single audits. For part b., EGLE informed us due to an increase in subrecipients and division of responsibilities, not all CSLFRF subrecipients were tracked for single audits. Effect LEO, MSF, and EGLE limited the State's assurance their subrecipients complied with grant requirements and implemented corrective actions for audit findings to prevent future sanctions or disallowed costs, which could necessitate adjustments to their records. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend LEO, MSF, and EGLE properly monitor their subrecipients to ensure they comply with the Uniform Guidance. Management Views For part a., LEO agrees with the finding. All three of MSF's subrecipient awards for the fiscal year were sampled totaling approximately $274,000 (0.3 percent of the total award). While MSF agrees with the finding that it did not have a written process to verify single audit compliance, management believes that MSF's risk assessment of subrecipients adequately determined that single audit verification was not required for two of its subrecipients since, based on all anticipated federal awards for the subrecipient, it was not expected that they would reach the expenditure threshold (2 CFR 200.332(f)). The third annually files a single audit, was expected to file a single audit, and did file a single audit. For part b., EGLE agrees with the finding. Auditor's Comments to Management Views Regarding part a., MSF acknowledges it does not have a process to identify or document its review of subrecipient single audit reports. MSF did not provide documentation to support the award period or the amount of the subaward to these three subrecipients. Regardless of the amount of the subaward, federal regulation 2 CFR 200.501 indicates the $750,000 threshold is based on the subrecipient's total federal expenditures for all federal programs during its fiscal year and not based on a specific program's subaward amounts or expenditures. Also, MSF did not review the single audit report submitted to the FAC and determine if it was necessary to issue a management decision letter for audit findings affecting the subawards it issued to the subrecipient. Therefore, the finding stands as written.

Finding Number: 2024-008 Prior Year Finding Number: 2023-015 Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of the Treasury COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Year: 10/01/2021 – 09/20/2024 Government Department/Agency: Office of the Deputy Mayor for Public Safety and Justice (DMPSJ); Office of Neighborhood Safety and Engagement (ONSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with the Uniform Guidance in 2 CFR Section 200.331(a) Requirements for Pass-Through Entities requires that pass-through entities must: Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information outlined in the section noted above, pre-award assessment, indirect cost rated for the award, assistance listing number, finding and award follow-up and other pertinent actions. In accordance with the Uniform Guidance in 2 CFR Section 200.332 Requirements for Pass-Through Entities requires that pass-through entities Verify that the subrecipient is not excluded or disqualified in accordance with Section 180.300. Verification methods are provided in Section 180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. In accordance with the Uniform Guidance in 2 CFR Section 200.332(e) Requirements for Pass-Through Entities requires that pass-through entities must: Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: • Review financial and performance reports • Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. • Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200.521. • Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section Section 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Condition – The program’s documented subrecipient monitoring requirements includes risk assessments, monitoring of subrecipients and the submission and review of monthly financial and performance reports. During our testing of the subrecipient’s compliance requirements, we noted the following issues: • Our testing of the program’s subrecipient monitoring requirements includes submission and review of monthly financial and performance reports. We noted for one (1) out of 17 samples, the subrecipient failed to submit their monthly financial and performance reports. • For one (1) out of 17 samples, the agency had no evidence to support it had performed the mandatory follow up on reported audit findings in the subrecipient’s audit report for the Corrective Action taken by the subrecipient to remediate the finding. • For one (1) out of 17 samples, the agency had no evidence that a debarment check was performed before the contract was entered into. The agency’s documented policies and the procurement procedures mandate a debarment check before entering into new contracts. Questioned Costs – Not determinable. Context – This is a condition identified per review of various District agencies’ compliance with specified monitoring requirements on the program’s subrecipients using a statistically valid sample. Effect – Subrecipients may not be properly monitored, which may result in subawards being used for unauthorized purposes in violation of the terms and conditions of the subawards or that the subaward performance goals were not achieved. Cause – There is lack of sufficient documentary evidence to support that the controls are operating as designed related to subrecipient monitoring compliance. Recommendation – We recommend that the agencies maintain sufficient documentation to evidence its internal controls over the risk assessment and monitoring of subrecipients. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – While DMPSJ doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. ONSE acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section. BDO’s Response – We have reviewed management’s response and our finding remains as indicated.

FINDING 2024-028 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Subrecipient Monitoring - Subrecipient Audits See Schedule of Findings and Questioned Costs for chart/table. Condition LEO, MSF, and EGLE did not properly monitor their subrecipients to ensure they complied with the Uniform Guidance. We noted: a. LEO and MSF did not have a process to identify or document if their subrecipients required a single audit. Therefore, LEO and MSF did not monitor these subrecipients to ensure the status or submission of their single audit reports and did not determine whether a management decision letter was needed. b. EGLE did not identify or document if its subrecipients required a single audit for 8 (67%) of 12 sampled subrecipients. We reviewed the federal audit clearinghouse (FAC) and noted 2 of the 8 subrecipients had single audit reports submitted to the FAC in fiscal year 2024. Criteria Federal regulation 2 CFR 200.501 requires nonfederal entities who expend $750,000 or more in federal awards during their fiscal year to obtain a single audit for that fiscal year. Also, federal regulation 2 CFR 200.332(f) requires the pass-through entity to verify these subrecipients are audited as required by Subpart F of the Uniform Guidance, Audit Requirements, when it is expected the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the $750,000 threshold. In addition, federal regulation 2 CFR 200.521(d) requires the pass-through entity to issue a management decision letter on the appropriateness of all audit findings related to its federal awards and the subrecipient's corrective action plan within six months of acceptance by the FAC. Cause For part a., LEO indicated because of limited staff resources it did not have a process in place to monitor subrecipient single audits. MSF indicated it believes its current process was sufficient because it requires the subrecipients to notify MSF upon completion of their single audits. For part b., EGLE informed us due to an increase in subrecipients and division of responsibilities, not all CSLFRF subrecipients were tracked for single audits. Effect LEO, MSF, and EGLE limited the State's assurance their subrecipients complied with grant requirements and implemented corrective actions for audit findings to prevent future sanctions or disallowed costs, which could necessitate adjustments to their records. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend LEO, MSF, and EGLE properly monitor their subrecipients to ensure they comply with the Uniform Guidance. Management Views For part a., LEO agrees with the finding. All three of MSF's subrecipient awards for the fiscal year were sampled totaling approximately $274,000 (0.3 percent of the total award). While MSF agrees with the finding that it did not have a written process to verify single audit compliance, management believes that MSF's risk assessment of subrecipients adequately determined that single audit verification was not required for two of its subrecipients since, based on all anticipated federal awards for the subrecipient, it was not expected that they would reach the expenditure threshold (2 CFR 200.332(f)). The third annually files a single audit, was expected to file a single audit, and did file a single audit. For part b., EGLE agrees with the finding. Auditor's Comments to Management Views Regarding part a., MSF acknowledges it does not have a process to identify or document its review of subrecipient single audit reports. MSF did not provide documentation to support the award period or the amount of the subaward to these three subrecipients. Regardless of the amount of the subaward, federal regulation 2 CFR 200.501 indicates the $750,000 threshold is based on the subrecipient's total federal expenditures for all federal programs during its fiscal year and not based on a specific program's subaward amounts or expenditures. Also, MSF did not review the single audit report submitted to the FAC and determine if it was necessary to issue a management decision letter for audit findings affecting the subawards it issued to the subrecipient. Therefore, the finding stands as written.

Finding Number: 2024-008 Prior Year Finding Number: 2023-015 Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of the Treasury COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Year: 10/01/2021 – 09/20/2024 Government Department/Agency: Office of the Deputy Mayor for Public Safety and Justice (DMPSJ); Office of Neighborhood Safety and Engagement (ONSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with the Uniform Guidance in 2 CFR Section 200.331(a) Requirements for Pass-Through Entities requires that pass-through entities must: Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information outlined in the section noted above, pre-award assessment, indirect cost rated for the award, assistance listing number, finding and award follow-up and other pertinent actions. In accordance with the Uniform Guidance in 2 CFR Section 200.332 Requirements for Pass-Through Entities requires that pass-through entities Verify that the subrecipient is not excluded or disqualified in accordance with Section 180.300. Verification methods are provided in Section 180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. In accordance with the Uniform Guidance in 2 CFR Section 200.332(e) Requirements for Pass-Through Entities requires that pass-through entities must: Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: • Review financial and performance reports • Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. • Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200.521. • Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section Section 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Condition – The program’s documented subrecipient monitoring requirements includes risk assessments, monitoring of subrecipients and the submission and review of monthly financial and performance reports. During our testing of the subrecipient’s compliance requirements, we noted the following issues: • Our testing of the program’s subrecipient monitoring requirements includes submission and review of monthly financial and performance reports. We noted for one (1) out of 17 samples, the subrecipient failed to submit their monthly financial and performance reports. • For one (1) out of 17 samples, the agency had no evidence to support it had performed the mandatory follow up on reported audit findings in the subrecipient’s audit report for the Corrective Action taken by the subrecipient to remediate the finding. • For one (1) out of 17 samples, the agency had no evidence that a debarment check was performed before the contract was entered into. The agency’s documented policies and the procurement procedures mandate a debarment check before entering into new contracts. Questioned Costs – Not determinable. Context – This is a condition identified per review of various District agencies’ compliance with specified monitoring requirements on the program’s subrecipients using a statistically valid sample. Effect – Subrecipients may not be properly monitored, which may result in subawards being used for unauthorized purposes in violation of the terms and conditions of the subawards or that the subaward performance goals were not achieved. Cause – There is lack of sufficient documentary evidence to support that the controls are operating as designed related to subrecipient monitoring compliance. Recommendation – We recommend that the agencies maintain sufficient documentation to evidence its internal controls over the risk assessment and monitoring of subrecipients. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – While DMPSJ doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. ONSE acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section. BDO’s Response – We have reviewed management’s response and our finding remains as indicated.

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings

2024-001 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D Cluster”) Grantor: Various - All R&D Cluster awards with subrecipients Award Name: Various - All R&D Cluster awards with subrecipients Award Year: FY2024 Assistance Listing Number: Various – All R&D Cluster awards with subrecipients Pass-through entities and ID Number: Various - All R&D Cluster awards with subrecipients Condition The University has a detailed pre-award risk assessment process prior to entering into a subrecipient relationship, which includes review of subrecipient Uniform Guidance reports. Subsequent review of Uniform Guidance reports for monitoring purposes is completed at the time of a subaward amendment. However, subawards are not always amended within a year, which creates a potential gap in review. In the FY2023 audit, 4 out of the 25 subaward selections did not have a Uniform Guidance report review or other monitoring review during the year, which resulted in a reportable finding. In FY2024, in response to the FY2023 finding in subrecipient monitoring (2023-001), the University implemented an annual Post-Award review of all subrecipient Uniform Guidance reports. This review documented the report information, findings noted, and follow-up performed with the subrecipient, as necessary. However, this consolidated review was deemed to be incomplete, as 1 of the 25 subrecipient selections was not included in the Post-Award review of all subrecipient Uniform Guidance reports. Management subsequently reviewed the completeness of the consolidated review, and determined a total of 12 subrecipients were not monitored in FY2024. Criteria 2 CFR 200.332(d) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(f) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Cause In compiling the consolidated analysis of all subrecipients with active funding during the fiscal year, the Post-Award team utilized reporting of subrecipient expenditures from the general ledger. This report inadvertently omitted a period of time during the fiscal year, which caused omission of select subrecipients from the consolidated Post-Award analysis. Effect The lack of an annual review of subrecipient Uniform Guidance reports may result in potential compliance issues not being identified and management not addressing findings and issuing a management decision, as required under the Uniform Guidance. Questioned Costs There are no questioned costs associated with this finding. Through audit procedures, there was no evidence of non-compliance from subrecipients. Recommendation We recommend the University address the completeness of their consolidated subrecipient monitoring through review of the reports used to compile the analysis. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings