City of CambridgeLocal Government

Finding Number: 2025-001 Program: Community Development Block Grant (CDBG) ALN #: 14.218 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2024–June 30, 2025 Compliance Requirement: Performance Reporting Type of finding: Material weakness and noncompliance Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No.109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department (CDBG) did not report awards granted to subrecipients for the CDBG program by the end of the month following the month in which the City awarded the subrecipient award. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. Cause The condition found was due to the City not reporting amounts passed through to subrecipients for the period from July 2024 to June 2025 within the required time after the award is granted to the subrecipient. Proper perspective During our testing of the three selected subawards, we noted reporting exceptions as subawards were not reported within the one month following the month that the City awarded the subrecipient contract. Additionally, there was a control exception to ensure that the data submitted is complete and accurate.Possible asserted effect Failure to submit subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government. Questioned costs None noted Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2024-002 Recommendation We recommend that the City continue to review and enhance their policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards, as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of responsible officials and corrective actions The City will continue strengthening its policies, procedures, and internal controls to ensure all subawards are reported in full compliance with FFATA. The City reported subawards using the subaward obligation date, which is the date the agreement is fully executed, rather than the July 1 performance start date. As a result, obligation dates varied depending on when each agreement is signed.

Finding Number: 2025-002 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2024 – June 30, 2025 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City has not implemented the designed controls and procedures to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated and level of monitoring is determined. • Appropriate monitoring and review of the subrecipient based on their risk of noncompliance. • Ensure that subrecipients are not suspended or debarred prior to entering into a contract with the City. Cause The City does not have formal written policies, procedures, and internal controls in place to ensure that all required subrecipient monitoring procedures are performed.Proper perspective During our audit, we noted that four of the four subrecipients selected for testing did not have a completed risk assessment to determine their risk of noncompliance. As such, we were unable to determine that the proper level of monitoring was completed throughout the fiscal year over the contracted subrecipient. Additionally, there was no evidence that the City ensured the subrecipient was not suspended or debarred from working under a federal engagement prior to entering into the contract. Possible asserted effect Lack of effective controls over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2024-003 Recommendation We recommend the City establish a checklist or formal documentation to assess each subrecipient and their risk of non compliance prior to entering into a formal contract. The City should then use this risk assessment to determine the level of monitoring that is required throughout the term of the contract. Views of responsible officials and corrective actions The City has established a Risk Assessment tool that rates each HOPWA subrecipient across nine factors: 1) award amount, 2) timeliness of reporting, 3) timeliness of invoicing, 4) quality of reporting, 5) program complexity, 6) staff capacity, 7) staff turnover, 8) management changes, and 9) grantee history. The City will use this tool to determine the appropriate level and frequency of monitoring for each subrecipient.

Finding Number: 2025-003 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2024–June 30, 2025 Compliance Requirement: Reporting Type of finding: Material weakness and noncompliance Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No.109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department did not report awards granted to subrecipients for the HOPWA program by the end of the month following the month in which the City awarded the subrecipient award. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. Cause The condition found was due to the City not reporting amounts passed through to subrecipients for the period from July 2024 to June 2025 within the required time after the award is granted to the subrecipient. Proper perspective During our testing of four selected subawards, we noted reporting exceptions as subawards were not reported within the one month following the month that the City awarded the subrecipient contract. Additionally, there was a control exception to ensure that the data submitted is complete and accurate. Possible asserted effect Failure to submit subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2024-004 Recommendation We recommend that the City continue to review and enhance their policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards, as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of responsible officials and corrective actions The City will continue strengthening its policies, procedures, and internal controls to ensure all subawards are reported in full compliance with FFATA. The City reported subawards using the subaward obligation date, which is the date the agreement is fully executed, rather than the July 1 performance start date. As a result, obligation dates var depending on when each agreement is signed.

Finding Number: 2025-004 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2024–June 30, 2025 Compliance Requirement: Performance Reporting Type of finding: Material weakness and material noncompliance Criteria Performance Reporting for the HOPWA Consolidated Annual Performance and Evaluation Report Per HUD, the Consolidated Annual Performance and Evaluation Report (CAPER) provides annual performance reporting on client outputs and outcomes that enables an assessment of grantee performance in achieving the housing stability outcome measure. The CAPER fulfills statutory and regulatory program reporting requirements and provides the grantee and HUD with the necessary information to assess the overall program performance and accomplishments against planned goals and objectives. Both HOPWA formula and competitive grantees submitting reports after January 1, 2023, must complete and submit the HUD-4155 “Consolidated APR/CAPER” (OMB number 2506-0133). HOPWA Formula Grantees that accept the supplemental funding authorized under the CARES Act should report on the use of supplemental grant funds in the same performance report as their use of entitlement funds. Both formula and competitive grantees are required to submit their completed HUD-4155 no later than 90 days after the close of their program or operating year. Competitive grantees have 120 days after the end of their grant’s last period of performance to submit the final HUD-4155. Grantees should be able to demonstrate that funds disbursed through federal financial systems are traceable in local accounts and accurately reported in Key Line Items in the HUD-4155. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • CAPER report is submitted to HUD within 90 days of the end of the 12-month program year. • Review of subrecipient’s CAPER to ensure complete and accurate reporting over key line items. Cause Subrecipients are required to submit their individual CAPER reports to the City prior to the City submitting its report to HUD. The City has had difficulty in getting the subrecipients to comply with the CAPER reporting, which is primarily due to staffing issues at the subrecipients. As a result, the City did not submit its CAPER to HUD within the required time-frame. Proper perspective The City failed to submit the CAPER that covers the period from July 1, 2023 to June 30, 2024 to HUD by the September 30, 2024 deadline. The City ultimately submitted the CAPER on February 28, 2025. Additionally, for four of four subrecipients selected for testing, the City was unable to provide documentation that the subrecipients’ CAPER reconciled to the Integrated Disbursement and Information System (IDIS) or the City’s general ledger system. Possible asserted effect Incomplete or inaccurate information from its subrecipients has resulted in the City’s inability to properly comply with HUD’s CAPER reporting requirements. Questioned costs Not determinable Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2024-005 Recommendation We recommend that the City establish policies, procedures, and internal controls to ensure that all subrecipient CAPER reports are reconciled to the IDIS system and submitted to HUD within 90 days of year-end. Views of responsible officials and corrective actions The Audit, while investigating FY25 programs and activities, assessed the FY24 HOPWA CAPER, which was delivered to HUD past its due date. For the FY25 CAPER, a submission by nature of general reporting timelines occurs in FY26, was completed by the grantees on time and submitted to the City on time, including certain specific revisions and corrections, and was delivered to and accepted by HUD by the required submission deadline. The City expects future CAPERs to be submitted in a timely manner as grantees successfully adapted to the new Excel based reporting format.

Finding Number: 2025-005 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2024–June 30, 2025 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have effective controls in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated and level of monitoring is determined. • Verification and review that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. • All required elements of the subrecipient contracts are included during execution. Cause The City’s lack of effective internal controls which caused the following noncompliance and control exceptions.Proper perspective During the audit, we noted that six of the nine subrecipient selections did not contain all the required elements of the contract. Additionally, for nine of the nine selections, the City did not complete a risk assessment or conclude on the subrecipient's risk of noncompliance. We also noted that for two of the subrecipients that required a single audit, there was no evidence to support the nature and extent of the City's review of those audit reports. Therefore, we were unable to determine, based on the subrecipient's risk assessment and single audit reports, the proper level of monitoring procedures to be performed. Possible asserted effect Lack of effective controls over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding Yes, 2024-009 Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining and reviewing the documentation. The City should then conclude on and document the subrecipient’s risk of noncompliance based on the checklist to ensure the proper level of monitoring occurs throughout the year. Views of responsible officials and corrective actions The city already established a well-designed internal control manual of policies and procedures over the ARPA grant's full cycle grant management, as well as various templates to evaluate the subrecipients' risks and monitoring their performances. In FY26, the city will implement its internal control by conducting timely subrecipient monitoring activities with signed documents

Program: Community Development Block Grant (CDBG) ALN #: 14.218 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Performance Reporting Type of finding: Material weakness and noncompliance Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No.109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department (CDBG) did not report awards granted to subrecipients for the CDBG program by the end of the month following the month in which the City awarded the subrecipient award. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. Cause The condition found was due to the City not reporting amounts passed through to subrecipients for the period from July 2023 to June 2024, as the City typically reports these on a one-year lag due to the timing of when the contract starts and its final execution. Proper perspective During our testing of the three selected subawards, we noted reporting exceptions as subawards were not reported within the one month following the month that the City awarded the subrecipient contract. Additionally, there was a control exception to ensure that the data submitted is complete and accurate. Possible asserted effect Failure to submit subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government. Questioned costs None noted Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding A similar finding was not reported in the prior year. Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards, as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of responsible officials and corrective actions The City has taken several steps to strengthen its FFATA compliance. Historically, FFATA reporting posed challenges for many recipients, including the City, due to legacy reporting systems that did not fully align with the requirements of SAM.gov. As part of its compliance improvement efforts, the City has transitioned to directly reporting subaward data in SAM.gov. This shift necessitated a thorough review of internal processes, particularly because many of the City's subrecipient contracts are designed to begin on July 1 of each fiscal year but are not fully executed until months later, after the HUD-signed grant agreement is received, which generally occurs between late September and November. These timing discrepancies previously made it difficult to consistently identify and use the correct obligation date for FFATA reporting. The Federal Grants team initially used a manual Excel-based system to compile FFATA data from fully executed contracts. Each contract contains the essential elements required for FFATA reporting, including the Assistance Listing (CFDA) number, the City's and subrecipient's UEI numbers, agency name and address, award amount, and a brief program description. This spreadsheet served as the foundation for reporting subawards in SAM.gov. To address these issues, the City has established an updated standardized data collection and tracking mechanism. In response to this audit finding, the City has implemented the following corrective actions: 1.Standardized Data Collection: An updated subrecipient data collection form has been developed to ensure consistent and complete capture of all required FFATA elements prior to contract execution. 2.Formal Tracking System: The City created a FFATA Tracking Spreadsheet to systematically document and monitor all required reporting elements, including the correct obligation date, which is now tied to the legal execution date of the subaward. 3.Policy and Procedure Development: FFATA reporting policy and procedures have been developed to codify roles, timelines, and compliance responsibilities. This includes guidance on identifying the proper obligation date, data verification steps, and the timeline for submission to SAM.gov (within 30 days of obligation). 4.Staff Training and Oversight: Relevant staff will be trained on FFATA compliance requirements, and the Grants Management Division will conduct quarterly spot checks to ensure accuracy and timeliness of reporting. These corrective actions reflect the City's commitment to strengthening its federal grant oversight and ensuring full compliance with FFATA regulations.

Finding Number: 2024-003 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Appropriate monitoring of the subrecipient based on their risk of noncompliance. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. Cause The City does not have formal written policies, procedures, and internal controls in place to ensure that all required subrecipient monitoring procedures are performed. Proper perspective During our audit, we noted that four of the four subrecipients selected for testing did not have a completed risk assessment to determine their risk of noncompliance. As such, we were unable to determine that the proper level of monitoring was completed throughout the fiscal year over the contracted subrecipient. Additionally, we noted that the audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the reports obtained. Possible asserted effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-005 Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining and reviewing the documentation. The City should then conclude on and document the subrecipient’s risk of noncompliance based on the checklist to ensure the proper level of monitoring occurs throughout the year. Views of responsible officials and corrective actions The City has addressed this recommendation. The City has updated policies and procedures in place. A standardized Subrecipient Audit Risk Assessment Checklist is in place and a Monitoring Risk Assessment Checklist has also been developed and implemented to guide and document the evaluation of subrecipient risk, review of single audit reports, monitoring. Federal Grants Division staff will complete this checklist during the initial subrecipient review and update it annually. This will ensure consistent documentation of each subrecipient's risk level and corresponding compliance requirements. The process will enable the City to make informed decisions regarding the appropriate level of monitoring for each subrecipient, based on the risk assessment outcomes. This systematic approach enhances accountability, supports audit readiness, and aligns with federal guidance under 2 CFR Part 200. All the agencies/subrecipients have been informed of the upcoming monitoring.

Finding Number: 2024-004 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Reporting Type of finding: Material weakness and noncompliance Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No.109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department did not report awards granted to subrecipients for the HOPWA program by the end of the month following the month in which the City awarded the subrecipient award. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. Cause The condition found was due to the City not reporting amounts passed through to subrecipients for the period from July 2023 to June 2024, as the City typically reports these on a one-year lag due to the timing of when the contract starts and its final execution. Proper perspective During our testing of four selected subawards, we noted reporting exceptions as subawards were not reported within the one month following the month that the City awarded the subrecipient contract. Additionally, there was a control exception to ensure that the data submitted is complete and accurate. Possible asserted effect Failure to submit subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-006 Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards, as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of responsible officials and corrective actions The City has taken several steps to strengthen its FFATA compliance. Historically, FFATA reporting posed challenges for many recipients, including the City, due to legacy reporting systems that did not fully align with the requirements of SAM.gov. As part of its compliance improvement efforts, the City has transitioned to directly reporting subaward data in SAM.gov. This shift necessitated a thorough review of internal processes, particularly because many of the City's subrecipient contracts are designed to begin on July 1 of each fiscal year but are not fully executed until months later, after the HUD-signed grant agreement is received, which generally occurs between late September and November. These timing discrepancies previously made it difficult to consistently identify and use the correct obligation date for FFATA reporting. The Federal Grants team initially used a manual Excel-based system to compile FFATA data from fully executed contracts. Each contract contains the essential elements required for FFATA reporting, including the Assistance Listing (CFDA) number, the City's and subrecipient's UEI numbers, agency name and address, award amount, and a brief program description. This spreadsheet served as the foundation for reporting subawards in SAM.gov. In response to this audit finding, the City has implemented the following corrective actions: 1.Standardized Data Collection: A subrecipient data collection form has been developed to ensure consistent and complete capture of all required FFATA elements prior to contract execution. 2.Formal Tracking System: The City created a FFATA Tracking Spreadsheet to systematically document and monitor all required reporting elements, including the correct obligation date, which is now tied to the legal execution date of the subaward.

Finding Number: 2024-005 Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Pass-through Entity: N/A- Direct Award Federal Agency: Department of Housing and Urban Development Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Performance Reporting Type of finding: Material weakness and material noncompliance Criteria Performance Reporting for the HOPWA Consolidated Annual Performance and Evaluation Report Per HUD, the Consolidated Annual Performance and Evaluation Report (CAPER) provides annual performance reporting on client outputs and outcomes that enables an assessment of grantee performance in achieving the housing stability outcome measure. The CAPER fulfills statutory and regulatory program reporting requirements and provides the grantee and HUD with the necessary information to assess the overall program performance and accomplishments against planned goals and objectives. Both HOPWA formula and competitive grantees submitting reports after January 1, 2023, must complete and submit the HUD-4155 “Consolidated APR/CAPER” (OMB number 2506-0133). HOPWA Formula Grantees that accept the supplemental funding authorized under the CARES Act should report on the use of supplemental grant funds in the same performance report as their use of entitlement funds. Both formula and competitive grantees are required to submit their completed HUD-4155 no later than 90 days after the close of their program or operating year. Competitive grantees have 120 days after the end of their grant’s last period of performance to submit the final HUD-4155. Grantees should be able to demonstrate that funds disbursed through federal financial systems are traceable in local accounts and accurately reported in Key Line Items in the HUD-4155. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • CAPER report is submitted to HUD within 90 days of the end of the 12-month program year. • Review of subrecipient’s CAPER to ensure complete and accurate reporting over key line items. Cause Subrecipients are required to submit their individual CAPER reports to the City prior to the City submitting its report to HUD. The City has had difficulty in getting the subrecipients to comply with the CAPER reporting, which is primarily due to staffing issues at the subrecipients. As a result, the City did not submit its CAPER to HUD within the required time-frame. Proper perspective The City failed to submit the CAPER that covers the period from July 1, 2022 to June 30, 2023 to HUD by the September 30, 2023 deadline. The City ultimately submitted the CAPER on May 3, 2024. Additionally, the City has been unable to provide documentation that the subrecipients’ CAPER has been reconciled to the Integrated Disbursement and Information System (IDIS). Possible asserted effect Incomplete or inaccurate information from its subrecipients has resulted in the City’s inability to properly comply with HUD’s CAPER reporting requirements. Questioned costs Not determinable Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-007 Recommendation We recommend that the City establish policies, procedures, and internal controls to ensure that all subrecipient CAPER reports are reconciled to the IDIS system and submitted to HUD within 90 days of year-end. Views of responsible officials and corrective actions The City will continue to work with all agencies receiving HOPWA to complete their annual CAPER correctly and in a timely manner. This emphasis will be reiterated throughout the awarding process and will be subject to regular status updates to ensure compliance and accuracy. Further, the City will work with HUD to establish a correct methodology in reporting consistency with IDIS, as the annual CAPER and HOPWA contracts do not operate open uniform timelines, nor do they involve consistent financial reporting structures. The City does not believe the simple and direct correlation to IDIS is a reasonable or useful metric for the CAPER, but acknowledges that there should be a consistent standard that can be reconciled to financial activity during the year covered by each CAPER.

Finding Number: 2024-006 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Allowability Type of finding: Material weakness and noncompliance Criteria Per the activities allowed or unallowed requirement within Part 4 of the Compliance Supplement, recipients may use payments from CSLFRF to: 1. Respond to the public health and negative economic impacts of the pandemic, by supporting the health of communities, and helping households, small businesses, impacted industries, and the public sector recover from economic impacts of the pandemic. 2. Replace lost public sector revenue to provide government services; recipients may use this funding to provide government services to the extent of the reduction in revenue experienced due to the pandemic. 3. Provide premium pay for essential workers, offering additional support to those who have borne and will bear the greatest health risks because of their service in critical infrastructure sectors; and 4. Invest in water, sewer, and broadband infrastructure, making necessary investments to improve access to clean drinking water, support, vital wastewater and storm water infrastructure, and to expand access to broadband internet. For beneficiary payments (expenditures), evaluate whether the entity's records identify the individual or group as eligible to receive beneficiary payments for the applicable period. Additionally, according to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City set specific requirements for small businesses to be eligible to receive beneficiary payments under the CSLFRF program. Businesses were required to submit an application to the City with supporting documentation to confirm they were eligible for the payment. One of the requirements to be eligible is that the business must show a loss between the years of 2019 and 2021. We noted during our testing that the City awarded beneficiary payments to businesses that did not meet this requirements set by the City. We noted 3 exceptions from a sample selection of 40. Cause Due to improper review and approval, the City approved three business applications to receive a beneficiary payment that were ineligible. Proper perspective During our testing, we noted that 3 of 40 selections did not meet the eligibility criteria to be awarded a beneficiary payment. One exception showed a business loss in 2022, which is outside the period of the program requirements to submit loss documentation (2019-2021). One additional exception relates to a businesses showing an increase in sales/revenue for the 2021-2022 years. The City was unable to provide documentation that this business had a loss in either 2019 or 2020. The last exception relates to an individual that was awarded a small business grant where the business nor the individual is domiciled in Cambridge. As such, the City should not have approved these businesses for payment when reviewing their applications. Possible asserted effect Approving businesses that are not eligible to receive a beneficiary payment could cause the City to be charging the grant unallowable costs. Questioned costs $13,500 Statistical sampling That same was not intended to be, and was not, a statistically valid sample. Repeat finding A similar finding was not reported in the prior year. Recommendation We recommend the City review applications to ensure only eligible businesses are approved to receive beneficiary payments. Views of responsible officials and corrective actions The City has implemented additional controls over the review of all applicant information related to program funds being disbursed only to eligible applicants.

Finding Number: 2024-007 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Awar Year: July 1, 2023–June 30, 2024 Compliance Requirement: Procurement Type of finding: Material weakness and noncompliance Criteria Recipients may use awarded funds to enter into contracts to procure goods and services necessary to implement one or more of the eligible purposes outlined in 42 USC sections 802(c) and 803(c) and Treasury’s 2021 Interim Final Rule, and 2022 Final Rule, and 2023 Interim Final Rule. Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.327. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition For three of seven selections, we noted that the City did not follow the proper procurement policies as outlined in the Massachusetts General Law Chapter 30B. One exception related to a vendor that had cumulative expenditures greater than $10,000 in FY24. This vendor did not have a related contract for these expenditures and therefore the City did not follow procurement policies. Two additional exceptions relate to sole-source procurements with contract values greater than $50,000. Per Chapter 30B, sole-source procurements of more the $50,000 cannot be completed unless the contract relates to software maintenance, library books, and educational materials. These contracts did not relate to any of the beforementioned categories. Additionally, the City did not have documentation to show that a reasonable services. As such, a sole-source procurement method was not in compliance with Chapter 30B of the Massachusetts General Law. Cause The nature and reason for the noncompliance is attributed to oversight error on the City's part for not entering into contracts/maintaining procurement documentation appropriately. The City enters into hundreds of contracts annually funded with the ARPA program, all of which are manually reviewed. Therefore, it is likely that human error caused the noncompliance. Proper perspective The City’s policy is to follow the Massachusetts General Law Chapter 30B when procuring goods and services. Out of a sample size of seven, we noted that three of the vendors were not properly procured, as described in the conditions found. Possible asserted effect Not following the proper procurement policies, as outlined in Chapter 30B, could cause the City to inappropriately award a contract to a vendor. Questioned costs None noted Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding A similar finding was not reported in the prior year. Recommendation We recommend the City to review the procurement policies and ensure that expenditures for vendors that exceed $10,000 follow the correct procurement policies and procedures. Additionally, sole source bids require the City to follow certain policies and procedures. Views of responsible officials and corrective actions The City has updated its procurement process in FY2025 to ensure that expenditures for vendors that exceed $10,000 and sole source contracts follow the correct procurement policies and procedures in accordance with MGL 30B. investigation occurred that showed only one, or all vendors contracted with, could provide the required

Finding Number: 2024-008 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Suspension and Debarment Type of finding: Material weakness and noncompliance Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Additionally, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have formal policies and procedures for ensuring vendors are not suspended or debarred prior to entering into a contract. However, when establishing contracts for vendors under the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. Additionally, the City requires the program staff check the System of Award Management (SAM) to ensure the vendor is not suspended or debarred from working under a federal contract. If neither of the beforementioned methods are used, the City will require the vendor to submit a self-certification to ensure they are not suspended or debarred. Throughout our testing, we noted the required contract language was not included within all vendor contracts. Additionally, there was no evidence that city verified the vendor on SAM.gov, or that there was a self-certification included as part of the contracting process. Cause The City requires that standard contract language be included in all vendor contracts that addresses the suspension and debarment requirements. The City was unaware that the required language was excluded from vendor contracts entered into for the CSLFRF program. There was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City did not retain any documentation that they checked SAM.gov prior to entering into a control with a vendor. Proper perspective During our audit, we noted five of nine vendors selected for testing did not contain language in the contract regarding suspension and debarment, as evidenced via review of the subrecipient contracts. Additionally, it was communicated to us that the City checked SAM.gov for each vendor’s status, however, they were not able to provide evidence that this occurred. During compliance testing, it was confirmed all subrecipients, except for two, were not suspended or debarred. The engagement team was unable to determine if Margaret Fuller Neighborhood House and Smartcat Platforms Inc. was suspended or debarred as they are not registered with SAM.gov. Possible asserted effect Lack of formal review of subrecipient contracts and review of entities on SAM.gov could result in the City entering into contracts with prohibited entities. Questions costs None noted Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat finding Yes, 2023-008 Recommendation We recommend the City set formal policies and procedures around ensuring vendors are not suspended or debarred. Documented policies and procedures would ensure that required language is included within all vendor contracts prior to execution and that SAM.gov is checked and documentation is retained. Views of responsible officials and corrective actions The City has taken actions to ensure that the “Suspension and Debarment” clause or vendor selfcertification confirmation statement has been added to the FY2025 contract and grant agreements. Additionally, City staff has adopted a new sign-off process to document the City's staff review of the vendors status in “SAM.gov”.

Finding Number: 2024-009 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Pass-through Entity: N/A- Direct Award Federal Agency: U.S. Department of Treasury Federal Award Year: July 1, 2023–June 30, 2024 Compliance Requirement: Subrecipient Monitoring Type of finding: Material weakness and material noncompliance Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. • All required elements of the subrecipient contracts are included during execution. Cause The City’s lack of effective internal controls and written policies and procedures have caused the following Proper perspective During the audit, we noted that eight of the nine subrecipient selections did not contain all the required elements of the contract. Additionally, nine of the nine selections completed a risk assessment questionnaire. However, there is no indication that the City reviewed the questionnaires and subsequently concluded on the subrecipient’s risk of noncompliance. We also noted that audited financial statements were obtained for the three subrecipients that required a single audit, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Therefore, we were unable to determine if, based on the subrecipient’s risk assessment questionnaire and single audit report, if additional monitoring procedures were required Possible asserted effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned costs None Statistical sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding Yes, 2023-009 Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining and reviewing the documentation. The City should then conclude on and document the subrecipient’s risk of noncompliance based on the checklist to ensure the proper level of monitoring occurs throughout the year. Views of responsible officials and corrective actions The City has implemented additional controls over subrecipient monitoring by establishing a formal policy to review and document subrecipient qualifications, risk assessments and financial reports and have created subsequent monitoring plans and checklists. noncompliance and control exceptions.

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Suspension and Debarment Type of finding: Significant deficiency Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure that nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Also, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition When establishing contracts for subrecipients under the Emergency Solutions Grant Program (ESG), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. During fiscal year 2023, the required contract language was not included within the subrecipient contracts executed for the ESG program. Additionally, the City’s policy is to check the System of Award Management (SAM) to verify that its subrecipients were not suspended or debarred. During our audit, we noted one of four subrecipients selected for testing were not checked for suspension and debarment as evidenced via review of the subrecipient contracts or through SAM documentation. During compliance testing for the subrecipients, it was confirmed they were not suspended or debarred. Cause The City requires that standard contract language be included in all of its subrecipient contracts and that the City reviews SAM to address suspension and debarment requirements. The City was unaware that the required language was excluded from subrecipient contracts entered into for the ESG program as there was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City requires that program personnel review SAM.gov to ensure the subrecipient is not suspended or debarred. There was no documentation that this review had occurred prior to entering into a contract with the subrecipient. Effect Lack of formal review of subrecipient contracts and review of entities on SAM could result in the City entering into contracts with prohibited entities. Questioned Costs None Recommendation We recommend the City ensure that required language is included within all subrecipient contracts prior to execution. We also recommend that the City review that subrecipients are not included on the SAM exclusion list and retain documentation of that check and review prior to entering into contracts with subrecipients. Views of Responsible Officials and Corrective Actions Based on the finding in the prior year audit, the City updated the subrecipient contract template in spring 2023 prior to execution of contracts for the FY24 ESG program year and will continue to utilize the updated template to ensure required language certifying that the agency, its officers, and employees are not suspended or debarred from doing business with the federal government. Staff will continue to verify that subrecipients are not suspended or debarred by checking against the Sam.gov Exclusion List and registration pages prior to executing contracts, and will document those checks through grant management meeting minutes and Smartsheet tracking. Implementation Date Updates to the contract template were completed in spring 2023 and updated contract template was utilized for FY24 program year beginning July 1, 2023 and will be utilized for FY25 ESG program year beginning July 1, 2024. Documentation from the Sam.gov website showing that all ESG subrecipients are in good standing will be included in each subrecipient file for the FY25 program year, with anticipated completion of June 30, 2024. Responsible Officials Anthony Woods, Planner and Contract Manager, and Liz Mengers, Planning and Development Manager

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Special Tests; Payments to Subrecipients Type of finding: Material Weakness and Material noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria According to 24 CFR section 576.203, a recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s complete payment request. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s ESG Program has a control in place to ensure that invoice cover sheets (i.e., reimbursement requests) are reviewed in a timely manner so that the City can subsequently reimburse subrecipients within 30 days and remain in compliance with the requirement. However, the control to ensure timely payments to subrecipients was not operating effectively as payments to 8 of 19 subrecipients tested had payment dates that ranged from 15 and 255, subsequent to the subrecipient’s completed request for payment. Cause The City did not have effective controls in place to ensure subrecipients were paid for allowable costs within 30 days after receiving the subrecipient’s completed payment request. Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203. Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203. Questioned Costs None Recommendation We recommend the City establish effective controls to ensure payment requests received from subrecipients are paid within 30 days of receipt. Views of Responsible Officials and Corrective Actions Based on prior year (FY22) findings, the City established the following procedures to ensure payment requests received from subrecipients are paid within 30 days of receipt of a complete request for reimbursement: 1. Department of Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203.Human Service Programs (DHSP) Contract Manager reviews invoices within 5 business days of receipt of request for reimbursement from subrecipient. a. If invoice is complete, original date of receipt is recorded. b. If invoice is incomplete, subrecipient is notified of items or documentation that is missing and receipt date is updated to reflect date of receipt of complete invoice. 2. Contract Manager approves payment request and submits to DHSP Fiscal staff for processing. 3. Fiscal staff processes and submits to Auditing Department as Priority payment. Four of the 19 sampled payment requests were received or processed after receipt of the FY22 audit findings, and all of those requests for reimbursement were paid within 30 days receipt. Implementation Date Implementation of the above process began with the FY23 3rd quarter invoices in April 2023. Responsible Officials Anthony Woods, Planner and Contract Manager; Liz Mengers, DHSP Planning and Development Manager; Giovanna Alvarez, DHSP Fiscal Administrator; and Janice Alger, Assistant Director of Administration, Human Services

Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Numbers: E-20-MC-25-005, E-21-MC-25-0005, E-22-MC-25-0005, E-20-MW-25-005, and E-20-MW-35-005 Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City has established an Audit Review Certification form that is completed by employees to formally document review of subrecipient agencies' audit reports. Implementation Date The City implemented use of the Audit Review Certification form starting in Spring 2023 as part of the ESG subrecipient application process for the FY24 program year beginning July 1, 2023, and will continue use of the form for the FY25 program year beginning on July 1, 2024. Responsible Officials Anthony Woods, Planner and Contract Manager, and Liz Mengers, Planning and Development Manager

Program: HOME Investment Partnerships Program (HOME) ALN #: 14.239 Federal Agency: Department of Housing and Urban Development Federal Award Number: M22-MC250202 Award Year: July 1, 2022–June 30, 2023 Eligibility/Subrecipient Monitoring Type of finding: Noncompliance Prior-year finding: No Statistically valid sample: No Criteria 24 CFR 92.252, Qualification as affordable housing: Rental housing (e) Periods of affordability. The HOME-assisted units must meet the affordability requirements for not less than the applicable period specified in the following table, beginning after project completion. (1) The affordability requirements: (i) Apply without regard to the term of any loan or mortgage, repayment of the HOME investment, or the transfer of ownership (ii) Must be imposed by a deed restriction, a covenant running with the land, an agreement restricting the use of the property, or other mechanisms approved by HUD and must give the participating jurisdiction the right to require specific performance (except that the participating jurisdiction may provide that the affordability restrictions may terminate upon foreclosure or transfer in lieu of foreclosure) (iii) Must be recorded in accordance with State recordation laws. (2) The participating jurisdiction may use purchase options, rights of first refusal, or other preemptive rights to purchase the housing before foreclosure or deed in lieu of foreclosure in order to preserve affordability. (3) The affordability restrictions shall be revived according to the original terms if, during the original affordability period, the owner of record before the foreclosure, or deed in lieu of foreclosure, or any entity that includes the former owner or those with whom the former owner has or had family or business ties obtains an ownership interest in the project or property. 4) The termination of the restrictions on the project does not terminate the participating jurisdiction’s repayment obligation under § 92.503(b). (h) Tenant income. The income of each tenant must be determined initially in accordance with § 92.203(a)(1)(i). In addition, each year during the period of affordability the project owner must reexamine each tenant’s annual income in accordance with one of the options in § 92.203 selected by the participating jurisdiction. 24 CFR92.203 Income determinations (a) The HOME program has income-targeting requirements for the HOME program and for HOME projects. Therefore, the participating jurisdiction must determine each family is income eligible by determining the family’s annual income. (1) For families who are tenants in HOME-assisted housing and not receiving HOME tenant-based rental assistance, the participating jurisdiction must initially determine annual income using the method in paragraph (a)(1)(i) of this section. For subsequent income determinations during the period of affordability, the participating jurisdiction may use any one of the following methods in accordance with § 92.252(h): (ii) Obtain from the family a written statement of the amount of the family’s annual income and family size, along with a certification that the information is complete and accurate. The certification must state that the family will provide source documents upon request. Title 45 US Code of Federal Regulations Part 75 (45 CFR part 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 75.303 also states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Additionally, the 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition During our testwork, we noted there were two individuals residing in a facility financed with a City HOME loan who did not meet the low-income requirements and were therefore determined not to be eligible. Cause The City’s property manager failed to ensure that another unit, or the next available unit, within the building would be designated as a HOME-floating unit as required in its loan agreement with the City. Effect Ineligible recipients could potentially cause the City to not be in compliance with HUD requirements. Questioned Costs Not determinable Recommendation We recommend the City work collaboratively with its property managers to ensure that the correct number of units are being designated as HOME-assisted units. Views of Responsible Officials and Corrective Actions The two individuals determined to have incomes in excess of HOME Program limits were noted in our FY23 monitoring of properties assisted with HOME funds. The HOME Program allows for a unit to be occupied by a household who was initially eligible and whose income later increases, but requires that a comparable unit be designated as a HOME unit and leased to an eligible household when one is available. Owners of each property were made aware of the circumstance when City monitoring was completed. Each will designate comparable units to be HOME units when available and lease them to eligible households. Implementation Date Dependent on when residents move and/or appropriate units are available. Responsible Officials Chris Cotter, Housing Director & Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City will incorporate a more formal review of financial audits of subrecipients in conjunction with new contracts moving forward. These audits, and City staff’s verification of assessment will be included in each subrecipient file. Implementation Date FY2025 Contracts Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Reporting Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, herein referred to as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 2 US Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.1 defines subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 2 CFR 200.1 defines subrecipient as a nonfederal entity that receives a subaward from a passthrough entity to carry out part of a federal program but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City’s Community Development Department did not report awards granted to subrecipients for the HOPWA program by the end of the month following the month in which the City awarded the subrecipient award that is greater than or equal to $30,000 as required by FFATA. FFATA requires the City to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS/UEI number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the City did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testwork of four subawards, we also noted reporting exceptions as subawards were not reported in the required time. Cause The condition found was due to the City not reporting any amounts passed through to subrecipients for the period from July 2022 to June 2023, as the responsible officials were not aware of the reporting timeline requirements. As a result, all subawards were reported on a one-year lag. Effect Failure to submit all subaward amounts passed through to subrecipients and subcontractors under subawards as defined by 2 CFR 200.1 in the City’s FFATA reporting could result in the City reporting inaccurate and incomplete amounts to the federal government Questioned Costs None Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all amounts passed through to subrecipients under subawards as defined in 2 CFR 200.1 are reported in accordance with the FFATA federal regulations. In addition, we recommend that the City use obligation date for FFATA reporting. Views of Responsible Officials and Corrective Actions HOPWA contracts have typically been obligated over the course of several or more months, as some subrecipients operate in different ways. Going forward, the City will use the contract start date (7/1) as the Obligation date, and will submit the FFATA report accordingly. Implementation Date 8/31/2024 (representing the end of the month following the obligation of funds). Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Housing Opportunities for Persons with AIDS (HOPWA) ALN #: 14.241 Federal Agency: Housing and Urban Development Federal Award Numbers: MAH22-F005, MAH20-F005, and MAH21-F005 Award Year: July 1, 2022–June 30, 2023 Performance Reporting Type of finding: Material weakness and material noncompliance Prior-year finding: No Statistically valid sample: No Criteria Performance Reporting for the HOPWA Consolidated Annual Performance and Evaluation Report Per HUD, the Consolidated Annual Performance and Evaluation Report (CAPER) provides annual performance reporting on client outputs and outcomes that enables an assessment of grantee performance in achieving the housing stability outcome measure. The CAPER fulfills statutory and regulatory program reporting requirements and provides the grantee and HUD with the necessary information to assess the overall program performance and accomplishments against planned goals and objectives. HOPWA formula grantees are required to submit a CAPER demonstrating coordination with other Consolidated Plan resources. HUD uses the CAPER data to obtain essential information on grant activities, project sponsors, housing sites, units and households, and beneficiaries (which includes racial and ethnic data on program participants). The Consolidated Plan Management Process (CPMP) tool provides an optional tool to integrate the reporting of HOPWA-specific activities with other planning and reporting on Consolidated Plan activities. In accordance with 25 CFR 574.520(a), the City must submit a CAPER to HUD within 90 days of the end of each 12-month program year until all Grant Funds are expended. Key line items of the CAPER include amount of HOPWA funds expended with HOPWA in the program year for each HOPWA-eligible activity. Auditor should review Part 3 Accomplishment Data Planned Goal and Actual Outputs, Table 1 HOPWA Performance Planned Goal and Actual Outputs, Column f HOPWA Actual funds in the CAPER, and Part 3C Summary Overview of Grant Activities Performance and Expenditure Information, Table 1 Performance and Expenditure Information by Activity Type, Column 2 Outputs: Amount of HOPWA Funds Expended. Lastly, 2 CFR 200.303(a) states, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: – CAPER report is submitted to HUD within 90 days of the end of the 12-month program year. – Review of subrecipient’s CAPER to ensure complete and accurate reporting over key line items. The City failed to submit the CAPER that covers the period from July 1, 2021 to June 30, 2022 to HUD. The report is due to HUD by September 30, 2022. Additionally, the City has been unable to provide documentation that the subrecipient's CAPER has been reconciled to the Integrated Disbursement and Information System (IDIS). Cause Subrecipients are required to submit their individual CAPER reports to the City prior to the City submitting its report to HUD. The City has had difficulty in getting the subrecipients to comply with the CAPER reporting, which is primarily due to staffing issues at the subrecipients. As a result, the City did not submit its CAPER to HUD within the required time-frame. Effect Incomplete information from its subrecipients has resulted in the City’s inability to properly comply with HUD’s CAPER reporting requirements. Questioned Costs Not determinable Recommendation We recommend that the City review and enhance its policies, procedures, and internal controls to ensure that all subrecipient CAPER reports are reconciled to the IDIS system and submitted to HUD within 90 days of year-end. Views of Responsible Officials and Corrective Actions The FY22 CAPER was submitted to HUD on June 11, 2024. City will continue to work with all HOPWA subrecipients to ensure that a complete and accurate CAPER is completed in the appropriate format as required by HUD. This will include a focus on inputting the correct (eg, actual expended vs. award amount) funding amount. Implementation Date Beginning with CAPERs submitted for the FY ending 6/30/2024 (City 2024, Federal 2023). Responsible Officials Robert Keller, Project Planner, Cambridge Community Development Department, and Judith Tumusiime, Federal Grants Manager, Cambridge Community Development Department

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Suspension and Debarment Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure nonfederal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Also, when a nonfederal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition When establishing contracts for subrecipients under the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF), the City requires that standard contract language be included to address the applicable suspension and debarment requirements. During fiscal year 2023, the required contract language was not included within the subrecipient contracts executed for the CSLFRF program. Additionally, the City did not verify that its subrecipients were not suspended or debarred through the System for Award Management (SAM) or include self-certifications from the vendor/subrecipient during the contracting process. During our audit, we noted five of seven vendors and four of four subrecipients selected for testing were not checked for suspension and debarment as evidenced via review of the subrecipient contracts. During compliance testing, it was confirmed for all vendors and subrecipients, except for one, that they were not suspended or debarred. The engagement team was unable to determine if Neville Communities, Inc. is suspended or debarred as it is not registered with SAM.gov. Cause The City requires that standard contract language be included in all its subrecipient contracts that addresses suspension and debarment requirements. The City was unaware that the required language was excluded from subrecipient contracts entered into for the CSLFRF program as there was insufficient review of the contracts prior to execution to ensure all required elements were present. Additionally, the City requires that program personnel review SAM.gov to ensure the subrecipient is not suspended or debarred. There was no documentation that this review had occurred prior to entering into a contract with the subrecipient. Effect Lack of formal review of subrecipient contracts and review of entities on SAM could result in the City entering into contracts with prohibited entities. Questioned Costs None Recommendation We recommend the City ensure that required language is included within all subrecipient contracts prior to execution. We also recommend the City review that subrecipients are not suspended or debarred on the SAM website and retain documentation of this check prior to entering into contracts with subrecipients. Views of Responsible Officials and Corrective Actions The City will ensure that subrecipient contracts will include language about suspension and debarment. The City will also download a PDF copy of the subrecipients registration on SAM.GOV showing the subrecipient’s Exclusion Summary Status. Implementation Date FY25 Contracts (7/1/2024) Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Subrecipient Monitoring Type of finding: Material weakness and noncompliance Prior-year finding: Yes Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: • Each subrecipients risk of noncompliance is appropriately evaluated. • Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for the four subrecipients selected for testing, but there was no documentation to evidence the nature and extent of the City’s review of the audit reports obtained. Additionally, a documented risk assessment was not performed by the City over the four subrecipients selected for testing prior to entering into a contract. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Additionally, the City requires a risk assessment be completed over each subrecipient. However, due to time constraints, a risk assessment was not completed or documented. Effect Lack of effective controls and written policies and procedures over subrecipient monitoring could result in the City’s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements for both risk assessments and review of single audit report procedures. Employees can complete these checklists when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City will use a subrecipient audit certification form and a subrecipient risk assessment questionnaire to evaluate a subrecipient's risk/experience with federal funds as well as assess their federal funding threshold for having a single audit. Implementation Date FY25 Contracts (7/1/2024) Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: SLFRP1982 Award Year: July 1, 2022–June 30, 2023 Reporting Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria The 2 CFR 200.328 and 31 CFR section 35.4 require quarterly and annual reporting of the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) grant. The report focuses on the following key line items: current-period obligation, cumulative obligation, current-period expenditure, and cumulative expenditures. According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our audit, we selected the December 31, 2022 and June 30, 2023 report for testing. We noted that the current-period obligations, cumulative obligations, current-period expenditures, and cumulative expenditures contained on these reports could not be reconciled to the City’s books and records. As such, the engagement team was unable to determine if the amounts included in these key line items were complete and accurate. Cause PeopleSoft reports that were used to prepare the CSLFRF reports were not retained by the City. As PeopleSoft continuously updates, the detail used to prepare these reports could not be reproduced by the City. Effect Lack of document retention and reconciliation from the general ledger system to the CSLFRF could result in inaccurate reporting to the US Department of Treasury. Questioned Costs None Recommendation We recommend the City ensures proper document retention and complete reconciliations for how quarterly and annual reports are compiled. Views of Responsible Officials and Corrective Actions The Finance department will document the reconciliation of the City’s GL ARPA expenditures and obligations to the Department of Treasury ARPA reporting portal report both quarterly and annually. All reconciling adjustments and GL report documentation will be properly retained. Implementation Date 7/1/2023 Responsible Officials Michele Kincaid, Assistant Finance Director, and Sharon Pu, Grants Management

Program: Special Education Cluster (IDEA) ALN #: 84.027 Federal Agency: Department of Education Federal Award Number: NA Award Year: July 1, 2022–June 30, 2023 Period of Performance Type of finding: Material weakness and noncompliance Prior-year finding: No Statistically valid sample: No Criteria Per Part 4 of the Compliance Supplement, LEAs and SEAs must obligate funds during the 27 months, extending from July 1 of the fiscal year for which the funds were appropriated through September 30 of the second following fiscal year. This maximum period includes a 15-month period of initial availability plus a 12-month period for carryover. For example, funds from the fiscal year 2019 appropriation initially became available on July 1, 2019 and may be obligated by the grantee and subgrantee through September 30, 2021 (Section 421(b) of GEPA (20 USC 1225(b)); 34 CFR sections 76.703 through 76.710). According to 2 CFR 200.303, the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During testing over period of performance for the IDEA program, 14 samples were selected for testwork. For four selections (all related to the same vendor), we noted that expenditures were charged to the SC23605 grant 52 days prior to the grant’s start date. The expenditures were invoiced on August 1, 2022, and the grant’s period of performance began on September 22, 2022 (the date the Massachusetts Department of Education notified the City of this grant’s effective date). Cause The cause of the noncompliance relates to an error assigning POs for a certain vendor. POs created for this vendor for July 2022 tuition were mistakenly charged to the incorrect grant. A lack of review over charges to individual grants and programs has caused the City to charge expenses to the IDEA grant outside of its period of performance. Questioned Costs Not determinable Recommendation We recommend the City establish more precise controls over the review and approval of invoices, specifically relating to the review and approval over the direct grant that the expense will be charged to. Views of Responsible Officials and Corrective Actions Cambridge Public Schools' CFO or Grants Coordinator will review and sign-off on all tuition requisitions that will be charged to grants to confirm the grant approval date and compliance with the period of performance. Implementation Date The new approval process will be in place by July 1, 2024. Responsible Officials Dr. Karyn Grace, Assistant Superintendent of Student Services, Cambridge Public Schools, Ivy Washington, Chief Financial Officer, Cambridge School Department, and Lindsay Smythe, Grant Coordinator, Cambridge School Department

Finding Number: 2022 001 Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Number: E 20 MC 25 005; E 20 MW 25 0005 Award Year: 7/1/2021 ? 6/30/2022 E 21 MC 25 0005 Suspension and Debarment Type of finding: Material Weakness Prior year finding: No Statistically valid sample: No Criteria The 2 CFR sections 180.215 and 180.220 provide the principles to be applied to ensure non federal entities are not contracting with or making subawards under covered transactions to parties that are suspended or debarred. Also, when a non federal entity enters into a covered transaction with an entity at a lower tier, the non federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. According to 2 CFR 200.303, the non Federal entity must Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition When establishing contracts for subrecipients under the Emergency Solutions Grant Program (ESG), the City required that standard contract language be included to address the applicable suspension and debarment requirements. During fiscal year 2022, the required contract language was not included within the subrecipient contracts executed for the ESG program. Additionally, the City did not verify that its subrecipients were not suspended or debarred through the System for Award Management (SAM). During our audit, we noted 5 of 5 subrecipients selected for testing were not checked for suspension and debarment as evidenced via review of the subrecipient contracts. During compliance testing for the subrecipients it was confirmed they were not suspended or debarred. Cause The City requires that standards contract language be included in all of their subrecipient contracts that addresses suspension and debarment requirements. The City was unaware that the required language was excluded from subrecipient contracts entered into for the ESG program as there was insufficient review of the contracts prior to execution to ensure all required elements were present. Effect Lack of formal review of subrecipient contracts and review of entities on SAM could result in the City entering into contracts with prohibited entities. Questioned Costs None Recommendation We recommend the City ensure that required language is included within all subrecipient contracts prior to execution. We also recommend that the City review that subrecipients are not included on the SAM website and retain documentation of that check and review prior to entering into contracts with subrecipients. Views of Responsible Officials and Corrective Actions The City will update the subrecipient contract template to ensure the required language is included in all newly executed contracts certifying that the agency, its officers, and employees are not suspended or debarred from doing business with the federal government. Prior to entering into contracts with subrecipients, the City will check that each subrecipient is not included on the SAM.gov Exclusion List, and will include a dated screenshot from the SAM.gov website documenting the review in each project file. Implementation Date Updates to the Emergency Solutions Grant subrecipient contracts will be implemented for all newly executed contracts for use in the FY24 ESG program year. All ESG subrecipients will be checked against the Sam.gov Exclusion List and determined to be in good standing prior to the contract being executed and this process will be documented. Responsible Officials Anthony Woods, Planner and Contract Manager; Liz Mengers Magargee, Planning and Development Manager

Finding Number: 2022 002 Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Number: E 20 MC 25 005; E 20 MW 25 0005 Award Year: 7/1/2021 ? 6/30/2022 E 21 MC 25 0005 Special Tests; Payments to Subrecipients Type of finding: Material Weakness and Material noncompliance Prior year finding: No Statistically valid sample: No Criteria According to 24 CFR section 576.203, a recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient?s complete payment request. According to 2 CFR 200.303, the non Federal entity must Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City?s ESG Program has a control in place to ensure that invoice cover sheets (i.e. reimbursement requests) are reviewed in a timely manner so that the City can subsequently reimburse subrecipients within 30 days and remain in compliance with the requirement; however, the control to ensure timely payments to subrecipients was not operating effectively as there was a 8 to 110 day lag between the date the reimbursement request was received and the payment date. During our audit, we noted 14 of 21 subrecipient reimbursements selected for testing were not completed within 30 days of receiving the completed request for payment. Cause The City did not have effective controls in place to ensure subrecipients were paid for allowable costs within 30 days after receiving the subrecipient?s complete payment request. Effect Lack of effective controls resulted in the City not complying with 24 CFR section 576.203. Questioned Costs None Recommendation We recommend the City establish effective controls to ensure payment requests received from subrecipients are paid within 30 days of receipt. Views of Responsible Officials and Corrective Actions The City will establish the following procedures to ensure payment requests received from subrecipients are paid within 30 days of receipt of a complete request for reimbursement: 1. Department of Human Service Programs (DHSP) Contract Manager reviews invoices within 5 business days of receipt of request for reimbursement from subrecipient. a. If invoice is complete, original date of receipt is recorded. b. If invoice is incomplete, subrecipient is notified of items or documentation that is missing and receipt date is updated to reflect date of receipt of complete invoice. 2. Contract Manager approves payment request and submits to DHSP Fiscal staff for processing. 3. Fiscal staff processes and submits to Auditing Department as Priority payment. Implementation Date Implementation will begin April 15, 2023, when the FY23 3rd Quarter invoices are anticipated to be received by ESG subrecipients. Responsible Officials Anthony Woods, Planner and Contract Manager; Liz Mengers Magargee, DHSP Planning and Development Manager; Giovanna Alvarez, DHSP Fiscal Administrator; Janice Alger, Assistant Director of Administration, Human Services

Finding Number: 2022 003 Program: Emergency Solutions Grant Program (ESG) ALN #: 14.231 Federal Agency: Housing and Urban Development Federal Award Number: E 20 MC 25 005; E 20 MW 25 0005 Award Year: 7/1/2021 ? 6/30/2022 E 21 MC 25 0005 Subrecipient Monitoring Type of finding: Material Weakness Prior year finding: No Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non Federal entity must Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: ? Each subrecipients risk of noncompliance is appropriately evaluated ? Monitoring activities over subrecipients are performed on a timely basis ? Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted that audited financial statements were obtained for 5 of the 5 subrecipients selected for testing, but there was no documentation to evidence consideration of the compliance requirements indicated above. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formal documentation required to indicate what should be reviewed when reviewing the audit reports to ensure compliance with subrecipient monitoring requirements. Effect Lack of effective controls could result in the City?s noncompliance with program requirements. Questioned Costs None Recommendation We recommend the City establish a checklist or formal documentation requirements that employees can complete when obtaining subrecipient audit reports to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City has established an Audit Review Certification form that will be completed by employees to formally document review of subrecipient agencies? audit reports. Implementation Date The City will implement use of the Audit Review Certification form as part of the ESG subrecipient application process for the FY24 program year beginning July 1, 2023. Responsible Officials Anthony Woods, Planner and Contract Manager; Liz Mengers Magargee, Planning and Development Manager

Finding Number: 2022 004 Program: Coronavirus State and Local Fiscal Recovery Funds ALN #: 21.027 Federal Agency: U.S. Department of Treasury Federal Award Number: SLFRP1982 Award Year: 7/1/2021 ? 6/30/2022 Subrecipient Monitoring Type of finding: Material Weakness and Noncompliance Prior year finding: No Statistically valid sample: No Criteria The 2 CFR sections 200.332(d) through (f) provide the principles to be applied to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. According to 2 CFR 200.303, the non Federal entity must Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The City does not have properly designed controls and documented procedures in place to ensure compliance with the following requirements: ? Each subrecipients risk of noncompliance is appropriately evaluated ? Monitoring activities over subrecipients are performed on a timely basis ? Verification that subrecipients are audited as required when they are expected to exceed the threshold for having a single audit. During our audit, we noted the City does not have formally documented policies and procedures related to subrecipient monitoring and risk assessment prior to entering into contracts with subrecipients. For 1 of our 2 subrecipients selected for testing, there was no evidence of risk assessment prior to entering into contract. We noted that audited financial statements were obtained for 2 of the 2 subrecipients selected for testing, but there was no documentation to evidence monitoring procedures performed over the reports obtained. Cause The City requires that audited financial statements are obtained for subrecipients, but there is no checklist or formally documented policies and procedures for subrecipient monitoring and risk assessment to ensure compliance with subrecipient monitoring requirements. Effect Lack of effective controls resulted in the City not complying with 2 CFR 200.303. Questioned Costs None Recommendation We recommend the City establish well documented policies and procedures over subrecipient monitoring including a checklist or formal documentation requirements that employees can complete when obtaining subrecipient audit reports and making determinations on subrecipients contracts to ensure required monitoring procedures are performed and well documented. Views of Responsible Officials and Corrective Actions The City has established an Audit Review Certification form that will be completed by employees to formally document the review of subrecipient agencies? audit reports. Implementation Date The checklist is completed, and the City will start using the form immediately as new subrecipients are awarded ARPA funds. Responsible Officials Betty Lyons, Federal Grants Manager

Finding Number: 2021-001 Program: Community Development Block Grants (CDBG) ALN #: 14.218 Federal Agency: Housing and Urban Development Federal Award Number: B-20-MC-25-0005 Award Year: 7/1/2020 ? 6/30/2021 Allowable Costs/ Cost Principles Type of finding: Significant Deficiency Prior year finding: No Statistically valid sample: No Criteria The 2 CFR sections 200.420 through 200.475 provide the principles to be applied in establishing the allowability of certain items of cost. These principles apply whether or not a particular item of cost is treated as a direct cost or indirect (F&A) cost. Additionally, 2 CFR 200.303 indicates that non-Federal entities receiving Federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. Condition The City?s Community Development Department (CDD) charges allowable payroll costs to the CDBG program based on time charged specifically to that program. During our audit, we noted three of 25 timesheets reviewed did not have a supervisor?s signature verifying the timesheet had been reviewed and approved. Cause For the unapproved timesheet dated, 7/4/2020, the CDD implemented in 7/2020 an automated system, Smartsheet, as a pilot for time entry. However, at the beginning of the pilot, not all staff submitted their timesheet through Smartsheet and therefore were not approved in Smartsheet. In these instances, time may have been emailed to the employee?s supervisor, but an email or an approval was not provided. For the unapproved timesheets dated 1/2/21 and 6/19/21, there does not appear to be a formal proxy procedure established to ensure all timesheets are reviewed and approved if an immediate supervisor is on personal time off. Effect Lack of a formal specific proxy policy and procedure over ensuring all timesheets are reviewed and approved could result in unallowable costs charged to the program. Questioned Costs Not determinable Recommendation We recommend the CDD review their policies and procedures over ensuring all timesheets, especially those charged to a federal grant, be reviewed and approved by someone in the employee?s chain of command. Views of Responsible Officials and Corrective Actions For the unapproved timesheet dated 7/4/2020 and prior to that date, the timesheet submission and approval process was manual. However, during the COVID 19 pandemic, CDD migrated to an automated system (Smartsheet) for timesheet submission and approval. The automated system began as a pilot and was fully implemented at the end of July 2020. Not all staff submitted their timesheets in Smartsheet at the beginning of the pilot, so the timesheet dated 7/4/2020 was not approved in Smartsheet. For the unapproved timesheets dated 1/2/21 and 6/19/21, the supervisor was on vacation during those weeks. Typically, the smartsheet form will default to an employee?s direct supervisor, but the employee has an option to reroute their timesheet for approval to someone else, usually their supervisor?s supervisor when their supervisor is out of the office. This alternative step did not occur for these timesheets. The written timesheet procedures have been updated to ensure all timesheets are reviewed and approved by someone in the employee?s chain of command in the absence of his/her supervisor. Implementation Date The timesheet procedures have been updated as of March 2022. Responsible Officials Sandra Clarke, Deputy Director, Chief of Administration.

Finding Number: 2020-002 Program: HOME Investment Partnerships Program CFDA #: 14.239 Federal Agency: Department of Housing and Urban Development Federal Award Number: B-19-MC-25-0005 Award Year: 7/1/19-6/30/20 Eligibility Type of finding: Significant Deficiency and Noncompliance Prior year finding: Yes 2019-005 Statistically valid sample: No Criteria According to 24 CFR 92.203(b): The HOME program has income targeting requirements for the HOME program and for HOME projects. Therefore, the participating jurisdiction must determine if each family is income eligible by determining the family?s annual income. (1) For families who are tenants in HOME-assisted housing and not receiving HOME tenant-based rental assistance, the participating jurisdiction must initially determine annual income using the method in paragraph (a)(1)(i) of this section. For subsequent income determinations during the period of affordability, the participating jurisdiction may use any of the following methods in accordance with 92.252(h): (i) Examine the source documents evidencing annual income (e.g. wage statement, interest statement, unemployment compensation statement) for the family. (ii) Obtain from the family a written statement of the amount of the family?s annual income and family size, along with a certification that the information is complete and accurate. The certification must state that the family will provide source documents upon request. (iii) Obtain a written statement from the administrator of a government program under with the family receives benefits and which examines each year the annual income of the family. The statement must indicate the tenant?s family size and state the amount of the family?s annual income; or alternatively, the statement must indicate the current dollar limit for very low or low-income families for the family size of the tenant and state that the tenant?s annual income does not exceed this limit. (2) For all other families, the participating jurisdiction must determine annual income by examining the source documents evidencing annual income (e.g., wage statement, interest statement, unemployment, compensation statement) for the family. Exhibit IV CITY OF CAMBRIDGE, MASSACHUSETTS Schedule of Findings and Questioned Costs Year ended June 30, 2020 IV-5 According to 92.252(h): The income of each tenant must be determined initially in accordance with 24 CFR 92.203(a)(1)(i). In addition, each year during the period of affordability the project owner must re-examine each tenant?s annual income in accordance with one of the options at 24 CFR 92.203 selected by the participating jurisdiction. An owner of a multifamily project with an affordability period of 10 years or more who re-examines tenant?s annual income through a statement and certification in accordance with 24 CFR 92.203(a)(1)(ii), must examine the income of each tenant, in accordance with 24 CFR 92.203(a)(1)(i), every sixth year of the affordability period. Otherwise, an owner who accepts the tenant?s statement and certification in accordance with 24 CFR 92.203(a)(1)(ii) is not required to examine income of tenants in multi-family or single-family projects unless there is evidence that the tenant?s written statement failed to completely and accurately state information about the family?s size or income. Additionally, 2 CFR 200.303 indicates that non Federal entities receiving Federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. Condition The Federal Government requires that participating jurisdictions must establish and maintain effective internal controls over the HOME program that provide reasonable assurance that only eligible participants are included in the program. During testwork, we noted a lack of formal controls over eligibility. More specifically, the forms used to complete eligibility monitoring were not approved or certified by the City and did not include formal evidence the City validated eligibility. The City relies on the subrecipient to obtain annual income certifications, and reviews eligibility determinations during on-site monitoring. However, for fiscal 2020, the HOME program received a waiver for the on-site monitoring requirement. As the HOME program validates eligibility during the onsite reviews, no verification of eligibility took place by the City in fiscal year 2020, other than obtaining the project compliance reports from the property managers. Further, the City is not tracking when the required 6-year income reviews are completed by the property manager. Cause The City did not have formal documented controls in place to ensure compliance with eligibility requirements for the HOME program. Effect Lack of formal controls could result in federal noncompliance providing benefits to ineligible recipients. Questioned Costs Not determinable Recommendation We recommend the City review their policies and procedures for HOME eligibility and add formal documented controls. We recommend the City utilize a formal checklist that includes all eligibility requirements to ensure they are in compliance with Federal requirements for the HOME program. This checklist should include detailed descriptions of the supporting documentation used to verify eligibility. The checklist should also include the date of the last 6-year review and whether the 6-year review was required and completed during the current year. The checklist should be signed and dated by the City employee who completed the checklist and certified the participant?s eligibility.

Finding Number: 2020-003 Program: Adult Education ? Basic Grants to States CFDA #: 84.002 Federal Agency: Department of Education Federal Award Number: HS19152 Award Year: 9/1/2018 ? 8/31/2019; 9/1/2019 ? 8/31/2020 Allowable costs Type of finding: Significant Deficiency and Noncompliance Prior year finding: No Statistically valid sample: No Requirement Allowable Cost Basic Guidelines Except where otherwise authorized by statute, cost must meet the following general criteria in order to be allowable under federal awards; 1. Be necessary and reasonable for the performance of the federal award and be allocable thereto under the principles in 2 CFR part 200, subpart E. 2. Conform to any limitations or exclusions set forth in 2 CFR part 200, subpart E or in the federal award as to types or amount of cost items. 3. Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the non-federal entity. 4. Be accorded consistent treatment. A cost may not be assigned to a federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the federal award as an indirect cost. 5. Be determined in accordance with generally accepted accounting principles (GAAP), except for state and local governments and Indian tribes only as otherwise provided for in 2 CFR part 200. 6. Not be included as a cost or used to meet cost-sharing or matching requirements of any other federally financed program in either the current or a prior period. 7. Be adequately documented. Exhibit IV CITY OF CAMBRIDGE, MASSACHUSETTS Schedule of Findings and Questioned Costs Year ended June 30, 2020 IV-8 The 2 CFR sections 200.420 through 200.475 provide the principles to be applied in establishing the allowability of certain items of cost, in addition to the basic considerations identified above. These principles apply whether or not a particular item of cost is treated as a direct cost or indirect (F&A) cost. Additionally, 2 CFR 200.303 indicates that non Federal entities receiving Federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. Condition The City?s Community Learning Center charges allowable health insurance costs to the Adult Education program based on a percentage of payroll, hereafter referred to as the Health Insurance Rate. During our audit, we noted the City?s Health Insurance Rate is not annually updated and incorrectly includes the employee portion of health care costs. Further, we noted the 4th quarter health insurance costs charged to the grant did not agree to the underlying supporting calculation. The difference between the amount charged ($6,330) and the supporting documentation ($3,822) totaled $2,508. Cause The City?s formal control in place was not performed at a precise enough level to detect the incorrect amount of health insurance costs charged to the grant. Effect Lack of precision of control and lack of formal policies and procedures over the Health Insurance Rate could result in unallowable costs charged to the program. Questioned Costs Not determinable Recommendation We recommend the Community Learning Center review their policies and procedures over charging health insurance to the Adult Education grant. We also recommend controls be performed at a level of precision which would identify any incorrect charges to the program. Further, we recommend the City formally document the method used to determine the proper Health Insurance Rate and update the calculation annually.

Finding Number: 2020-004 Program: Adult Education ? Basic Grants to States CFDA #: 84.002 Federal Agency: Department of Education Federal Award Number: Various Award Year: 9/1/2019 ? 8/31/2020 Eligibility Type of finding: Significant Deficiency and Noncompliance Prior year finding: No Statistically valid sample: No Criteria The eligibility criteria for the Adult Education program is as follows: Eligibility for Individuals Eligible individuals are individuals who are at least 16 years of age, who are not enrolled or required to be enrolled in secondary school under state law, and who are basic skills deficient, do not have a secondary school diploma or its recognized equivalent and have not achieved an equivalent level of education, or are English language learners (29 USC 3272(4)). Additionally, 2 CFR 200.303 indicates that non Federal entities receiving Federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. Condition During our testing for eligibility, we noted for 6 of 40 (15%) samples tested, an assessment documenting skill level was not provided and therefore not reviewed. The intake specialists sign off on the eligibility determinations; however, there is not a formal supervisory review of the eligibility determinations. Cause It appears the missing assessments were from one location and missing due to insufficient back ?up procedures utilized. Also, a lack of a formal review of eligibility determinations does not provide proof a review occurred by someone other than intake personnel. Effect Without documentation of assessments, the City is unable to fully support the eligibility determination made. Further, a lack of a formal review over eligibility determinations increases the risk services are provided to ineligible recipients. Exhibit IV CITY OF CAMBRIDGE, MASSACHUSETTS Schedule of Findings and Questioned Costs Year ended June 30, 2020 IV-11 Questioned Costs Not determinable Recommendation We recommend the City strengthen their controls over ensuring supporting documentation for eligibility determinations are maintained and formalize a review control over eligibility determinations.

Finding Number: 2019-001 Program: Continuum of Care Program CFDA #: 14.267 Federal Agency: Department of Housing and Urban Development Federal Award Number: MA0636L1T091800 Award Year: Various Procurement Type of finding: Significant Deficiency Prior year finding: No Statistically valid sample: No Criteria: According to 2 CFR 200.318: (a) The non-Federal entity must use its own documented procurement procedures which reflect applicable State and local laws and regulations, provided that the procurements conform to applicable Federal law and the standards identified in this section. (b) Non-Federal entities must maintain oversight to ensure that contractors perform in accordance with the terms, conditions and specifications of their contracts or purchase orders. According to 2 CFR 200.303: The non-Federal entity must: (c) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States of the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (?COSO?). Condition: The Federal Government requires non-Federal entities to establish procurement policies and procedures that conforms to Federal standards and have controls in place to ensure compliance with these procedures. The City has documented policies and procedures for selecting subrecipients. During our testwork over procurement, we noted a lack of formal documented controls ensuring compliance with certain policies and procedures. Subrecipient proposals are scored based on past performance. There is no formal documented review or approval of these scores. Additionally, subrecipients are reviewed and ranked by the Evaluation Panel. There is no formal documentation of the ranking being approved by the Evaluation Panel. During our testing of the procurement of five subrecipients, one had a scorecard that was incorrectly calculated. The incorrect scorecard did not have any effect on the project receiving funding or the amount of funding. Cause: The City did not have formal documented controls in place to ensure that certain procurement policies and procedures were followed when selecting subrecipients. Effect: Lack of formal undocumented controls could result in federal noncompliance. Questioned Costs: None Recommendation: We recommend the City review their policies and procedures for procurement and add formal documented controls as needed. We recommend these controls include a review control over the subrecipient scorecards to ensure they are properly calculated and an authorization control to document the Continuum of Care Evaluation Panel?s approval of the rankings and tiers of subrecipient projects. Views of Responsible Officials and Corrective Actions: The City shall update the Continuum of Care Governance Charter to adopt and/or clarify formal roles, responsibilities, and voting processes for the Cambridge Continuum of Care Board of which the Continuum of Care Evaluation Panel is a subsection to approve the ranking and tiering of Continuum of Care subrecipients applying for new and renewal funding. The City shall also update the Continuum of Care Governance Charter and the Continuum of Care Program Competition Local Competition Information document to strengthen control of the subrecipient scoring process including the establishment of the Continuum of Care Planner as the party primarily responsible for scoring with the Planning and Development Manager providing review and approval of subrecipient scorecards. Implementation Date: April 30, 2020, however the Continuum of Care Program Competition Local Competition Information is updated and published annually after HUD?s publication of the Continuum of Care Notice of Funding Availability to reflect annual changes detailed in the competition documents. HUD?s NOFA publication schedule is unpredictable, but generally occurs in early- to mid-summer. Responsible Officials: Liz Mengers, Planning and Development Manager; Michelle McCarthy, Planner and Contract Manager

Finding Number: 2019-002 Program: Continuum of Care Program CFDA #: 14.267 Federal Agency: Department of Housing and Urban Development Federal Award Number: MA0636L1T091800 Award Year: Various Matching Type of finding: Significant Deficiency and Noncompliance Prior year finding: No Statistically valid sample: No Criteria: According to 24 CFR 578.73(b): Cash Sources. A recipient or subrecipient may use funds from any source, including any other federal sources (excluding Continuum of Care program funds), as well as State, local, and private sources, provided that funds from the source are not statutorily prohibited to be used as a match. The recipient must ensure that any funds used to satisfy the matching requirements of this section are eligible under the laws governing the funds in order to be used as matching funds for a grant awarded under this program. Condition: The Federal Government requires that expenditures used for matching purposes be incurred and paid with non-Continuum of Care funds. To track subrecipient matching, the City requires that all subrecipients submit documentation of their match expenditures as well as evidence of payment. During our testing of twenty-five subrecipient reimbursement requests, seventeen claimed matching funds for the period selected. Of these seventeen, two did not provide documentation that the match expenditures were paid. Cause: During the review of subrecipient reimbursement requests, the City did not always ensure claimed matching expenditures included documentation of payment. Effect: Without documentation of payment, the City is unable to determine if the claimed match was actually paid by the subrecipient. Questioned Costs: Undeterminable Recommendation: We recommend the City strengthen their controls over subrecipient matching to ensure that all subrecipients are informed of the documentation required when claiming matching expenditures. We also recommend the City update the Fiscal Administration Desk Guide to include acceptable forms of documentation subrecipients can provide for proof of payment. Views of Responsible Officials and Corrective Actions: (1) Updates to the Fiscal Administration Desk Guide: The City shall update the Fiscal Administration Desk Guide to include a detailed schedule of documents that are acceptable to substantiate match expenses. (2) Change to subrecipient invoice templates: The City shall update its subrecipient invoice template to require the subrecipient to provide more details about the kinds of match expenses it contributes each month in order to assist contract managers with identifying whether the proper documentation has been received. Implementation Date: (1) Updates to the Fiscal Administration Desk Guide will take place by April 30, 2020. (2) Changes to subrecipient invoice templates shall take place by March 15, 2020 for use with invoices due from subrecipient April 15, 2020. Responsible Official: Michelle McCarthy, Planner and Contract Manager

Finding Number: 2019-003 Program: Continuum of Care Program CFDA #: 14.267 Federal Agency: Department of Housing and Urban Development Federal Award Number: MA0636L1T091800 Award Year: Various Special Test ? Reasonable Rental Rates Type of finding: Material Weakness and Material Noncompliance Prior year finding: No Statistically valid sample: No Criteria: According to 24 CFR 578.51(g): Rental Reasonableness. HUD will only provide rental assistance for a unit if the rent is reasonable. The recipient or subrecipient must determine whether the rent charged for the unit receiving rental assistance is reasonable in relation to rents being charged for comparable unassisted units, taking into account the location, size type, quality, amenities, facilities, and management and maintenance of each unit. Reasonable rent must not exceed rents currently being charged by the same owner for comparable unassisted units. According to 24 CFR 578.49(B)(2): Leasing individual units. When grants are used to pay rent for individual housing units, the rent paid must be reasonable in relation to rents being charged for comparable units, taking into account the location, size, type, quality, amenities, facilities, and management services. In addition, the rents may not exceed rents currently being charged for comparable units, and the rent paid may not exceed HUD-determined fair market rents. Condition: The Federal Government requires that recipients or subrecipients assess the reasonableness or rents being charged and ensure that rents charged to the grant are the same as those charged for comparable unassisted units. In leasing programs the Federal Government prohibits rents charged to the grant to exceed the Department of Housing and Urban Development?s (?HUD?) fair market rents, while Rental Assistance programs are permitted to exceed Fair Market Rent provided the rent is reasonable. During our testing of twenty-five subrecipient reimbursement requests, twenty-four had leasing or rental expenditures for the period selected. Of these twenty-four, fourteen did not provide detailed rent-rolls to support the rent charged to the grant. Additionally, during our testing of five subrecipient projects, four had not completed site-visits to ensure subrecipients establishment of rent reasonableness. For the remaining one, a site-visit was performed but included a finding regarding rent reasonableness. A follow up plan was documented in the site-visit report; however, no formal documentation of the follow-up occurring or the issue being formally resolved with the subrecipient was noted. Cause: During the review of subrecipient reimbursement requests, the City did not ensure that rent and leasing expenditures included rent-roll documentation that included the size of the unit, making it difficult to determine Fair Market Rent for the unit. The City also didn?t have procedures in place to ensure site-visits were completed on an annual basis. Effect: Without unit-size documentation, leasing and rental assistance charged to the grant could not be reviewed to confirm compliance with HUD?s fair market rent requirement. Site-visits were not completed annually to ensure subrecipients had established rent reasonableness and that rents being charged were comparable to unassisted units. Questioned Costs: Undeterminable Recommendation: We recommend the City strengthen their controls over subrecipient reimbursement requests to ensure that all subrecipients are informed of the documentation required when requesting reimbursement for leasing and rent expenditures. We also recommend the City update its Continuum of Care Program Standards to include the procedure subrecipients must use to document rent reasonableness and the documentation of this determination that must be retained in the client file. We further recommend the City obtain lease agreements from subrecipients for new units and maintain the monthly rent information in an excel spreadsheet for the project. This would allow Grant-Contract Managers to spot-check monthly rent rolls to the agreed upon rates in the lease agreements. We also recommend the City create a schedule at the beginning of the award year to ensure that subrecipient site-visits occur on an annual basis. Views of Responsible Officials and Corrective Actions: (1) Rent Roll updates: Rent roll forms were updated in October 2019 to include more information about unit size, contract rent, and reimbursement rate but have not been implemented with each subrecipient. Contract Managers shall be instructed to fully implement the use of this updated rental roll form with subrecipients immediately rather than waiting until the start of a new contract year as was planned. (2) Tracking rental amount: Contract Managers will begin tracking contract rent amounts and reimbursement amounts in a spreadsheet for each project. (3) Subrecipient monitoring: The City has implemented a monitoring schedule calling for each subrecipient administering a permanent supportive housing program to be monitored during the first quarter (January ? March) of the calendar year. As of this date three of seven subrecipients have had on-site monitoring with monitoring reports pending. The remaining monitoring visits are scheduled to take place within the next 90 days. Contract Managers shall continue the practice of sampling rent reasonableness documentation at these on-site visits. (4) Policy updates: The City shall update the Continuum of Care Program Standards and the Fiscal Administration Desk Guide to require a standard process by which subrecipients must document rent reasonableness including standard documentation that must be kept in each client file. Implementation Date: (1) Rent Roll updates and rental amount tracking shall be fully implemented by March 15, 2020 for use with invoices due from subrecipients on April 15, 2020. (2) Subrecipient monitoring is on-going and shall be complete by May 30, 2020. (3) Policies shall by updated and adopted by April 30, 2020. Responsible Officials: Michelle McCarthy, Planner and Contract Manager; Liz Mengers, Planning and Development Manager

Finding Number: 2019-004 Program: HOME Investment Partnerships Program CFDA #: 14.239 Federal Agency: Department of Housing and Urban Development (HUD) Federal Award Number: M18-MC250202 Award Year: 7/1/18-6/30/19 Reporting Type of finding: Significant Deficiency and Noncompliance Prior year finding: No Statistically valid sample: No Criteria: According to 2 CFR 200.508: (b) Loan and loan guarantees (loans). Since the Federal Government is at risk for loans until the debt is repaid, the following guidelines must be used to calculate the value of Federal awards expended under loan programs: (1) Value of new loans made or received during the audit period; plus (2) Beginning of the audit period balance of loans from previous years for which the Federal Government imposes continuing compliance requirements; plus (3) Any interest subsidy, cash or administrative cost allowance received. Condition: The Federal Government requires non-Federal entities to maintain their loan portfolio and ensure the correct amount of loans is reported on the Schedule of Expenditures of Federal Awards (?SEFA?). The amount of loans reported on the SEFA must include the value of new loans made during the year plus the beginning balance of loans from the previous year and any administrative cost allowance of interest subsidy. Loans must stay on the SEFA until the end of the Federal period of affordability. When we were provided the outstanding loan portfolio, we noted several loans included on the schedule which had periods of affordability that had expired. Cause: The City did not have formal documented controls in place to ensure that the HOME loan portfolio was properly updated and maintained. Effect: Lack of formal controls could result in federal noncompliance. Questioned Costs: None Recommendation: We recommend the City review their policies and procedures for the HOME loans and add formal documented controls for updating and maintaining the loan portfolio. We recommend that these controls include a review control over the loan portfolio to ensure they are properly included or removed depending on their Federal period of affordability. Views of Responsible Officials and Corrective Actions: Columns were added to the HOME Loan Report to reference the HUD IDIS number, the HUD affordability start date, and the HUD affordability end date. The HOME Loan Report will be migrated to a Smart Sheet to enable automatic reminders when a loan is coming to the end of its affordability period. This will ensure the correct amount of active loans will be reflected in the SEFA. Implementation Date: The HOME Loan Report has been updated as of October 2019. Migration to a Smart Sheet will be completed by June 30, 2020. Responsible Officials: Kevin Gookin, Chief Fiscal Officer, Chris Cotter, Director of Housing

Finding Number: 2019-005 Program: HOME Investment Partnerships Program CFDA #: 14.239 Federal Agency: Department of Housing and Urban Development (HUD) Federal Award Number: M18-MC250202 Award Year: 7/1/18-6/30/19 Eligibility Type of finding: Material Weakness and Noncompliance Prior year finding: No Statistically valid sample: No Criteria: According to 24 CFR 92.203(b): The HOME program has income targeting requirements for the HOME program and for HOME projects. Therefore, the participating jurisdiction must determine if each family is income eligible by determining the family?s annual income. (1) For families who are tenants in HOME-assisted housing and not receiving HOME tenant-based rental assistance, the participating jurisdiction must initially determine annual income using the method in paragraph (a)(1)(i) of this section. For subsequent income determinations during the period of affordability, the participating jurisdiction may use any of the following methods in accordance with 92.252(h): (i) Examine the source documents evidencing annual income (e.g. wage statement, interest statement, unemployment compensation statement) for the family. (ii) Obtain from the family a written statement of the amount of the family?s annual income and family size, along with a certification that the information is complete and accurate. The certification must state that the family will provide source documents upon request. (iii) Obtain a written statement from the administrator of a government program under which the family receives benefits and which examines each year the annual income of the family. The statement must indicate the tenant?s family size and state the amount of the family?s annual income; or alternatively, the statement must indicate the current dollar limit for very low or low-income families for the family size of the tenant and state that the tenant?s annual income does not exceed this limit. (2) For all other families, the participating jurisdiction must determine annual income by examining the source documents evidencing annual income (e.g., wage statement, interest statement, unemployment, compensation statement) for the family. According to 92.252(h): The income of each tenant must be determined initially in accordance with 24 CFR 92.203(a)(1)(i). In addition, each year during the period of affordability the project owner must re-examine each tenant?s annual income in accordance with one of the options at 24 CFR 92.203 selected by the participating jurisdiction. An owner of a multifamily project with an affordability period of 10 years or more who re-examines tenant?s annual income through a statement and certification in accordance with 24 CFR 92.203(a)(1)(ii), must examine the income of each tenant, in accordance with 24 CFR 92.203(a)(1)(i), every sixth year of the affordability period. Otherwise, an owner who accepts the tenant?s statement and certification in accordance with 24 CFR 92.203(a)(1)(ii) is not required to examine income of tenants in multi-family or single-family projects unless there is evidence that the tenant?s written statement failed to completely and accurately state information about the family?s size or income. According to 24 CFR 92.508: (a) Each participating jurisdiction must establish and maintain sufficient records to enable HUD to determine whether the participating jurisdiction has met the requirements of this part. At a minimum, the following records are needed: (3)(v) Records demonstrating that each family is income eligible in accordance with 24 CFR 92.203. (3)(vii) Records demonstrating that each rental housing project meets the affordability and income targeting requirements of 24 CFR 92.252 for the required period. Records must be kept for each family assisted. Condition: The Federal Government requires that participating jurisdictions must establish and maintain effective internal controls over the HOME program that provide reasonable assurance that only eligible participants are included in the program. During testwork, there was a lack of formal controls over eligibility. More specifically, the forms used to complete eligibility monitoring were not certified by the City and did not include formal evidence that validated eligibility. During testwork, we noted the City is not obtaining annual income certifications, but relies on the subrecipient to do so. The City is instead performing on-site monitoring over income eligibility; however, based on the time table required for the housing quality standards, instead of annually. As such, in certain cases, income eligibility has not been verified for 2-3 years. Further, the monitoring documents maintained by the City do not provide evidence as to what documents were reviewed and used as verification for the tenant?s eligibility. When completing the on-site monitoring, the City is reviewing income eligibility documentation; however, the City is not retaining the documentation evidencing eligibility in participant files. Instead, all supporting eligibility documents are maintained on-site by the property managers. Lastly, the City is not tracking when the required 6-year income reviews are completed by the property manager. Cause: The City did not have formal documented controls in place to ensure compliance with eligibility requirements for the HOME program. Effect: Lack of formal controls could result in federal noncompliance. Questioned Costs: Undeterminable Recommendation: We recommend the City review their policies and procedures for HOME eligibility and add formal documented controls. We recommend the City create a formal checklist that includes all eligibility requirements to ensure they are in compliance with Federal requirements for the HOME program. This checklist should include detailed descriptions of the supporting documentation used to verify eligibility. The checklist should also include the date of the last 6-year review and whether the 6-year review was required and completed during the current year. The checklist should be signed and dated by the City employee who completed the checklist and certified the participant?s eligibility. Additionally, we recommend the City communicate directly with HUD to determine whether completing eligibility determinations on the same timetable as housing quality standards is sufficient or whether eligibility monitoring must be completed annually. Further, we recommend the City, as the participating jurisdiction, determine with HUD if they must maintain source documentation relating to eligibility in files for each tenant or whether it is adequate for property managers to maintain eligibility records and have the City perform monitoring procedures and maintain a checklist as documentation of eligibility. Views of Responsible Officials and Corrective Actions: HOME Compliance Monitoring Policies and Procedures have been updated. The formal checklist is being generated. Implementation Date: Home Compliance Monitoring Policies and Procedures were updated March 2020. The checklist will be completed by May 2020. Responsible Officials: Betty Lyons, Federal Grants Manager; Chris Cotter, Director of Housing

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION