Cook County, IllinoisLocal Government

Subrecipient Monitoring and Special Tests: Housing Quality Standards Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: M17-DC170213 and 2017 M18-DC170213 and 2018 M21-DC170213 and 2021 M22-DC170213 and 2022 Home Investment Partnerships Program (HOME), Federal Assistance Listing #14.239 County Department – Department of Planning and Development (DPD) Finding 2025 – 001 CRITERIA Subrecipient Monitoring 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4) Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. DPD’s HOME Program Policies and Procedures Manual (updated January 2025), Monitoring Section (pages 114 to 129), under the Annual Monitoring Plan/Schedule Update, states the plan should identify the participating jurisdiction (PJ) monitoring goals and strategies, highlighting areas to which staff should pay special attention during the monitoring year. A specific schedule detailing annual, bi-annual, and tri-annual monitoring visits as required by HUD must be developed and maintained. To assure that adequate records are kept regarding each property and its compliance status, the monitor should establish a monitoring file for each property. The basic items in the file should include written agreement, written tenant selection criteria, property and unit inspections and results, etc. Also, HOME Program Compliance should conduct a risk assessment of its portfolio of the PJ’s HOME projects so that the highest risk projects can be identified and monitored first. In addition, HOME Program Compliance must conduct a desk review of all properties in the monitoring workload each year, as well as on-site reviews periodically, ranging from annually to every 3 years based on the number of units in property (i.e. 26 or more units require an annual review). Special Tests: Housing Quality Standards Per 24 CFR Section 92.209(i), Tenant-based rental assistance: Eligible costs and requirements, Housing Standards, states “The participating jurisdiction must require the housing occupied by a family receiving tenant-based rental assistance under this section to meet the participating jurisdiction's property standards under § 92.251. Initially and annually thereafter, the participating jurisdiction must determine the housing complies with its property standards and is decent, safe, sanitary, and in good repair in accordance with § 92.251(f). During the period of affordability (i.e., the period for which the nonfederal entity must maintain subsidized housing) for HOME assisted rental housing, the PJ must perform on-site inspections to determine compliance with property standards and verify the information submitted by the owners no less than (a) every three years for projects containing one to four units, (b) every two years for projects containing five to 25 units, and (c) every year for projects containing 26 or more units. CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not provide sufficient evidence to document annual monitoring performed, as well as performed the required inspections to ensure property standards were met, as required by Federal regulations and its internal policies. CAUSE Based on discussions with management, the cause of the findings occurred as a result of post pandemic allocations to the County which included several housing related fundings and initiatives, including Emergency Rental Assistance I & II (ERA I& II), Homeless Sheltering, Homeless and Transitional Sheltering Physical Site Acquisition and Development, HOME ARPA (HUD Allocation), and HOME, CDBG CV development delays that challenged the Housing teams provision of services and compliance requirement. While HUD had extended post pandemic compliance moratoriums into fiscal year 2024, Housing team hiring, training and implementation of compliance activities were unable to activate fully in the subject fiscal year to meet compliance. Additionally, for subrecipient monitoring of the HOME program, costs paid to developers were misclassified as subrecipient expenditures. The HOME program does not have contracts with subrecipients. EFFECT Failure to adequately monitor the activities and performance of subrecipients (and developers) could result in Federal awards being used for unauthorized purposes and DPD’s inability to adequately perform required risk assessments. Failure to perform the required inspections to ensure property standards were met is a violation of Federal regulations. QUESTIONED COSTS None. CONTEXT Subrecipient Monitoring During the current audit period, we noted a total of thirty-seven (37) projects were included on the Program Year 2024 (Fiscal Year 2025) HOME monitoring rental portfolio schedule provided, which required annual monitoring per DPD’s internal policies. Of the 37 projects, we noted three projects had some monitoring conducted during the period, which included some review of tenant files (for income verification/eligibility) and limited physical inspections of HOME units. No additional documentation was provided to verify compliance with federal regulations and the HOME Program Policies and Procedures Manual which required annual monitoring of each project (property). In addition, we noted approximately $7.3 million was reported on the SEFA as pass-through to two subrecipients under the program for the fiscal year ended November 30, 2025. Based on further discussions, DPD noted that these subrecipients are the two title companies used to pay the developers under the HOME program in accordance with its escrow agreement(s). We also reviewed a sample of these payments noting the supporting documentation referenced the developers as subrecipients. No documentation was provided to support compliance with subrecipient monitoring as required by 2 CFR Part 200.332. Special Tests: Housing Quality Standards We were provided with the same 37 projects reviewed under subrecipient monitoring to verify that DPD performed the required inspections to ensure that property standards were met. Based on our review, we noted the list included projects with HOME assisted units ranging from one (1) to 99 units, which would have required inspections every one to three years. However, the listing provided did not identify those units on which housing quality inspections were due. In addition, of the 37 projects, we were provided with documentary evidence to support only one (1) project whereby the required unit inspection reports were completed. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPD ensure procedures should be in place to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance, as required by Federal regulations and internal policies. Also, documentation should be maintained to support that required inspections are performed to ensure that property standards are met, including identification of those units on which housing quality inspections are due, in accordance with 24 CFR 92.251(f). VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 42-43.

Subrecipient Monitoring Federal Department – U.S. Department of Treasury Federal Award Identification Number and Year: SLFRP0143 and 2021 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds, Federal Assistance Listing #21.027 County Department(s) – Various Finding 2025 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (b) ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: (1) Federal award identification. (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN)…(c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. The Cook County, Illinois ARPA: Subrecipient Risk Assessment and Risk Reassessment Process Manual (dated May 16, 2024), states "If a subrecipient does not complete the risk reassessment by the assigned due date, their risk level will remain the same and they will be eligible for reimbursements only. Advancement requests will not be considered until the subrecipient completes the risk reassessment." Also, the level of monitoring to which the subrecipient must adhere to will vary by risk level assigned. The monitoring expectations associated with each risk level will be communicated to the subrecipient in the form of the risk reassessment and financial monitoring letter”. The monitoring parameters associated with each risk level are outlined below: • High Risk – minimum of monthly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Medium Risk – minimum of monthly to quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Low Risk - minimum of quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns The Cook County ARPA Grants Compliance Guide, under External Risk Management, states "Federal grant regulations in Uniform Guidance require that all SLFRF-funded programs be conducted in a risk-informed manner, particularly the selection and monitoring of subrecipients that implement programming on behalf of Cook County. In order to assess the risk potential of external subrecipient partners, each subrecipient organization is assessed for risk as the beginning of their partnership with the County and assigned a risk rating of High, Medium, or Low. This rating informs the monitoring and documentation requirements for that subrecipient. Subrecipients are reassessed for risk annually to reflect any changes or improvements in their risk potential”. The Cook County ARPA SLFRG Grant Subaward Financial Management Manual (revised March 3, 2025), under Subaward Financial Management Roles and Responsibilities states that “as outlined in the risk assessment form, the level of monitoring will be based on subrecipient’s risk designation. The subrecipient will receive a risk assessment and financial management letter apprising it of the expectations associated with its assigned risk level”. In addition, under Section A. Advancement of Funds Process, Item VI. Shifting to Reimbursement Model, states “nine months prior to the program’s conclusion, no further advancements can be provided to a subrecipient. Unspent advance balances will be applied against subsequent expenses incurred and reported to the County. Some subrecipients may need working capital to maintain operations, and it will be the responsibility of the Department to create a drawdown schedule to ensure to the best of its ability that all advanced funds are expended and/or recouped by program-end”. CONDITION During the current audit period, the County performed inadequate monitoring of its subrecipients as required by its internal policies. CAUSE Based on discussions with management, the County instituted new internal guidelines for program and financial management of its State and Local Fiscal Recovery Funds (SLFRF) award. These guidelines included more strict monitoring controls than federal regulations require. Additionally, the County deployed a new grants management system specifically to assist in collection and reporting on program metrics and subrecipient financials. The grants management system went live in spring of 2024. The County continues to invest in compliance oversight and technical assistance to ensure its new guidelines are effectively implemented, particularly in relation to utilization of its grants management system. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of 40 subrecipients (of a population of 250 subrecipients), we noted the following:  For 1 subrecipient file, we noted one (1) monitoring log was completed. However, based on risk rating(s) assigned, a total of four (4) monitoring logs were required.  For 11 subrecipients, we noted the risk reassessments were expired, ranging from 167 to 920 days over the assigned due date. Of the 11 subrecipients, 6 had risk reassessments currently outstanding and 3 had advancement requests approved without a risk reassessment, both of which were contrary to County’s internal policies. The total amount advanced to the 3 subrecipients was $772,214.  We noted one subrecipient submitted advancement requests totaling $852,757 during the County’s fiscal year. Based on review of the supporting documentation, it appears these funds are actual reimbursement of costs previously incurred by the subrecipient and should have been submitted via a payment request(s) as opposed to an advancement request(s). Consequently, the SEFA reported total expenditures incurred of $594,815, instead of the total $852,757, resulting in a net understatement of $257,942. However, the subrecipient was compensated for all work that was performed.  We noted the County executed a subrecipient agreement (signed December 20, 2024) prior to verifying the subrecipient had an active Unique Entity Identifier (UEI) number (active date January 20, 2025) which is required by Federal regulation. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend County implement procedures to ensure adequate documentation (monitoring log) is maintained and timely completion of risk reassessment is conducted to support the evaluation of each subrecipient’s risk of noncompliance as required by Federal regulations and its internal policies. Also, the County should adhere to its written internal policies which require that advancement requests not be considered until the subrecipient completes the risk reassessment. In addition, the agreement with a subrecipient should not be executed without an active UEI, unless exceptions to these policies are clearly documented. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 44-45.

Program Income Federal Department – U.S. Department of Health and Human Services Pass-through Chicago Department of Public Health and AIDS Foundation of Chicago Federal Award Identification Number(s) and Year(s): H8900008 and 2025 H89HA00008 and 2023 HIV Emergency Relief Program Grants, Federal Assistance Listing #93.914 County Department –Cook County Health (CCH) Finding 2025 – 003 CRITERIA Per the U.S Department of Health and Human Services, Health Resources & Services Administration (HRSA) Policy Clarification Notice # 15-03, Clarification Regarding the Ryan White HIV/AIDS Program (RWHAP) and Program Income, Grant Policy Update 9/15/2025, states that in the context of the RWHAP, program income is most commonly generated by recipients and subrecipients as a result of charging for services and receiving payment from third-party reimbursement. Under the uniform administrative requirements, to the extent available, recipients and subrecipients must disburse funds available from program income, rebates, refunds, contract settlements, audit recoveries and interest earned on such funds before requesting additional cash payments. Also, recipients are required to track and account for all program income in accordance with 2 CFR § 200.302(b)(3). Additionally, it is the responsibility of the recipient to monitor and track program income earned by subrecipients. Subrecipients should retain program income for “additive” use within their own programs. 2 CFR Part 200.307, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Program income. (a) General. The recipient or subrecipient is encouraged to earn income to defray program costs when appropriate. Program income must be used for the original purpose of the Federal award. Program income earned during the period of performance may only be used for costs incurred during the period of performance or allowable closeout costs. See § 200.472(b). Program income must be expended prior to requesting additional Federal funds. Program income exceeding amounts specified in the Federal award may be added to or deducted from the total allowable costs in accordance with the terms and conditions of the Federal award. CONDITION During the current audit period, Cook County Health (CCH) did not comply with federal regulations regarding the use and reporting of program income as it relates to funds awarded through the RWHAP. CAUSE Based on discussions with management, the HIV grants transitioned to CCH from an external organization in July 2025. Award amounts were granted in multiple phases, requiring four budget revisions, with the final revision approved in December 2025. The contractual period covered March 2025 through December 2025. During the transition period, CCH lacked formal operational procedures to identify, record, and track program income, as well as several operational and administrative challenges which contributed to this issue. EFFECT Failure to adequately track and report program income is a violation of Federal regulations and could result in the return of funds to the Federal government. QUESTIONED COSTS None. CONTEXT Based on initial discussions with CCH management, the RWHAP did not generate any program income during the period from December 1, 2024 to November 30, 2025. However, during our review of patient’s eligibility documentation, we noted certain participants insurance were billed for services performed under the federal program, thereby representing payments received from third-party reimbursements. Consequently, CCH was able to provide a patient payment report showing HIV diagnosis via its Invision and CPA Cerner systems which included $2,937,999 in total payments and $47,784 in total patient payments received during the period. We noted this information was not reported as program income to the two grantor agencies during the period ended November 30, 2025. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that CCH implement written policies and procedures to ensure that program income is tracked and monitored to ensure accurate reporting to its grantor agencies. Also, procedures should be in place to properly allocate all program income to the RWHAP and to ensure that future funds disbursed from available program income are utilized for eligible program activities prior to requesting any additional reimbursement (cash payments) from the grantor agencies as required by 2 CFR Part 200.307. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 46-47.

Reporting Federal Department – U.S. Department of Homeland Security Pass-through Illinois Emergency Management Agency Federal Award Identification Number and Year: EMW-2021-SS-00001 and 2021 EMW-2022-SS-00025-S01 and 2022 EMW-2023-SS-00013 and 2023 EMW-2024-SS-05137 and 2024 Homeland Security Grant Program, Federal Assistance Listing #97.067 County Department – Department of Emergency Management and Regional Security Finding 2025 – 004 CRITERIA As required by the 2024 grant agreement(s) with the State of Illinois, Illinois Emergency Management Agency (IEMA), Section 10.1 and 11.1, states that Grantee must submit financial and performance reports as requested and in the format required by Grantor no later than the dues date(s) specified in PART TWO or PART THREE. Grantee must submit quarterly reports with Grantor describing the expenditure(s) of the funds related thereto, unless more frequent reporting is required by the Grantee due to the funding source or pursuant to specific award conditions. 2 CFR 200.208. Any report required by 30 ILCS 708/125 may be detailed in PART TWO or PART THREE. Grantee must report to Grantor on the performance measures listed in Exhibit D, PART TWO or PART THREE at the intervals specified by Grantor, which must be no less frequent than annually and no more frequent than quarterly, unless otherwise specified in PART TWO, PART THREE, or Exhibit E pursuant to specific award conditions. For certain construction-related Awards, such reports may be exempted as identified in PART TWO or PART THREE. 2 CFR 200.329. Under Exhibit D, Performance Measures and Standards, states that the Grantee shall provide a quarterly Reimbursement Request and Reporting Form to IEMA-OHS within thirty (30) days after the end of the quarter throughout the performance period of the Agreement. The Grantee must submit a final Reimbursement Request and Reporting Form to the Grantor within 30 days after the expiration of the Agreement, or within 30 days of completion of all approved projects, whichever occurs first. Performance standards include: 1. Appropriate use of grant funds in accordance with the approved scope of work and budget outlined in Section 2.3, and the terms outlined in this Agreement; 2. The timely submittal of required documentation, as defined in this Agreement; and 3. Adequate results from grant monitoring conducted by the Grantor. CONDITION During the current audit period, Cook County Department of Emergency Management and Regional Security (DEMRS) did not comply with the reporting requirements as outlined in its grant agreement(s). CAUSE Based on discussions with management, this finding occurred due to significant turnover in key finance and grants management positions, which created gaps in continuity and delayed the Department’s transition to IEMA’s Amplifund reporting system. As prior management departed and new staff were onboarded, the Department faced operational challenges that affected the consistency of its grant reporting processes. Due to Amplifund’s requirement that reimbursement requests be submitted sequentially before performance reports can be filed, the delays in prior‑period submissions prevented DEMRS from accessing and submitting the quarterly reports. Statewide pauses in FEMA and IEMA grant processing further contributed to the backlog. EFFECT Failure to prepare and submit required reports is a violation of federal regulations and impairs the grantor agency’s ability to adequately monitor the program activities/federally funded program and could result in the loss of grant funding. QUESTIONED COSTS None. CONTEXT During the County’s fiscal year ended November 30, 2025, DEMRS had four (4) active grant agreements with IEMA, which represented a total of 16 quarterly reimbursement requests (reports) and 1 final close-out report that were required to be submitted during this period. As a result, we selected for review a total of 8 quarterly reports and the 1 final close-out report required under the 2021 IEMA grant agreement, which ended August 31, 2025. Based on discussions with management and review of the grantor payment request portal, we noted DEMRS did not submit any of the required quarterly reports due under the 2022, 2023 and 2024 grant agreements. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DEMRS develop and implement procedures to ensure required reports are prepared, reviewed, and submitted in a timely manner and in compliance with its grant agreements A compliance calendar of all future grants reporting due dates should be maintained to assist with ensuring future compliance with reporting requirements. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 48.

Cash Management Federal Department – U.S. Department of Justice Pass-through Illinois Criminal Justice Information Authority Federal Award Identification Number and Year: 15JOVW-21-GG-00543-STOP and 2021 15JOVW-22-GG-00422-STOP and 2022 Violence Against Women Formula Grants, Federal Assistance Listing #16.588 County Department – State’s Attorney Office Finding 2024 – 001 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements Standards for Financial and Program Management, Section 200.305 Federal Payment (b)(3) Payments for recipients and subrecipients other than States requires that, “Reimbursement is preferred when the requirements in paragraph (b) cannot be met, when the Federal agency or pass-through entity sets a specific condition per Section 200.208, when requested by the recipient or subrecipient, when a Federal award is for construction, or when a significant portion of the construction project is accomplished through private market financing or Federal loans and the Federal award constitutes a minor portion of the project. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper.” CONDITION During the current audit period, the Cook County State’s Attorney Office (SAO) did not adequately comply with its cash management requirements in accordance with federal regulations. CAUSE Based on discussions with management, a portion of the late payments resulted from the SAO’s Program Managers being unable to provide sufficient documentation demonstrating that the delays were due to late invoice submissions by subrecipients. As a result, the Auditor could not verify whether the non-compliance was attributable to subrecipient actions. The remaining delays were due to weaknesses in the payment processing system, which relied heavily on email communications between involved parties. These emails, initiated by the Accounts Payable Processor, were not acted upon in a timely manner, resulting in payments being processed well over the thirty (30) days after initial submission. EFFECT The failure to pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s billing or payment request is a violation of federal regulations. This could impact the subrecipient’s ability to adequately perform its programmatic responsibilities under the program. QUESTIONED COSTS None. CONTEXT During our test of 29 subrecipients’ expenditures, we noted 17 instances where payments to the subrecipients’ were not made within 30 days after receipt of the subrecipient’s payment request. The payments were submitted late, ranging from 2 to 313 days late. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that SAO develop and implement procedures to ensure payments to subrecipients are made within 30 days after receipt of the subrecipients billing or payment request, as required. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 38.

Subrecipient Monitoring Federal Department – U.S. Department of Justice Pass-through Illinois Criminal Justice Information Authority Federal Award Identification Number and Year: 15JOVW-21-GG-00543-STOP and 2021 15JOVW-22-GG-00422-STOP and 2022 Violence Against Women Formula Grants, Federal Assistance Listing #16.588 County Department – State’s Attorney Office Finding 2024 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4)Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. CONDITION During the current audit period, the Cook County State’s Attorney Office (SAO) did not adequately comply with its subrecipient monitoring requirements as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding was an inadequate understanding of sub-recipient monitoring policies and best practices. While the Department believed at the time that they were in compliance with the applicable monitoring requirements, they now recognize that their efforts did not fully meet the necessary standards. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in the inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of two (2) subrecipients (of a population of 4 subrecipients), we noted the following:  For both subrecipients, we noted documentation was not maintained to support SAO’s evaluation of the subrecipients’ risk of noncompliance and the frequency of monitoring to be conducted by SAO based on the assessed risk.  We also noted for both subrecipients, no documentation was provided to verify whether the subrecipients were required to have a Single Audit conducted, including SAO’s review of the report, and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.332e(3).  The SAO utilized a “Subrecipient Monitoring Checklist” (Checklist) to conduct and document its monitoring of subrecipients. Based on review, we noted the Checklist does not include evidence of who completed the monitoring, the date the actual monitoring was performed nor the subrecipient personnel with whom the monitoring results were discussed during the site visit. Also, the Checklist appears to be inaccurately completed. Specifically, we noted the Checklist noted that the results include expected corrective actions and dates for resolution. However, there was no finding or issues noted in the formal letter submitted to the subrecipient(s) after the site visit(s). IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend SAO implement procedures to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance and review of the Single audit report, as required by Federal regulations. Also, we suggest that the Checklist be accurately prepared and updated to include evidence of who completed the monitoring, the date the actual monitoring was performed, and the subrecipient personnel with whom the monitoring results were discussed during the site visit. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 38-39.

Reporting Federal Department – U.S. Department of Treasury Pass-through Illinois Department of Human Services Federal Award Identification Number and Year: SLFRP4406 and 2021 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds, Federal Assistance Listing #21.027 County Department – Justice Advisory Council Finding 2024 – 003 CRITERIA As required by the grant agreement with the State of Illinois, Department of Human Services (IDHS), Exhibit B, Deliverables. 4. Reporting Requirements, states “i. Pursuant to Paragraph 13.1 and 13.2 Cook County will submit monthly, quarterly and final Periodic Financial Reports (PFRs) in the format prescribed by IDHS. The monthly, quarterly and final Periodic Financial Reports must be submitted no later than the 15th of each month for the preceding month or quarter by email. The final year-end report (July 1st - June 30th) will be due on or before July 15th or no more than 30 days following grant termination. ii. Pursuant to Paragraph 13.1 and 13.2 Cook County will submit quarterly and final Periodic Performance Reports (PPRs) in the format prescribed by IDHS. Quarterly and Final Periodic Performance Reports are due no later than the 15th of each month for the preceding quarter by email. Quarter 1 (July 1st - September 30th) due October 15th, Quarter 2 (October 1st- December 31st) due January 15th, Quarter 3 (January 1st- March 31st) due April 15th, and Quarter 4 (April 1st- June 30th) due July 15th). The final year-end report (July 1st -June 30th) will be due on or before July 15th or no more than 30 days following grant termination. Performance reports will include a detailed account of how Cook County is ensuring compliance with 2 CFR 200.332. iii. Annual Program Application Plan: Providers are required to submit an Annual Program Application/Plan each year. Annual Program Plans for Programs exempt from 30 ILCS 708 (GATA) or during a renewal year will be due in April/May of each year for the upcoming program year.” CONDITION During the current audit period, Cook County Justice Advisory Council (JAC) did not comply with the reporting requirements as outlined in its grant agreement. CAUSE Based on discussions with management, the March 2024 monthly financial finding occurred due to reconciling actual expenditures for the 5-month grant period close-out. The quarterly performance report finding occurred due to an adjusted 30 days reporting schedule allowed verbally by the grantor. EFFECT Failure to submit reports in a timely manner could impair the grantor agency’s ability to monitor program activities and could result in the loss of grant funding. QUESTIONED COSTS None. CONTEXT During our review, we noted the IDHS grant agreement ended on June 30, 2024, which represented seven months of required reporting to be submitted during the County’s fiscal year. As a result, we reviewed a total of eight reports submitted (three monthly financial (of a population of 7 monthly reports), one quarterly financial and one quarterly performance report (of a population of 2 quarterly financial and performance reports), one final financial and one final performance report, and one annual program application plan report), and noted 2 of the eight reports reviewed were submitted late. See Finding for Chart/ Table. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend JAC develop and implement procedures to ensure reports are submitted in a timely manner and in compliance with its grant agreement. A compliance calendar of all future grants reporting due dates should be maintained to assist with ensuring future compliance with reporting requirements. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 40-41.

Special Tests and Provisions Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: E-20-UW-17-0001 and 2020 E-22-UC-17-0001 and 2022 Emergency Solutions Grant Program, Federal Assistance Listing #14.231 County Department – Department of Planning and Development Finding 2023 – 001 CRITERIA 24 CFR Part 576, Emergency Solutions Grants Program, Subpart C - Award and Use of Funds, Section 576.203 Obligations, expenditure, and payments requirements (c) Payments to Subrecipients states, “The recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s complete payment request. This requirement also applies to each subrecipient that is a unit of generalpurpose local government.” CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not adequately comply with its special tests and provisions requirements in accordance with federal regulations. CAUSE Based on discussions with management, this finding occurred due to the DPD receiving invoices from subrecipients that had missing support documentation or included incorrect support documentation. The DPD has hired new staff that will assist with training subrecipients on submission of invoices. EFFECT The failure to pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s complete payment request is a violation of federal regulations. This could impact the subrecipient’s ability to adequately perform its programmatic responsibilities under the program. QUESTIONED COSTS None. CONTEXT During the prior audit period, we noted four instances (of 44 subrecipients’ expenditures) where payments to the subrecipients were not made within 30 days after receiving the subrecipient’s complete payment request, as required. This resulted in the 2022 audit finding and subsequent corrective action planned prepared by DPD to address the finding, which included corrective action planning to be implemented on future grants as this grant will close in September 2023. During the current audit period, we received DPD’s current year status of the prior audit finding, noting that the corrective action plan discussed and implemented did not address the issues which were noted in the 2022 audit finding. Furthermore, we tested 40 subrecipients’ expenditures, noted four instances where payments to the subrecipients were not made within 30 days after receiving the subrecipient’s complete payment request, as required. The payments were submitted late, ranging from 13 to 74 days late. Also, we noted that for two of these subrecipients’ expenditures the payment request occurred after September 2023. IDENTIFICATION OF REPEATED FINDINGS Repeated (Prior Finding No. 2022-002) RECOMMENDATION We recommend that DPD develop and implement procedures to ensure payments to subrecipients are made within 30 days after receipt of the subrecipients complete payment request, as required. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 53.

Reporting Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year(s): B-13BUS-17-0001 and 2013 CDBG - Disaster Recovery Grants - Pub. L. No. 113-2 Cluster: Hurricane Sandy Community Development Block Grant Disaster Recovery Grants (CDBG-DR), Federal Assistance Listing #14.269 County Department – Department of Planning and Development Finding 2023 – 002 CRITERIA Per the 2013 Funding approval/agreement with the U.S. Department of Housing and Urban Development (HUD), Item 6 states, “The grantee shall comply with requirements established by the Office of Management and Budget (OMB) concerning the Dun and Bradstreet Data Universal Numbering System (DUNS), the System or Award Management (SAM) Central Contractor Registration database, and the Federal Funding Accountability and Transparency Act, including Appendix A to Part 25 of the Financial Assistance Use of Universal Identifier and Central Contractor Registration, 75 Fed. Reg. 55671 (Sept. 14, 2010) (to be codified at 2 CFR part 25) and Appendix A to Part 170 of the Requirements for Federal Funding Accountability and Transparency Act Implementation, 75 Fed. Reg. 55663 (Sept. 14, 2010) (codified at 2 CFR part 170).” The Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) website states, “FSRS is the reporting tool Federal prime awardees (i.e. prime contractors and prime grants recipients) use to capture and report subaward and executive compensation data regarding their first-tier subawards to meet the FFATA reporting requirements. Prime contract awardees will report against subcontracts awarded, and prime grant awardees will report against sub-grants awarded.” In addition, “Prime Grant Recipients awarded a new Federal grant greater than or equal to $30,000 as of October 1, 2010 are subject to FFATA sub-award reporting requirements as outlined in the Office of Management and Budgets guidance issued August 27, 2010. The prime awardee is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000.” In accordance with 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, Appendix A, Award Term, b. 1. Reporting total compensation of recipient executives for non-Federal entities, states, “You must report total compensation for each of your five most highly compensated executives for the preceding completed fiscal year, if - i. The total Federal funding authorized to date under this Federal award equals or exceeds $30,000 as defined in 2 CFR 170.320; ii. in the preceding fiscal year, you received— (A) 80 percent or more of your annual gross revenues from Federal procurement contracts (and subcontracts) and Federal financial assistance subject to the Transparency Act, as defined at 2 CFR 170.320 (and subawards), and (B) $25,000,000 or more in annual gross revenues from Federal procurement contracts (and subcontracts) and Federal financial assistance subject to the Transparency Act, as defined at 2 CFR 170.320 (and subawards); and, iii. The public does not have access to information about the compensation of the executives through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986. 2. Where and when to report. You must report executive total compensation described in paragraph b.1. of this award term: i. As part of your registration profile at https://www.sam.gov. ii. By the end of the month following the month in which this award is made, and annually thereafter.” CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not comply with its FFATA reporting requirements as outlined in its grant agreement and federal regulations. CAUSE Based on discussions with management, this finding occurred due to not reporting FFATA information for one subrecipient that was awarded in fiscal year 2023 for the CDBG-DR grant. EFFECT Failure to prepare and submit required reports is a violation of federal regulations and impairs the grantor agency’s ability to adequately monitor the program activities/federally funded program. QUESTIONED COSTS None. CONTEXT We noted a total of 37 subrecipients received a sub-award greater than $30,000 in the prior fiscal year(s). Of these 37 subrecipients, we noted 7 had grant disbursements during the County’s fiscal year 2023 and hence, should have been subject to FFATA Subaward reporting. Based on our follow up discussions with DPD personnel, of the 37 subrecipients awarded, only one (1) subrecipient received a new sub-award during fiscal year 2023. Consequently, we were not provided with any evidence that DPD submitted any reporting information as required under the FFATA Subaward Reporting, in the FSRS system. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DPD develop and implement procedures to ensure required reports are prepared, reviewed, and submitted in a timely manner and in compliance with its grant agreement and federal regulations. Per federal regulations, prime grant recipients awarded a new federal grant greater than or equal to $30,000 as of October 1, 2010, are subject to FFATA sub-award reporting requirements as outlined in the Office of Management and Budgets guidance issued August 27, 2010. The prime awardee (i.e., County DPD) is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If any federal requirement is unclear, we recommend that DPD reach out to its grantor agency for additional clarification and guidance. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 53.

Special Tests and Provisions (Reporting) Federal Department – U.S. Department of Transportation Pass-through Illinois Department of Transportation Highway Planning and Construction, Federal Assistance Listing #20.205 County Department – Department of Transportation and Highway Finding 2023 – 003 CRITERIA As required by the grant agreement(s) with the State of Illinois, Department of Transportation (IDOT), grantee agrees to submit periodic financial and performance reporting on the approved IDOT BoBS 2832 form. Grantee shall file quarterly BoBS 2832 reports with grantor describing the expenditure(s) of the funds and performance measures related thereto. Quarterly reports must be submitted no later than 30 calendar days following the period covered by the report. For the purpose of reconciliation, the grantee must submit a BoBS 2832 report for the period ending 11/30. BoBS 2832 report marked as "Final Report" must be submitted to the grantor 60 days after the end date of the agreement. Failure to submit the required BoBS 2832 reports may cause a delay or suspension of funding. The grant agreement also states that “pursuant to 2 CFR 200.328, periodic performance reports shall be submitted no later than 30 calendar days following the period covered by the report.” CONDITION During the current audit period, Cook County Department of Transportation and Highway (DOTH) did not comply with the reporting requirements as outlined in its grant agreement(s). CAUSE Based on discussions with management, this finding was the result of working with consultants who had not previously submitted reports of this nature. The reports they produced required multiple revisions due to errors which lead to DOTH failing to submit the reports in a timely manner. EFFECT Failure to submit reports in a timely manner could impair the grantor agency’s ability to monitor program activities and could result in the loss of grant funding. Also, the failure to ensure accurate amounts are reported could result in the over-reporting and future spending of grant funds. QUESTIONED COSTS None. CONTEXT During our review of seven reports submitted (five quarterly reports and two annual BoBS periodic performance and financial) under three DOTH grants, we noted the 2 annual reports were submitted late. See Finding for chart/table. In addition, for grant C-91-381-19 report, we noted that the “remaining balance available” amount included in the report was overstated by $15,924. This occurred due to a recalculation error in the report. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DOTH develop and implement procedures to ensure reports are submitted in a timely manner and in compliance with its grant agreements. A compliance calendar of all grants reporting due dates should be maintained to assist with ensuring compliance with reporting requirements. In addition, we recommend DOTH ensure all amounts included on grant reports are accurately calculated and reported. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 54.

Cash Management Federal Department – U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing #93.391 County Department – Department of Public Health Finding 2023 – 004 CRITERIA Federal regulations (45 CFR Part 75.305) Payment. (b) (3) states that reimbursement is the preferred method when the requirements in paragraph (b) cannot be met, when the US Department of Health and Human Service (HHS) awarding agency sets a specific condition per Section 75.207 or when the non- Federal entity requests payment by reimbursement. When the reimbursement method is used, the HHS awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the HHS awarding agency or pass-through entity reasonably believes the request to be improper. CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not adequately comply with its cash management requirements in accordance with federal regulations. CAUSE Based on discussions with management, the cause of this finding is due to 1) instances of misplaced and/or lost vendor invoices preventing them from submitting the invoice to Finance for processing, 2) lack of personnel resources and staff turnover resulting in invoice review, approval, and submission delays, 3) vendor/subrecipient contract execution delays, 4) delays in processing invoices due to verification of invoices for a) invoice date, b) description of services, c) amounts requested, d) allowability; if stated information is missing, then invoices are returned to the vendor, accordingly; if invoice submitted to DPH/Cook County Health (CCH) Finance, then the invoices are returned to the program staff. EFFECT The failure to pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s billing or payment request is a violation of federal regulations. This could impact the subrecipient’s ability to adequately perform its programmatic responsibilities under the program. QUESTIONED COSTS None. CONTEXT We noted DPH does not currently track the receipt date on invoices submitted by the subrecipients. As a result, we were unable to verify if payments to the subrecipients were made within 30 days after receipt of the subrecipient’s billing. To perform our testing, we utilized the invoice date on the billings provided by the subrecipients to determine if payments were made within the 30-day requirement. Specifically, during our test of 24 subrecipients’ expenditures, we noted 15 instances where payments to the subrecipients’ appear to be submitted late, ranging from 2 to 248 days late. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DPH develop and implement procedures to ensure payments to subrecipients are made within 30 days after receipt of the subrecipients billing or payment request, as required. Also, we suggest DPH include a date stamp of the receipt date on each invoice to ensure compliance with the 30-day requirement. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 55.

Subrecipient Monitoring Federal Department – U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing #93.391 County Department – Department of Public Health Finding 2023 – 005 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.332. Requirements for pass-through entities, requires that “All pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F—Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in Section 200.208 Specific conditions. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in Section 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F— Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in Section 200.501 Audit requirements. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in Section 200.338 Remedies for noncompliance of this part and in program regulations.” CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not adequately comply with its subrecipient monitoring requirements in accordance with federal regulations. CAUSE Based on discussions with management, the cause of this finding was due to DPH/CCH identifying a consultant agency to conduct the subrecipient monitoring; this was accomplished October 2023. Current Status: These documents were created, shared with the auditor pending management approval; 1) Subrecipient Monitoring Policy 2). Subrecipient Commitment Form 3). Subrecipient Determination Tool 4). Subrecipient Risk Assessment and Monitoring Guide. EFFECT Failure to adequately monitor the activities and performance of a subrecipient could result in Federal awards being used for unauthorized purposes and DPH’s inability to adequately perform risk assessments on its subrecipient(s). QUESTIONED COSTS None. CONTEXT During the prior audit period, we noted 6 instances (of 27 subrecipients), whereby adequate documentation was not maintained to support both the financial and programmatic monitoring of these subrecipients. Also, we noted no evidence of the performance of subrecipients’ risk assessment and whether the subrecipients were required to have a Single audit conducted. This resulted in the 2022 audit finding and subsequent corrective action planned prepared by DPH to address the finding, which was anticipated to be completed by December 31, 2023. During the current audit period, we received DPH’s current year status of the prior audit finding, noting that risk assessment and monitoring will be ongoing during the 2023 Single audit. To assess the current year’s status, we reviewed 5 of 35 subrecipients, noting that risk assessments were conducted in April 2024. We also noted that 4 of the 5 subrecipients reviewed were subject to a Single Audit per the risk assessment documentation. However, we noted no evidence financial monitoring conducted, including whether a Single Audit report was obtained and reviewed by DPH. IDENTIFICATION OF REPEATED FINDINGS Repeated (Prior Finding No. 2022-009) RECOMMENDATION We recommend DPH implement its prior corrective action plan for any future subrecipients awarded under the federal program. Also, procedures should be in place to adequately document financial monitoring conducted, as well as the review of the Single Audit report, as required by federal regulations. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 56.

Subrecipient Monitoring Federal Department – U.S. Department of Health and Human Services Federal Award Identification Number and Year: NU58DP006993 and 2022/2023 COVID-19 - Community Health Workers for Public Health Response and Resilient, Federal Assistance Listing #93.495 County Department – Department of Public Health Finding 2023 – 006 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.332. Requirements for pass-through entities, requires that “All pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F—Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in Section 200.208 Specific conditions. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in Section 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F— Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in Section 200.501 Audit requirements. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in Section 200.338 Remedies for noncompliance of this part and in program regulations.” CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not perform adequate monitoring of its subrecipients as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding was due to DPH/CCH identifying a consultant agency to conduct the subrecipient monitoring; this was accomplished October 2023. Current Status: These documents were created, shared with the auditor pending management approval; 1) Subrecipient Monitoring Policy 2). Subrecipient Commitment Form 3). Subrecipient Determination Tool 4). Subrecipient Risk Assessment and Monitoring Guide. EFFECT Failure to adequately monitor the activities and performance of a subrecipient could result in Federal awards being used for unauthorized purposes and DPH’s inability to adequately perform risk assessments on its subrecipient(s). QUESTIONED COSTS None. CONTEXT During the current audit period, we noted 12 subrecipients were awarded funds. During our review of three (3) subrecipients, we noted the following:  For all three subrecipients, we noted that adequate documentation was not maintained to support the financial monitoring of these subrecipients. Also, no documentation was provided to verify whether the subrecipients were required to have a Single Audit conducted, including DPH’s review of the report, and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.332d(3).  For one subrecipient, we noted documentation was not maintained to support DPH’s evaluation of the subrecipient’s risk of noncompliance and the frequency of monitoring to be conducted by DPH based on the assessed risk. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPH implement procedures to ensure that adequate documentation is maintained to support financial monitoring conducted, evaluation of each subrecipient’s risk of noncompliance and review of the Single Audit report, as required by federal regulations. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 56.

Reporting Federal Department ? U.S. Department of Housing and Urban Development Federal Award Identification Number and Year(s): B-20-UC-17-0001 and 2020/2021 B-20-UW-17-001 and 2021 CDBG ? Entitlement Grants Cluster: Community Development Block Grants/Entitlement Grants, Federal Assistance Listing #14.218 County Department ? Department of Planning and Development Finding 2022 ? 001 CRITERIA Per the 2021 Funding approval/agreement with the U.S. Department of Housing and Urban Development (HUD), Section 8 Special Conditions (c) states, ?In addition to the conditions contained on form HUD 7082, the grantee shall comply with requirements established by the Office of Management and Budget (OMB) concerning the Dun and Bradstreet Data Universal Numbering System (DUNS); the System for Award Management (SAM.gov.); the Federal Funding Accountability and Transparency Act as provided in 2 CFR part 25, Universal Identifier and General Contractor Registration; and 2 CFR part 170, Reporting Subaward and Executive Compensation Information.? The Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) website states, ?FSRS is the reporting tool Federal prime awardees (i.e. prime contractors and prime grants recipients) use to capture and report subaward and executive compensation data regarding their first-tier subawards to meet the FFATA reporting requirements. Prime contract awardees will report against sub-contracts awarded, and prime grant awardees will report against sub-grants awarded.? In addition, ?Prime Grant Recipients awarded a new Federal grant greater than or equal to $30,000 as of October 1, 2010 are subject to FFATA sub-award reporting requirements as outlined in the Office of Management and Budgets guidance issued August 27, 2010. The prime awardee is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000.? In accordance with 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, Appendix A, Award Term, b. 1. Reporting total compensation of recipient executives for non-Federal entities, states, ?You must report total compensation for each of your five most highly compensated executives for the preceding completed fiscal year, if - i. The total Federal funding authorized to date under this Federal award equals or exceeds $30,000 as defined in 2 CFR 170.320; ii. in the preceding fiscal year, you received? (A) 80 percent or more of your annual gross revenues from Federal procurement contracts (and subcontracts) and Federal financial assistance subject to the Transparency Act, as defined at 2 CFR 170.320 (and subawards), and (B) $25,000,000 or more in annual gross revenues from Federal procurement contracts (and subcontracts) and Federal financial assistance subject to the Transparency Act, as defined at 2 CFR 170.320 (and subawards); and, iii. The public does not have access to information about the compensation of the executives through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986. 2. Where and when to report. You must report executive total compensation described in paragraph b.1. of this award term: i. As part of your registration profile at https://www.sam.gov. ii. By the end of the month following the month in which this award is made, and annually thereafter.? SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Reporting Federal Department ? U.S. Department of Housing and Urban Development Federal Award Identification Number and Year(s): B-20-UC-17-0001 and 2020/2021 B-20-UW-17-001 and 2021 CDBG ? Entitlement Grants Cluster: Community Development Block Grants/Entitlement Grants, Federal Assistance Listing #14.218 County Department ? Department of Planning and Development Finding 2022 ? 001 (Continued) CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not comply with its FFATA reporting requirements as outlined in its grant agreement and federal regulations. CAUSE Based on discussions with management, this finding occurred due to establishing threshold requirements for subrecipient reporting. DPD collects information annually from sub-recipients receiving CDBG grant funds. Awarded subrecipients are required to submit self-attestation forms to DPD hosted grant workshops. The completed forms determine the subrecipient reporting requirements. In 2022, selected subrecipients did not meet the threshold for reporting salaries of top executives as determined by the federal regulations. EFFECT Failure to prepare and submit required reports is a violation of federal regulations and impairs the grantor agency?s ability to adequately monitor the program activities/federally funded program. QUESTIONED COSTS None. CONTEXT Based on our review of the fiscal year 2022 grant disbursements, we noted a total of 45 subrecipients had expenditures greater than $30,000. We selected 9 subgrantee (subrecipients) for review and noted that DPD did not submit any reporting information as required under the FFATA Subaward Reporting, in the FSRS system. IDENTIFICATION OF REPEATED FINDINGS None. SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Reporting Federal Department ? U.S. Department of Housing and Urban Development Federal Award Identification Number and Year(s): B-20-UC-17-0001 and 2020/2021 B-20-UW-17-001 and 2021 CDBG ? Entitlement Grants Cluster: Community Development Block Grants/Entitlement Grants, Federal Assistance Listing #14.218 County Department ? Department of Planning and Development Finding 2022 ? 001 (Continued) RECOMMENDATION We recommend that DPD develop and implement procedures to ensure required reports are prepared, reviewed, and submitted in a timely manner and in compliance with its grant agreement and federal regulations. Per federal regulations, prime grant recipients awarded a new federal grant greater than or equal to $30,000 as of October 1, 2010, are subject to FFATA sub-award reporting requirements as outlined in the Office of Management and Budgets guidance issued August 27, 2010. The prime awardee, County DPD, is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If any federal requirement is unclear, we recommend that DPD reach out to its grantor agency for additional clarification and guidance. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County?s corrective action plan is on page 60.

Special Tests and Provisions Federal Department ? U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: E-20-UW-17-0001 and 2020 E-20-UC-17-0001 and 2020 Emergency Solutions Grant Program, Federal Assistance Listing #14.231 County Department ? Department of Planning and Development Finding 2022 ? 002 CRITERIA 24 CFR Part 576, Emergency Solutions Grants Program, Subpart C - Award and Use of Funds, Section 576.203 Obligations, expenditure, and payments requirements (c) Payments to Subrecipients states, ?The recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient?s complete payment request. This requirement also applies to each subrecipient that is a unit of general-purpose local government.? CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not adequately comply with its special tests and provisions requirements in accordance with federal regulations. CAUSE Based on discussions with management, this finding occurred because the ESG program has a complicated billing structure which includes five (5) different spending areas from which a subrecipient can select for payment. This complicated billing structure forces DPD staff to provide an extensive amount of technical assistance to various subrecipients due to incorrect invoice submissions. Many of the subrecipients are understaffed and lack the capacity to bill properly. DPD staff spent a significant amount of time providing technical assistance to subrecipients with the preparation of requests for reimbursements. EFFECT The failure to pay each subrecipient for allowable costs within 30 days after receiving the subrecipient?s complete payment request is a violation of federal regulations. This could impact the subrecipient?s ability to adequately perform its programmatic responsibilities under the program. QUESTIONED COSTS None. SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Special Tests and Provisions Federal Department ? U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: E-20-UW-17-0001 and 2020 E-20-UC-17-0001 and 2020 Emergency Solutions Grant Program, Federal Assistance Listing #14.231 County Department ? Department of Planning and Development Finding 2022 ? 002 (Continued) CONTEXT During our test of 44 subrecipients? expenditures, we noted four instances where payments to the subrecipients were not made within 30 days after receiving the subrecipient?s complete payment request, as required. The payments were submitted late, ranging from 46 to 140 days late. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DPD develop and implement procedures to ensure payments to subrecipients are made within 30 days after receipt of the subrecipients complete payment request, as required. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County?s corrective action plan is on pages 60-61.

Eligibility Federal Department ? U.S. Department of Treasury Pass-through the Illinois Department of Human Services COVID-19- Emergency Rental Assistance Program, Federal Assistance Listing #21.023 County Department ? Department of Planning and Development Finding 2022 ? 003 CRITERIA Per the U.S Department of the Treasury, Emergency Rental Assistance, Frequently Asked Questions, revised July 27, 2022 (FAQ), ?In ERA 1, an eligible household may receive up to twelve (12) months of assistance (plus an additional three (3) months if necessary to ensure housing stability for the household, subject to the availability of funds). The aggregate amount of financial assistance an eligible household may receive under ERA 2, when combined with financial assistance under ERA 1, must not exceed 18 months.? In addition, the FAQ states, ?In ERA1, financial assistance for prospective rent payments is limited to three months based on any application by or on behalf of the household, except that the household may receive assistance for prospective rent payments for additional months (i) subject to the availability of remaining funds currently allocated to the grantee, and (ii) based on a subsequent application for additional assistance. In no case may an eligible household receive more than 18 months of assistance under ERA 1 and ERA 2, combined.? CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not adequately comply with federal regulations over eligibility requirements. CAUSE Based on discussions with management, this finding occurred due to an oversight in the procedure to check payments for the monthly cap of eighteen months by a reviewer, as the system did not have a calculated field on ?number of months? paid with a built-in cap that was subsequently added to the application system to limit payments to the cap number of months (18) for ERA I, ERA II combined. EFFECT The failure to ensure rental assistance payments are made during the periods allowed under the program is a violation of federal regulations. This could result in ineligible participants being paid/charged to the federally funded program. QUESTIONED COSTS We noted total potential questioned costs in the amount of $12,712. SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Eligibility Federal Department ? U.S. Department of Treasury Pass-through the Illinois Department of Human Services COVID-19- Emergency Rental Assistance Program, Federal Assistance Listing #21.023 County Department ? Department of Planning and Development Finding 2022 ? 003 (Continued) CONTEXT During our test of 40 participants, we noted a total of 5 participants received ERA 1 and/or ERA 2 rental assistance payments either beyond the maximum period allowed or during ineligible periods. Specifically, we noted the following: *Two participants received ERA 1 payments beyond the 15 months allowed. *One participant received both ERA 1 and ERA 2 payments beyond the 18 months allowed. *One participant was overpaid 3 months of future rental assistance payment. *One participant received rental assistance payment before March 13, 2020, the date of the emergency declaration pursuant to section 501(b) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. 5191(b), which were during ineligible periods. These issues resulted in the overpayment of rental assistance during fiscal year 2022 totaling $12,712. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DPD develop and implement procedures to ensure compliance with federal regulations. Also, procedures should be in place to ensure rental assistance payments does not exceed the maximum period allowed under the program and is within the periods allowed. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County?s corrective action plan is on page 61.

Inadequate Controls over Allowable Costs Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH23IP922637 and 2021 Pass-through the Illinois Department of Public Health COVID-19 ? Immunization Cooperative Agreements, Federal Assistance Listing #93.268 County Department ? Department of Public Health Finding 2022 ? 004 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, ?The non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and terms and conditions of the Federal award.? Subpart E ? Cost Principles, Section 200.403 states costs must meet the following general criteria in order to be allowable under Federal awards: ?(a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. ?(g) Be adequately documented.? In addition, Subpart E ? Cost Principles, Section 200.430 (i)(1) Standards for Documentation of Personal Expenses, states, ?Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; and (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities.? CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not maintain adequate controls over allowable costs as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding resulted from Program Leads and the Accounts Payable unit not following the established requirements for properly supporting invoices for services provided. The invoices that were attached in EBS Oracle were insufficient as required by the established County Policy. SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Inadequate Controls over Allowable Costs Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH23IP922637 and 2021 Pass-through the Illinois Department of Public Health COVID-19 ? Immunization Cooperative Agreements, Federal Assistance Listing #93.268 County Department ? Department of Public Health Finding 2022 ? 004 (Continued) EFFECT The failure to maintain adequate support and/or documentation evidencing the review of actual time spent by employees on the program is a violation of federal regulations and could result in additional payroll costs being charged to the federally funded program. QUESTIONED COSTS None. CONTEXT During our test of 35 expenditures, we were provided invoices supporting the total charges to the program. However, we noted 12 of the invoices reviewed included payroll related charges, of which we were unable to determine that DPH reviewed the detailed payroll records (such as time and effort reports) of those employees charged to the grant to verify that the related services were performed and were within the period specified on the invoices. This was due to the fact, that information was not maintained in the Oracle accounting system. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPH develop and implement procedures to ensure all expenditures, including personnel costs, are properly reviewed, approved, and supporting documentation maintained in accordance with federal regulations and the County?s policy. Once procedures are developed, adequate staff training should be conducted to ensure all program/grant finance personnel are familiar with the requirements. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County?s corrective action plan is on page 62.

Allowable Costs Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: 6NU5OCK000559-01-08 and 2020 Pass-through Illinois Department of Public Health COVID-19 ? Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Federal Assistance Listing #93.323 County Department ? Department of Public Health Finding 2022 ? 005 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, ?The non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and terms and conditions of the Federal award.? Subpart E ? Cost Principles, Section 200.403 states costs must meet the following general criteria in order to be allowable under Federal awards: ?(a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. ?(g) Be adequately documented.? CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not adequately comply with federal regulations over allowable costs. CAUSE Based on discussions with management, the cause of this finding resulted from not following the established controls that ensure proper support documentation is included with the journal entry chargeback entries prepared by Finance staff to justify the charges incurred to the Grant. Additionally, the Program Lead (key personnel) assigned to the program left the organization prior to the Grant ending which affected the periodic review for allowable costs/charges. EFFECT The failure to maintain adequate supporting documentation and to ensure all expenditures are allowable, reasonable, and properly reviewed and approved resulted in the identification of questioned costs and is a violation of federal regulations. QUESTIONED COSTS We noted total potential questioned costs in the amount of $336,583. SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Allowable Costs Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: 6NU5OCK000559-01-08 and 2020 Pass-through Illinois Department of Public Health COVID-19 ? Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Federal Assistance Listing #93.323 County Department ? Department of Public Health Finding 2022 ? 005 (Continued) CONTEXT During fiscal year 2022, we noted total program expenditures were incurred under five grant agreements (three with the Illinois Department of Public Health (IDPH) and two with the City of Chicago). For the IDPH grants, we tested 6 expenditure samples (from a population of 28), noting for two expenditures (totaling $1,618,957), adequate documentation was not initially provided to support the total amount charged to the program. As a result, DPH management subsequently provided a reconciliation of additional grant expenditures to support these charges. Upon further review, we noted that only $1,282,374 represents allowable costs that could be charged to the program, as other amounts noted were previously transferred to the grant in prior periods. The unreconciled difference of $336,583 remains unsupported and as such, represented potential questioned costs under the IDPH funded portion of the program. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPH ensure adequate documentation is maintained to support charges to the federal program and comply with federal regulations. Also, procedures should be developed and implemented to ensure all expenditures are allowable, reasonable, and properly reviewed and approved prior to charging the expenditures to the federally funded program. Finally, periodic and timely reconciliation of grant activities should be performed to ensure only allowable costs are being reported under the program. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County?s corrective action plan is on page 63.

Reporting Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NU50CK000556 and 2020 Pass-through City of Chicago, Department of Public Health COVID-19 ? Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Federal Assistance Listing #93.323 County Department ? Cook County Health Finding 2022 ? 006 CRITERIA As required by the grant agreement with the City of Chicago, the grantee must submit detailed monthly requisitions for reimbursement identifying the payment due for the services performed and/or costs incurred and paid directly by grantee. The requisitions must be submitted within 15 calendar days after the end of the month in which the grantee performed services and/or incurred and paid costs. CONDITION During the current audit period, Cook County Health (CCH) did not comply with the reporting requirements as outlined in its grant agreement. CAUSE Based on discussions with management, this finding occurred due to the grant agreement received from the City of Chicago was executed late and insufficient internal controls were in place to ensure the grant was assigned to the Department?s Grant vouchering tracking schedule to determine when the grant monthly voucher reports are due to the City of Chicago. EFFECT Failure to submit reports in a timely manner impairs the grantor agency?s ability to monitor program activities and could result in the loss of grant funding. Also, the failure to ensure expenditures included in the reports submitted to the grantor agency resulted in the under-reporting of grant expenditures on the schedule of expenditures of federal awards. QUESTIONED COSTS None. CONTEXT During our review of four monthly reports submitted under the City of Chicago grants, we noted two reports were submitted late, as noted below: SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Reporting Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NU50CK000556 and 2020 Pass-through City of Chicago, Department of Public Health COVID-19 ? Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Federal Assistance Listing #93.323 County Department ? Cook County Health Finding 2022 ? 006 (Continued) CONTEXT (Continued) Report Period Due Date Submission Date Days Late 3/1/2022-3/31/2022 4/15/2022 8/30/2022 137 7/1/2022-7/31/2022 8/15/2022 8/30/2022 15 In addition, for the remaining two reports covering the periods from 10/1/2022 to 10/31/2022 and 11/1/2022 to 11/30/2022, we noted expenditures of $7,126 and $7,608 respectively, included on the reports, which were not recorded as federal grant expenditures in the Oracle accounting system. Consequently, this resulted in an adjustment to the schedule of expenditures of federal awards to not only include these amounts, but the total grant expenditures incurred totaling $931,606 under the federal program during 2022. IDENTIFICATION OF REPEATED FINDINGS Repeated (Prior Finding No. 2021-004) RECOMMENDATION We recommend that CCH develop and implement procedures to ensure reports are submitted in a timely manner and in compliance with its grant agreements. A compliance calendar of all grants reporting due dates should be maintained to assist with ensuring compliance with reporting requirements. In addition, we recommend CCH ensure all expenditures included on grant reports are properly reported in the schedule of expenditures of federal awards. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County?s corrective action plan is on page 63.

Inadequate Controls over Allowable Costs Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing # 93.391 County Department ? Department of Public Health Finding 2022 ? 007 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, ?The non-Federal entity must: (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and terms and conditions of the Federal award.? Subpart E ? Cost Principles, Section 200.403 states costs must meet the following general criteria in order to be allowable under Federal awards: ?(a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. ?(g) Be adequately documented.? In addition, Subpart E ? Cost Principles, Section 200.430 (i)(1) Standards for Documentation of Personal Expenses, states, ?Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; and (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities.? CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not maintain adequate controls over allowable costs as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding resulted from the Program Leads and Accounts Payable unit not following the established requirements for properly supporting invoices for services provided. The invoices that were attached in EBS Oracle were insufficient as required by County Policy. SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Inadequate Controls over Allowable Costs Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing # 93.391 County Department ? Department of Public Health Finding 2022 ? 007 (Continued) EFFECT The failure to maintain adequate support and/or documentation evidence the review of actual time spent by employees on the program is a violation of federal regulations and could result in additional payroll costs being charged to the federally funded program. QUESTIONED COSTS None. CONTEXT During our test of 38 expenditures, we were provided invoices supporting the total charges to the program. However, we noted 17 of the invoices reviewed included payroll related charges, of which we were unable to determine that DPH reviewed the detailed payroll records (such as time and effort reports) of those employees charged to the grant to verify that the related services were performed and were within the period specified on the invoices. This was due to the fact, that information was not maintained in the Oracle accounting system. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPH develop and implement procedures to ensure all expenditures, including personnel costs, are properly reviewed, approved, and supporting documentation maintained in accordance with federal regulations and the County?s policy. Once procedures are developed, adequate staff training should be conducted to ensure all program/grant finance personnel are familiar with the requirements. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County?s corrective action plan is on page 63.

Reporting Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing # 93.391 County Department ? Department of Public Health Finding 2022 ? 008 CRITERIA Per the U.S. Department of Health and Human Services, Centers for Disease Control and Prevention (CDC), Notice of Funding Opportunity (NOFO) number CDC-RFA-OT21-2103, entitled, ?National Initiative to Address COVID-19 Health Disparities Among Populations at High-Risk and Underserved, Including Racial and Ethnic Minority Populations and Rural Communities?, dated May 3, 2021, Section 4. Federal Funding Accountability and Transparency Act of 2006 (FFATA), states ?Compliance with this law is primarily the responsibility of the Federal agency. However, two elements of the law require information to be collected and reported by applicants: 1) information on executive compensation when not already reported through the SAM, and 2) similar information on all sub-awards/subcontracts/consortiums over $25,000.? The Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) website states, ?FSRS is the reporting tool Federal prime awardees (i.e. prime contractors and prime grants recipients) use to capture and report subaward and executive compensation data regarding their first-tier subawards to meet the FFATA reporting requirements. Prime contract awardees will report against sub-contracts awarded, and prime grant awardees will report against sub-grants awarded.? In addition, ?Prime Grant Recipients awarded a new Federal grant greater than or equal to $30,000 as of October 1, 2010 are subject to FFATA sub-award reporting requirements as outlined in the Office of Management and Budgets guidance issued August 27, 2010. The prime awardee is required to file a FFATA sub-award report by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000.? In accordance with 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, Appendix A, Award Term, b. 1. Reporting total compensation of recipient executives for non-Federal entities, states, ?You must report total compensation for each of your five most highly compensated executives for the preceding completed fiscal year, if - i. The total Federal funding authorized to date under this Federal award equals or exceeds $30,000 as defined in 2 CFR 170.320; ii. in the preceding fiscal year, you received? (A) 80 percent or more of your annual gross revenues from Federal procurement contracts (and subcontracts) and Federal financial assistance subject to the Transparency Act, as defined at 2 CFR 170.320 (and subawards), and (B) $25,000,000 or more in annual gross revenues from Federal procurement contracts (and subcontracts) and Federal financial assistance subject to the Transparency Act, as defined at 2 CFR 170.320 (and subawards); and, iii. The public does not have access to information about the compensation of the executives through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986. SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Reporting Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing # 93.391 County Department ? Department of Public Health Finding 2022 ? 008 (Continued) CRITERIA (Continued) 2. Where and when to report. You must report executive total compensation described in paragraph b.1. of this award term: i. As part of your registration profile at https://www.sam.gov. ii. By the end of the month following the month in which this award is made, and annually thereafter.? CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not comply with its FFATA reporting requirements as outlined in its notice of award and federal regulations. CAUSE Based on discussions with management, the cause of this finding resulted from having subrecipients in the grant application identified as vendors. As a result, staff classified the associated costs as professional services instead of grant disbursements which is used to identify subrecipient(s) on the grant. Also, the Program Lead informed Finance late which did not allow sufficient time to mobilize CCH staff to prepare and submit the FFATA reporting. EFFECT Failure to prepare and submit required reports is a violation of federal regulations and impairs the grantor agency?s ability to adequately monitor the program activities/federally funded program. QUESTIONED COSTS None. CONTEXT Based on our review of the fiscal year 2022 grant disbursements, we noted a total of 13 subrecipients had expenditures greater than $30,000. We selected 4 subgrantee (subrecipients) for review and noted that DPH did not submit any reporting information as required under the FFATA Subaward Reporting, in the FSRS system. SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Reporting Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing # 93.391 County Department ? Department of Public Health Finding 2022 ? 008 (Continued) IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that DPH develop and implement procedures to ensure required reports are prepared, reviewed, and submitted in a timely manner and in compliance with its grant agreement and federal regulations. Also, sub-grant agreements and related expenditures incurred should be reviewed to ensure the appropriate determination, classification, and reporting of subrecipients. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County?s corrective action plan is on page 64.

Subrecipient Monitoring Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing # 93.391 County Department ? Department of Public Health Finding 2022 ? 009 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D?Post Federal Award Requirements Standards for Financial and Program Management, Section 200.332. Requirements for pass-through entities, requires that ?All pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F?Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in Section 200.208 Specific conditions. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in Section 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F?Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in Section 200.501 Audit requirements. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in Section 200.338 Remedies for noncompliance of this part and in program regulations.? SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Subrecipient Monitoring Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing # 93.391 County Department ? Department of Public Health Finding 2022 ? 009 (Continued) CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not perform adequate monitoring of its subrecipients as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding resulted from subrecipients being identified as vendors in the grant application. Also, the Program Lead informed Finance late which did not allow sufficient time to mobilize CCH staff and/or external consultant to perform subrecipient monitoring. EFFECT Failure to adequately communicate and monitor the activities and performance of a subrecipient could result in Federal awards being used for unauthorized purposes and DPH?s inability to adequately perform risk assessments on its subrecipient(s). QUESTIONED COSTS None. CONTEXT During the current audit period, we noted 27 subrecipients were awarded funds. During our review of 6 subrecipients, we noted adequate documentation was not maintained to support both the financial and programmatic monitoring of these subrecipients. Specifically, we noted documentation was not maintained to support DPH?s evaluation of each subrecipients risk of noncompliance and the frequency of monitoring to be conducted by DPH based on the assessed risk. Also, we noted no documentation was provided to verify whether the subrecipients were required to have a Single Audit conducted, including DPH?s review of the report, and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.332d(3). SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Subrecipient Monitoring Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH75OT000024 and 2021 COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises, Federal Assistance Listing # 93.391 County Department ? Department of Public Health Finding 2022 ? 009 (Continued) CONTEXT (Continued) In addition, while we noted that DPH does have a draft policy manual regarding the monitoring of its subrecipients, we noted the manual does not currently address or include the process and related procedures for conducting both fiscal and programmatic monitoring. Specifically, the draft manual does not: a) include any related checklists and/or forms being utilized, b) address the performance of risk assessments, or c) detail the frequency and type of monitoring (i.e., desk review, site visit) to be conducted based on assessed risks. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPH update its written procedures to document the monitoring of its subrecipients in accordance with 2 CFR 200.332 and once updated the draft policy should be finalized and implemented. Also, adequate staff resources and training should be in place to oversee the process of completing the required subrecipient monitoring, including documentation of the evaluation of the subrecipient risk of noncompliance and review of the Single Audit report, as required by federal regulations. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County?s corrective action plan is on page 64.

Reporting Federal Department ? U.S. Department of Health and Human Services COVID-19 - Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Federal Assistance Listing # 93.498 County Department ? Cook County Health Finding 2022 ? 010 CRITERIA Per the U.S. Department of Health and Human Services, Health Resources and Service Administration (HRSA) User Guide on Provider Relief Fund (PRF) Reporting Portal - Reporting dated June 30, 2021 (User Guide), Post-Payment Reporting Requirements, Section 1.3, ?PRF recipients should review the most recently published Post-Payment Notice of Reporting Requirements available on the PRF Reporting Requirements & Auditing website for information about reporting requirements?. Per the June 11, 2021, Post-Payment Notice of Reporting Requirements, Provider Relief Fund General and Targeted Distribution (which superseded the notice released on January 15, 2021), ?The period of availability of funds applies to all past and future PRF payments made under the legal authorities outlined in the section Overview of Legal Requirements for Reporting. PRF recipients must only use payments for eligible expenses, including services rendered, and lost revenue during the period of availability.? In addition, the June 11 Notice of Reporting Requirements states ?Reporting Entities will report on their use of funds using their normal basis of accounting (e.g., cash basis, accrual basis). Recipients will report data in the following order: 1) Interest Earned on PRF Payment(s); 2 Other Assistance Received; 3) Use of SNF and Nursing Home Infection Control Distribution Payments (if applicable); 4) Use of General and Other Targeted Distribution Payments; 5) Net Unreimbursed Expenses Attributable to Coronavirus; 6) Lost Revenues Reimbursement and various other data elements, as required.? Step 9 of the User Guide ? Other Provider Relief Funds Expenses for Payments Received During Payment Period states the Reporting Entity is required to report on the use of all other PRF payments by indicating the calendar year quarterly expenses reimbursed with these payments. PRF payments must be used for expenses unreimbursed by other sources and that other sources are not obligated to reimburse. Reporting Entities that received $500,000 or more in aggregated PRF payments during each Payment Received Period are required to report on the use of these other PRF payments in greater detail than the two categories of General and Administrative (G&A) Expenses and Health Care-Related Expenses, according to the following sub-categories of expenses: 1) General and Administrative Expenses Attributable to Coronavirus: a) Mortgage/Rent; b) Insurance; c) Personnel; d) Fringe Benefits; e) Lease Payments; f) Utilities/Operations; g) Other General and Administrative Expenses. 2) Health Care-Related Expenses Attributable to Coronavirus: a) Supplies; b) Equipment; c) Information Technology; d) Facilities: e) Other Health Care-Related Expenses." Step 10 of the User Guide ? Unreimbursed Expenses Attributable to Coronavirus states HRSA expects that PRF payments would be applied to unreimbursed expenses attributable to the coronavirus that are not obligated to be reimbursed by other sources before Provider Relief Fund payments are used for lost revenue. SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Reporting Federal Department ? U.S. Department of Health and Human Services COVID-19 - Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Federal Assistance Listing # 93.498 County Department ? Cook County Health Finding 2022 ? 010 (Continued) CRITERIA (Continued) Per the Provider Relief Fund and ARP Rural Payments, Frequently Asked Questions (FAQ) (last updated 2/25/2022), Use of Funds Section (modified 8/30/2021), ?To be considered an allowable expense under the PRF, the expense must be used to prevent, prepare for, and respond to the coronavirus. Reporting Entities are required to maintain adequate documentation to substantiate that these funds were used for health care-related expenses or lost revenue attributable to the coronavirus, and that those expenses or losses were not reimbursed from other sources and other sources were not obligated to reimburse them. Reporting Entities are not required to submit that documentation when reporting. Providers are required to maintain supporting documentation that demonstrates costs were incurred during the period of availability. The Reporting Entity is responsible for ensuring that adequate documentation is maintained.? 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D ? Post Federal Award Requirements, Section 200.303 states, ?the non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? CONDITION During the current audit period, Cook County Health (CCH) did not accurately prepare its Period 2 report submitted via the HRSA Reporting portal in accordance with the federal reporting requirements. CAUSE Based on discussions with management, the cause of this finding resulted from a misunderstanding of the expense data that was rolling/ inputted in the HRSA portal. The unreimbursed expenses line should have been inputted as Other PRF Expenses. CCH Management has already instituted a Corrective Action Plan (CAP) to prevent future occurrence. EFFECT Failure to ensure the Period 2 report is accurately prepared could impair the grantor agency?s ability to adequately monitor the federally funded program. Also, this failure resulted in inaccurate reporting of other PRF expenses and loss revenue during Period 2 Reporting, which will impact the subsequent and future PRF Period reports under the program. SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Reporting Federal Department ? U.S. Department of Health and Human Services COVID-19 - Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Federal Assistance Listing # 93.498 County Department ? Cook County Health Finding 2022 ? 010 (Continued) QUESTIONED COSTS None. CONTEXT During the prior audit period, we noted that Period 1 report submitted to HRSA was prepared in error, which resulted in a 2021 audit finding and subsequent corrective action planned prepared by CCH to address the finding. During the current audit period, we noted CCH did not have adequate time to implement its corrective action plan. As a result, the Period 2 report (which included $31,163,323 as payments received during the period from July 1, 2020 to December 31, 2020) submitted to HRSA was also prepared in error. Specifically, we noted the following: *The $31,163,323 categorized as other PRF expenses included amounts reimbursed by FEMA program(s), hence reimbursed from other (federal) sources. Hence, this amount was reported in error, which is a violation of the HRSA reporting requirements. *The other assistance received section of the report does not appear to include all other federal assistance received by CCH during the year. *CCH used the same methodologies included in the Period 1 Report to calculate its incremental costs attributable to the coronavirus. CCH (based on their understanding of the HRSA Provider Relief document modified 12/14/2020, which permitted reimbursement of marginal increased expenses related to the coronavirus) determined its net unreimbursed/incremental expenses incurred by calculating the increase in cost per (patient) discharge during the period of availability. These incremental costs per discharge were then applied to the discharge adjusted factor indicator (calculated by CCH as admits or discharges (excluding newborns) multiplied by (total charges/in-patient charges)) during the same period. This methodology resulted in total estimated incremental costs during Period 2 reporting of $72,889,648 which (after excluding expenses reimbursed from other sources reported of $29,966,420) resulted in net unreimbursed expenses attributable to coronavirus of $42,923,228 during the period of availability. However, we noted the current HRSA guidance, (FAQ, modified 2/25/2022, which was applicable during Period 2 reporting) no longer included language which permitted the reimbursement of such marginal increased expenses related to the coronavirus. SECTION III: FEDERAL AWARDS FINDINGS AND QUESTIONED COSTS (Continued) Reporting Federal Department ? U.S. Department of Health and Human Services COVID-19 - Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Federal Assistance Listing # 93.498 County Department ? Cook County Health Finding 2022 ? 010 (Continued) CONTEXT (Continued) Overall, it was noted that CCH had unreimbursed (unused) loss revenues available to be applied to the reporting period of $38,654,147, which exceeded the $31.6M payments received. This unused loss revenue could have been applied if the report had been accurately prepared. IDENTIFICATION OF REPEATED FINDINGS Repeated (Prior Finding No. 2021-003) RECOMMENDATION We recommend that CCH implements its prior corrective action plan for any future reports to be prepared and submitted under the PRF program. Also, procedures should be implemented to ensure accurate preparation of its report(s) in accordance with HRSA reporting requirements and to ensure the report(s) are properly reviewed by a second individual prior to submission. In addition, we suggest that CCH maintains an internal schedule to accurately track its related PRF expenses and loss revenue during each applicable reporting period, especially in instances where the prior period(s) reports were inaccurately prepared. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County?s corrective action plan is on pages 65-66.

Reporting Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number and Year: NH23IP922637 and 2020 Pass-through the Illinois Department of Public Health COVID -19 - Immunization Cooperative Agreements, Federal Assistance Listing # 93.268 County Department ? Department of Public Health Finding 2021 ? 002 Questioned Costs: None CRITERIA Per its inter-governmental agreement with the Illinois Department of Public Health (IDPH), grantee agrees to submit financial reports as requested and, in the format, required by grantor. Grantee shall file quarterly reports with Grantor describing the expenditure(s) of the funds related thereto, unless more frequent reporting is required by the grantee pursuant to specific award conditions. Quarterly reports must be submitted no later than thirty (30) calendar days following the three-month period covered by the report. Per Exhibit E of the agreement, grantee first performance report shall cover the first three months after the award begins. Grantee shall submit quarterly performance reports, along with any required data or metrics, within thirty (30) calendar days following the end of the quarter. All performance reports must include program qualitative and quantitative information, including a comparison of actual accomplishments to the objectives of the award established for the period; where the accomplishments can be quantified, a computation of the cost if required; performance trend data and analysis if required; and reasons why established goals were not met, if appropriate. CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not comply with the reporting requirements as outlined in its grant agreement. CONTEXT Based on our review of 4 reports submitted (2 quarterly financial and 2 quarterly programmatic), we noted 2 reports were submitted late ranging from 2 to 22 days late, as noted below: Type of Report Report Period Due Date Submission Date Days Late Work Plan Report(Prog) 12/1/2020 ? 2/28/2021 3/30/2021 4/21/2021 22 Reimbursement Certification 3/1/2021 ?5/31/2021 6/30/2021 7/2/2021 2 CONTEXT (continued) In addition, we noted the financial report covering the period from 9/1/2021 to 11/30/2021, total cumulative YTD expenditures for the period ended were $3,100,086. However, total expenditures per the Transaction Analysis provided were $3,263,632, a difference of $163,546. We also noted discrepancies in reconciling both the current period and YTD payroll and related fringe benefits expenses included on the report to the Transaction Analysis (source documentation). IDENTIFICATION OF REPEATED FINDING None. EFFECT Failure to maintain adequate documentation resulted in inaccurate reporting, reflecting a difference of $163,546 in expenditures and is a violation of federal requirements. Also, the failure to submit reports in a timely manner impairs the grantor agency?s ability to monitor program activities and could result in the loss of grant funding. CAUSE Based on discussions with management, this occurred primarily due to transitioning of programs, resulting in miscommunication/misunderstanding of the due date for Programmatic Report that needs to be submitted to IDPH. In addition, Grant Finance personnel had some family medical emergency causing her to miss the deadline for 2 days. Lastly, personnel (including fringes) and other contractual vendor expenses were charged to the Grant subsequently after the Grant Reimbursement Certification was submitted to IDPH. RECOMMENDATION We recommend DPH ensure all federal financial reports are reconciled to the appropriate Transaction analysis and are adequately reviewed. Additionally, supporting documentation of the analysis and review should be appropriately maintained. Also, procedures should be implemented to ensure reports are submitted timely and in compliance with DPH?s intergovernmental grant agreements. A compliance calendar of all grants reporting due dates should be maintained and cross-training of other personnel should be periodically performed to ensure compliance with reporting requirements. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County?s corrective action plan is on pages 44 ? 45.

Reporting Federal Department ? U.S. Department of Health and Human Services Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Federal Assistance Listing # 93.498 County Department ? Cook County Health Finding 2021 ? 003 Questioned Costs: None CRITERIA Per the U.S. Department of Health and Human Services, Health Resources and Service Administration (HRSA) User Guide on Provider Relief Fund (PRF) Reporting Portal - Reporting dated June 30, 2021 (?User Guide?), Post-Payment Reporting Requirements, Section 1.3 states PRF recipients should review the most recently published Post-Payment Notice of Reporting Requirements available on the PRF Reporting Requirements & Auditing website for information about reporting requirements. Per the June 11, 2021, Post-Payment Notice of Reporting Requirements, Provider Relief Fund General and Targeted Distribution (which superseded the notice released on January 15, 2021), states ?the period of availability of funds applies to all past and future PRF payments made under the legal authorities outlined in the section Overview of Legal Requirements for Reporting. PRF recipients must only use payments for eligible expenses including services rendered, and lost revenues during the period of availability.? The deadline (or period of availability) for use of funds during Period 1 was from January 1, 2020 to June 30, 2021 (for payments received from April 10, 2020 to June 30, 2020). Period 1 Report was due September 30, 2021, with a grace period which ended on November 30, 2021. In addition, the June 11 Notice of Reporting Requirements states Reporting Entities will report on their use of funds using their normal basis of accounting (e.g., cash basis, accrual basis). Recipients will report data in the following order: 1) Interest Earned on PRF Payment(s); 2 Other Assistance Received; 3) Use of SNF and Nursing Home Infection Control Distribution Payments (if applicable); 4) Use of General and Other Targeted Distribution Payments; 5) Net Unreimbursed Expenses Attributable to Coronavirus; 6) Lost Revenues Reimbursement and various other data elements, as required. Step 9 of the User Guide ? Other Provider Relief Funds Expenses for Payments Received During Payment Period, states the Reporting Entity is required to report on the use of all other PRF payments by indicating the calendar year quarterly expenses reimbursed with these payments. PRF payments must be used for expenses unreimbursed by other sources and that other sources are not obligated to reimburse. Reporting Entities that received $500,000 or more in aggregated PRF payments during each Payment Received Period are required to report on the use of these other PRF payments in greater detail than the two categories of General and Administrative (G&A) Expenses and Health Care-Related Expenses, according to the following sub- categories of expenses: 1) General and Administrative Expenses Attributable to Coronavirus: a) Mortgage/Rent; b) Insurance; c) Personnel; d) Fringe Benefits; e) Lease Payments; f) Utilities/Operations; g) Other General and Administrative Expenses. 2) Health Care-Related Expenses Attributable to Coronavirus: a) Supplies; b) Equipment; c) Information Technology; d) Facilities: e) Other Health Care Related Expenses. Step 10 of the User Guide ? Unreimbursed Expenses Attributable to Coronavirus, states HRSA expects that PRF payments would be applied to unreimbursed expenses attributable to coronavirus that are not obligated to be reimbursed by other sources before Provider Relief Fund payments are used for lost revenues. CRITERIA (continued) Per the Frequently Asked Questions on HRSA?s website, Use of Funds Section (last updated 8/30/2021), states to be considered an allowable expense under the PRF, the expense must be used to prevent, prepare for, and respond to coronavirus. PRF payments may also be used for lost revenues attributable to the coronavirus. Reporting Entities are required to maintain adequate documentation to substantiate that these funds were used for health care-related expenses or lost revenues attributable to coronavirus, and that those expenses or losses were not reimbursed from other sources and other sources were not obligated to reimburse them. Reporting Entities are not required to submit that documentation when reporting. Providers are required to maintain supporting documentation which demonstrates that costs were incurred during the period of availability. The Reporting Entity is responsible for ensuring that adequate documentation is maintained. 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D ? Post Federal Award Requirements, Section 200.303 states ?the non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? CONDITION During the current audit period, Cook County Health (CCH) did not accurately prepare its Period 1 report submitted via the HRSA Reporting portal in accordance with the federal reporting requirements. CONTEXT During our review of the Period 1 Report submitted, we noted CCH reported $122,229,389 as payments received during the period from April 1, 2020 to June 30, 2020. Of which, $51,504,264 was categorized as Other PRF expenses (broken down between General and Administrative expenses and Health Care-related Expenses) and the remaining $70,725,125 was categorized as other PRF remaining for possible loss revenues reimbursement. Specifically, we noted: ? The $51.5 million categorized as other PRF expenses were reimbursed by FEMA program(s), hence reimbursed from other (federal) sources. Hence, this amount was reported in error, which is a violation of the HRSA reporting requirements. ? CCH (based on their understanding of the HRSA Provider Relief document modified 12/4/2020, which permitted reimbursement of marginal increased expenses related to coronavirus), determined its net unreimbursed/incremental expenses incurred by calculating the increase in cost per (patient) discharge during the period of availability. These incremental costs per discharge were then applied to the discharge adjusted factor indicator (calculated by CCH as admits or discharges (excluding newborns) multiplied by (total charges/in-patient charges)) during the same period. This methodology resulted in total estimated incremental costs of $218,342,346, which after excluding expenses reimbursed from other sources, resulted in a net unreimbursed/incremental expense of $166,838,083 during the period of availability. We reviewed the methodology and assumptions used in the calculated expenses, which appeared reasonable based on the inputs utilized by CCH. However, due to the fact CCH applied this indirect approach to determining its unreimbursed coronavirus expenses, we were not able to perform detail testing of these expenditures. As such, we were unable to determine that these net incremental expenses incurred were directly used to prevent, prepare for, and respond to the coronavirus during the period of availability. ? Of the $166.8 million calculated as unreimbursed expenses attributable to coronavirus, it appeared a portion of this amount should have been first used to offset the $122 million received and reported as PRF expenses. Hence, no loss revenue reimbursement should have been reported on Period 1 Report. IDENTIFICATION OF REPEATED FINDING None. EFFECT Failure to ensure the Period 1 report is accurately prepared could impair the grantor agency?s ability to adequately monitor the federally funded program. Also, this failure resulted in inaccurate reporting of other PRF expenses and loss revenue during Period 1 Reporting, which impacts the subsequent and future PRF Period reports under the program. CAUSE Based on discussions with management, this was primarily due to misunderstanding of the expenses data that was rolling/inputted in the portal, the Unreimbursed Expenses line should have been inputted as Other PRF Expenses. As a result of this oversight, CCH Management has instituted a Corrective Action Plan included in this report to avoid future occurrence. RECOMMENDATION We recommend CCH develop and implement procedures to ensure accurate preparation of its report(s) and to ensure the report(s) are properly reviewed prior to submission. In addition, we recommend that CCH continue to follow up with HRSA regarding the possibility of correcting Period 1 Report and/or other future period reports. The PRF Reporting portal was designed so that each subsequent report would build from the previous completed and submitted report. The Reporting Portal will calculate remaining unused lost revenues that can be reimbursed by PRF payments received during future payment periods. As such, it is important that CCH maintains an internal schedule to accurately track its related PRF expenses and loss revenue during each applicable reporting period, until further guidance is provided/received from HRSA. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County?s corrective action plan is on pages 46 ? 47.

Reporting Federal Department ? U.S. Department of Health and Human Services Federal Award Identification Number(s) and Year(s): NU50CK000556 and 2020 6NU50CK000559-01-08 and 2020 Pass-through Agencies: City of Chicago, Department of Public Health Illinois Department of Public Health COVID-19-Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Federal Assistance Listing # 93.323 County Department ? Department of Public Health Finding 2021 ? 004 Questioned Costs: None CRITERIA Per the grant agreement with the City of Chicago, grantee will submit monthly requisitions for reimbursement identifying the payment due for the services performed and/or costs incurred and paid directly by grantee in such detail and supported by such documents as required by the City. Grantee must submit requisitions within 15 calendar days after the end of the month in which grantee performed services and/or incurred and paid costs. Per its inter-governmental agreement with the Illinois Department of Public Health, grantee agrees to submit financial reports as requested and, in the format, required by grantor. Grantee shall file quarterly reports with grantor describing the expenditure(s) of the funds related thereto, unless more frequent reporting is required by the grantee pursuant to specific award conditions. Quarterly reports must be submitted no later than thirty (30) calendar days following the three-month period covered by the report. In addition, per Exhibit E of the agreement, grantee first performance report shall cover the first three months after the award begins. Grantee shall submit quarterly performance reports, along with any required data or metrics, within thirty (30) calendar days following the end of the quarter. CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not comply with the reporting requirements as outlined in its grant agreements. CONTEXT We noted this program is funded under four grant agreements, one with the City of Chicago which had monthly reporting requirements and three with the Illinois Department of Public Health (IDPH) which had quarterly reporting requirements. During our test of reports submitted under the program, we reviewed a total of 10 reports (4 from the City of Chicago grant and 6 from the IDPH grants, comprised of 4 financial and 2 programmatic), noting 6 reports were submitted late ranging from 11 to 302 days late, as noted below: CONTEXT (continued) Grantor Agency Report period Due Date Submission Date Days Late City of Chicago 1/1/2021-1/31/2021 2/15/2021 12/14/2021 302 City of Chicago 5/1/2021-5/31/2021 6/15/2021 11/29/2021 167 City of Chicago 6/1/2021-6/30/2021 7/15/2021 11/29/2021 137 City of Chicago 10/1/2021-10/31/2021 11/15/2021 3/1/2022 105 IDPH ? financial report 6/1/2021 to 6/30/2021 7/30/2021 8/11/2021 11 IDPH ? work plan 6/1/2021 to 8/31/2021 9/30/2021 10/29/2021 29 In addition, we noted the financial report submitted to IDPH covering the period from 12/31/2020 to 2/28/2021, incorrectly reported indirect costs in the amount of $74,670, the actual indirect costs should have been $69,835, which resulted in a difference of $4,835. Finally, we also noted the financial report covering the period from 6/1/2021 to 6/30/2021 (which was a special report requested by grantor based on the grantor?s federal fiscal year end) was prepared using expenditures reported on the Transaction Analysis through run date of 8/10/2021, as opposed to the 6/30/2021 reporting period covered by the report, as required. IDENTIFICATION OF REPEATED FINDING None. EFFECT Failure to submit reports in a timely manner impairs the grantor agency?s ability to monitor program activities and could result in the loss of grant funding. Also, the failure to ensure reports are accurately prepared and are supported by expenditures during the reporting period could result in the over/under-reporting of grant expenditures and potential disallowed costs. CAUSE Based on discussions with management, the agreement from City of Chicago for the Contact Tracing External Grant was executed late by both parties, affecting the ability of staff to submit report(s) on the agreed-upon date on the agreement. The Senior Director of Contact Tracing Program who was managing the program, a key personnel, left CCDPH and the Department had limited time to transition the responsibilities, including quarterly programmatic reporting. Also, as a result, Financial Reimbursement Certification is submitted late due to approved invoices were not received timely. RECOMMENDATION We recommend DPH develop and implement procedures to ensure reports are submitted in a timely manner and in compliance with its grant agreements. A compliance calendar of all grants reporting due dates should be maintained to assist with ensuring compliance with reporting requirements. In addition, we recommend DPH ensure all federal financial reports are reconciled to the appropriate Transaction analysis. Additionally, supporting documentation of the analysis and review should be appropriately maintained. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County?s corrective action plan is on page 45.

Program Income Federal Department ? U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: M18-DC170213 and 2018 M19-DC170213 and 2019 M20-DC170213 and 2020 HOME Investment Partnerships Program, Federal Assistance Listing # 14.239 County Department ? Department of Planning and Development Finding 2021 ? 005 Questioned Costs: None CRITERIA Federal regulations (24 CFR Section 92.503 (a) (1)) require that program income be deposited in the participating jurisdiction's HOME Investment Trust Fund local account unless the participating jurisdiction permits the State recipient or sub-recipient to retain the program income for additional HOME projects pursuant to the written agreement. 24 CFR Section 92.505 states, ?the requirements of 2 CFR part 200 apply to participating jurisdictions, State recipients, and subrecipients receiving HOME funds, except for the following provisions: Section 200.306, 200.307, 200.308 (not applicable to participating jurisdictions), 200.311 (except as provided in Section 92.257), 200.312, 200.329, 200.333, and 200.334.? 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D ? Post Federal Award Requirements, Section 200.303 states, ?the non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? The Cook County Department of Planning and Development (DPD) Policies and Procedures Manual, revised November 2017, states Cook County is not required to identify program income by program funding year. However, Cook County must be able to identify which projects generated program income and which projects received program income, including the amount. Cook County must also be able to reasonably predict anticipated program income during the next program year. Thus, Cook County's financial management system tracks program income receivable (such as the amount and date of principal and interest due on a HOME loan). Cook County retains responsibility in accordance with 24 CFR 92.504(a) for HOME activities which are carried out by its subrecipients, including those funded with program income. Cook County must account for the source and application of HOME funds received by its subrecipients. Cook County must ensure that its subrecipients meet the standards for financial management systems of 24 CFR Part 85.20 or 24 CFR Part 84.21, as applicable, including controls for the receipt and expenditure of program income. CONDITION DPD did not adequately comply with its tracking and reporting of program income in accordance with federal regulations and its internal policies and procedures manual. CONTEXT During our review of program income, we noted the following: ? DPD underreported program income receipts into the HUD Integrated Disbursement & Information System (IDIS) by $459,897. A review of the Oracle Transaction Analysis (Program 53638) for the audit period disclosed that total program income received was $2,457,757, while total receipts reported in IDIS were $1,997,890. ? We reviewed three monthly program income reconciliation during the months of April to June 2021 between the Trakker (mortgage servicing software) and iNovah (County?s Department of Revenue system to record cash receipts) systems and noted all three reconciliations did not appear to be completed in a timely manner. We noted the reconciliations were completed between 39 to 56 days, after the following month end. For example, we noted the May 30, 2021 report was reconciled on August 25, 2021, 86 days later (or 56 days after the following month end). ? During our test of 40 items, we noted one item where program income in the amount of $44,000 was recorded as 2017 program income. However, per review of the supporting documentation provided, this amount was recorded as 2018 program income in the Oracle system. In addition, we noted the property affiliated with this program income was not properly included in the HOME listing of rental property provided for audit. This listing is typically used by DPD to perform monitoring of the properties. IDENTIFICATION OF REPEATED FINDING None. EFFECT Failure to comply with federal regulations and internal procedures applicable to the monitoring, tracking, and reporting of program income could result in excess funds in local accounts not properly being accounted for, and ultimately could result in the return of funds to the federal government. CAUSE Based on discussions with management, in 2021, DPD experienced personnel shortages such as two senior level staffers that were involved in the reconciliation process. Despite two distinct postings to fill these positions, these positions remain vacant. In addition to being short staffed COVID-19 related- illness and working remote has contributed to some business interruption. RECOMMENDATION We recommend DPD implement procedures to ensure timely reconciliation of all program income activities are being completed, as well as to update its internal policies and procedures to document when reconciliation will be completed. Also, procedures should be in place to ensure adequate documentation is being maintained to support program income activities and that the documentation agrees with the information in its Oracle accounting system. Finally, adequate staff resources and training should be in place to oversee the process of completing reconciliation and related reviews in a timely manner. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County?s corrective action plan is on pages 48 ? 49.

Special Tests and Provisions (Reporting) Federal Department ? U.S. Department of Transportation Federal Award Identification Number and Year: TE90(130) and 2018 Passed-through the Illinois Department of Transportation Highway Planning and Construction Cluster: Highway Planning and Construction, CFDA # 20.205 County Department ? Department of Transportation and Highways Finding 2020 ? 001 Questioned Costs: None CRITERIA Per its intergovernmental grant agreements, Grantee agrees to submit periodic financial and performance reporting on the approved IDOT BoBS 2832 form. Grantee shall file quarterly BoBS 2832 reports with Grantor describing the expenditure(s) of the funds and performance measures related thereto. The first BoBS 2832 report shall cover the first three months after the effective date of the agreement(s). Quarterly reports must be submitted no later than 30 calendar days following the period covered by the report. CONDITION During the current audit period, the Department of Transportation and Highways (DOTH) did not comply with the reporting requirements outlined in its grant agreement(s). CONTEXT Based on our review of 4 reports submitted (3 quarterly and 1 fiscal year end), we noted 3 reports were submitted late ranging from 11 to 171 days late, as noted below: Program Name Report Period Due Date Submission Date Days Late Lake Cook Road Raupp Blvd 8/1/20 - 10/31/20 (FY20 Q4) 11/30/2020 1/15/2021 46 Lake Cook Road Raupp Blvd 8/1/20 - 9/30/20 (Federal FY20 Year End)10/30/2020 11/10/2020 11 Cook County Transit Plan (SPR) 7/1/20 - 9/30/20 (FY20 Q3) 10/30/2020 4/19/2021 171 EFFECT Failure to submit reports in a timely manner impairs the grantor agency?s ability to monitor program activities and could result in the loss of grant funding CAUSE Based on our discussions with management, this occurred due to management?s oversight as proper reminders were not set up for the team at commencement of the project. RECOMMENDATION We recommend DOTH develop and implement procedures to ensure reports are submitted in a timely manner and in compliance with its intergovernmental grant agreements. A compliance calendar of all grants reporting due dates should be maintained to assist with ensuring compliance with reporting requirements. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County?s corrective action plan is on page 45

Equipment and Real Property Management Federal Department ? U.S. Department of Homeland Security Federal Award Identification Number and Year: EMW-2017-SS-00051-S01 and 2017; EMW-2018-SS-00020 and 2018 Passed-through the Illinois Emergency Management Agency Homeland Security Grant Program, CFDA # 97.067 County Department ? Department of Emergency Management and Regional Security Finding 2020 ? 002 Questioned Costs: None CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements Standards for Financial and Program Management, Section 200.313(d) Management requirements requires that ?Procedures for managing equipment (including replacement equipment), whether acquired in whole or in part under a Federal award, until disposition takes place will, as a minimum, meet the following requirements: (1) Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the federal award identification number (FAIN)), who holds title, the acquisition date, and cost of the property, percentage of Federal participation in the project costs for the Federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sale price of the property. (2) A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. (3) A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. (4) Adequate maintenance procedures must be developed to keep the property in good condition. (5) If the non-Federal entity is authorized or required to sell the property, proper sales procedures must be established to ensure the highest possible return.? CONDITION During the current year, the Cook County Department of Emergency Management and Regional Security (DEMRS) was unable to fully implement its prior year?s corrective action plan to maintain accurate and complete inventory records in accordance with the Federal regulations. CONTEXT During the prior audit period, we noted DEMRS did not fully implement its corrective action plan regarding the fiscal year 2018 finding over equipment inventory, which included performing a complete physical inventory on all equipment items and the results reconciled to the property records, as required by federal regulations. During the current audit period, we did not perform any detail reviews of equipment items during fiscal year 2020. Based on current year?s discussions with management and review, we noted that DEMRS developed an inventory project plan to address the finding. The plan anticipates migrating all the equipment items/assets into an electronic inventory (Elliott Data) system by May 31, 2021. Effective May 14, 2021, DEMRS has entered 93% of their total assets into the Elliott system. Once this step is completed, DEMRS will complete a physical inventory and reconciliation to the property records. As a result, DEMRS was unable to fully comply with the requirements of 2 CFR 200.313 for the fiscal year ended November 30, 2020. IDENTIFICATION OF REPEATED FINDING Repeated, (Prior Finding Nos. 2019-001, 2018-003, 2017-007, 2016-009, 2015-004, and 2014-008). EFFECT The failure to maintain equipment records as required, and to document whether or not the required equipment physical inventory and reconciliation to property records was performed as required by Federal regulations could result in the misstatement of perpetual records and inaccurate reporting of federally funded equipment. CAUSE Based on our discussions with management, this finding occurred because the corrective actions proposed in response to Finding 2019-001 were severely disrupted and delayed by the COVID-19 pandemic, simultaneous Federal, State and County disaster declarations, and DEMRS staff mobilization (beginning March 13, 2020) to manage and coordinate the County?s response to the public health emergency presented by the ongoing pandemic. Among the staff mobilized were those of the EMRS Logistics and Finance sections, both of which are integral in implementing the inventory project plan, deploying the Elliot Data Systems inventory management solution, and liaising with sub-recipients to facilitate the integration of grant-funded equipment in their possession. RECOMMENDATION We recommend DEMRS complete its process for entering all assets into the Elliott system. Once completed, DEMRS should begin the process of completing the required physical inventory and maintain documentation to support the results of the inventory and the reconciliation to the property records as required by Federal regulations. In addition, we recommend DEMRS develop written procedures to document its equipment inventory and management process going forward, including ensuring the master asset listing is updated and in accordance with the requirements of 2 CFR 200.313(d). VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTION The County?s corrective action plan is on pages 46 ? 47.

Subrecipient Monitoring Federal Department ? U.S. Department of Homeland Security Federal Award Identification Number and Year: EMW-2017-SS-00051-S01 and 2017; EMW-2018-SS-00020 and 2018 Pass-through the Illinois Emergency Management Agency Homeland Security Grant Program, CFDA # 97.067 County Department ? Department of Emergency Management and Regional Security Finding 2020 ? 003 Questioned Costs: None CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements Standards for Financial and Program Management, Section 200.331. Requirements for pass-through entities, requires that ?All pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F?Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in ?200.207 Specific conditions. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by ?200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in ?200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F?Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in ?200.501 Audit requirements. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in ?200.338 Remedies for noncompliance of this part and in program regulations.? Additionally, the Department?s Internal Procedures for Subrecipient Monitoring states on an annual basis, Finance Section staff will monitor each subrecipient that was active during the fiscal year. If the subrecipient was not active that year but had corrective actions in the previous year, those subrecipients will also be included in the monitoring list. CONDITION During the current audit period, the Cook County Department of Emergency Management and Regional Security (DEMRS) did not fully implement its prior year?s corrective action plan, including perform any monitoring of its subrecipients as required by its internal procedures and Federal regulations. CONTEXT During the prior audit period, we noted DEMRS performed some level of monitoring on 3 of its 21 subrecipients. The remaining subrecipients were given their awards late in fiscal year 2019 and had not begun any formal work yet. During the current audit period, while we noted that DEMRS developed a monitoring checklist and a risk assessment tool for monitoring as noted in its prior year?s corrective action plan, DEMRS did not perform any actual monitoring of its 16 subrecipients awarded grant funds, including documentation of DEMRS?s evaluation of each subrecipients? risk of noncompliance. Additionally, in accordance with its internal procedures which require annual monitoring, some level of subrecipient monitoring should have been completed during the year. IDENTIFICATION OF REPEATED FINDING Repeated, (Prior Finding No. 2019-002). EFFECT Failure to adequately monitor the activities and performance of subrecipients could result in Federal awards being used for unauthorized purposes and the Department?s inability to adequately perform risk assessments on subrecipients. CAUSE Based on our discussions with management, this finding occurred because the corrective actions proposed in response to Finding 2019-002 was severely disrupted and delayed by the COVID-19 pandemic, simultaneous Federal, State and County disaster declarations, and DEMRS staff mobilization (beginning March 13, 2020) to manage and coordinate the County?s response to the public health emergency presented by the ongoing pandemic. Other entities mobilized in response to the pandemic include local police and fire which make up the majority of EMRS? UASI sub-grantees. The largest UASI sub-grantees, the fire service?s Mutual Aid Box Alarm System (MABAS) and Orland Park Fire Protection District, were forced to postpone many of their grant funded trainings during fiscal year 2020, drastically reducing their ability to spend down awarded funds. Further, spending deadlines were repeatedly extended because of the pandemic. For example, the UASI 2017 grant was extended twice, and is now slated to close out on May 31, 2022. The UASI 2018 grant was also extended by FEMA/IEMA for the same reason, and has a current end date of August 31, 2022. Audits of smaller sub-grants were necessarily delayed during the audit period because the sub-recipients could not purchase the grant funded equipment due to the ongoing pandemic. Due to competing priorities (i.e., pandemic response), a decided lack of subrecipient spend-down of grant funds, and repeatedly extended grant close out dates, EMRS did not perform any monitoring during the audit period covering fiscal year 2020. RECOMMENDATION We recommend DEMRS update its internal procedures to reflect its risk assessment process for monitoring subrecipients going forward, as well as maintain documentation of the evaluation of each subrecipients? risk of noncompliance and actual monitoring performed, as required by federal regulations. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTION The County?s corrective action plan is on pages 47 ? 48.

Reporting Federal Departments ? U.S. Department of Justice U.S. Department of Treasury Equitable Sharing Program, CFDA # 16.922 Equitable Sharing, CFDA # 21.016 County Department ? Sheriff?s Office Finding 2020 ? 004 Questioned Costs: None CRITERIA Per the July 2018 Guide to Equitable Sharing for States, Local, and Trial Law Enforcement Agencies (Guide), Section VII.A. Federal Equitable Sharing Agreement and Certification (ESAC) Form states agencies must annually submit an ESAC in the eShare portal, regardless of whether funds were received or maintained during the fiscal year, in order to maintain compliance. The ESAC must be reviewed and approved by the head of the law enforcement agency and a designated official of the governing body prior to submission. Agencies must submit the ESAC within two months after the end of their fiscal year. No extensions to this deadline will be granted. Agencies will remain non-compliant until all paperwork is received and approved. For example, if the agency?s fiscal year ends September 30, the ESAC must be filed, reviewed, and accepted by November 30 for the agency to remain compliant. CONDITION During the current audit period, the Sheriff?s Office did not comply with the reporting requirements outlined the July 2018 Guide. CONTEXT Based on our review of the ESAC Annual Certification Report for the fiscal year ended November 30, 2020, we noted the report was signed by the agency head on February 4, 2021 and the governing body head on February 10, 2021. The report due date was January 30, 2021 and electronically submitted on February 18, 2021; hence report was submitted 19 days late. EFFECT Failure to submit reports in a timely manner impairs the grantor agency?s ability to monitor program activities and could result in the loss of grant funding. CAUSE Based on discussions with management, the employee who has historically submitted the ESAC Annual Certification Report left on a leave of absence the day before the due date. It took some time to get access to the right roles within the eShare portal system to submit the form. RECOMMENDATION We recommend Sheriff?s Office implement procedures to ensure its Annual Certification Report is submitted in a timely manner and in compliance with the July 2018 Guide. A compliance calendar of all grant reporting due date(s) should be maintained to assist with ensuring compliance with reporting requirements. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County?s corrective action plan is on page 49.

Reporting Federal Department ? U.S. Department of Treasury Federal Award Identification Number and Year: 6NU50CK000559-01-08 and 2020 Pass-through the Illinois Department of Public Health COVID-19 - Coronavirus Relief Fund, CFDA # 21.019 County Department ? Department of Public Health Finding 2020 ? 005 Questioned Costs: None CRITERIA Per its inter-governmental agreement with the Illinois Department of Public Health, grantee agrees to submit performance reports as requested and in the format required by grantor. Performance measures as outlined in the grant agreement must be reported quarterly. Grantee first performance report shall cover the first three months after the award begins. Grantee shall submit quarterly performance reports, along with any required data or metrics, within thirty (30) calendar days following the end of the quarter. All performance reports must include program qualitative and quantitative information, including a comparison of actual accomplishments to the objectives of the award established for the period; where the accomplishments can be quantified, a computation of the cost if required; performance trend data and analysis if required; and reasons why established goals were not met, if appropriate. CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not accurately prepare its quarterly performance reports. CONTEXT During our review of two quarterly performance reports (covering the period from June 1, 2020 to August 31, 2020 and the period from September 1, 2020 to November 30, 2020), we noted the same qualitative and quantitative information was provided for both reports tested. Based on discussions with DPH?s management, it was noted that the information included in the reports was based on the preparation date (March and April 2021, respectively), as opposed to the period covered date. Hence, it appears the reports were not accurately prepared. In addition, we were not provided with documentation to support the information included in the reports. EFFECT Failure to maintain adequate supporting documentation and ensure reports are accurately prepared could impair the grantor agency?s ability to monitor DPH?s program performance and could result in the loss of grant funding. CAUSE Based on discussions with management, this occurred due to accurate information being mistakenly attributed to the incorrect reporting timeframe in the State?s grant management system. The State is aware that DPH has corrections to the data. The State has been fully apprised of all accurate data throughout the duration of the grant as all data is compiled in the State?s required CRM tool, Salesforce. RECOMMENDATION We recommend DPH develop procedures to ensure accurate preparation of its performance reports, maintain adequate supporting documentation on the information contained in the reports, and ensure the reports are properly reviewed prior to submission. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County?s corrective action plan is on pages 50 ? 51.

Subrecipient Monitoring Federal Department ? U.S. Department of Treasury Federal Award Identification Number and Year: 6NU50CK000559-01-08 and 2020 Pass-through the Illinois Department of Public Health COVID-19 - Coronavirus Relief Fund, CFDA # 21.019 County Department ? Department of Public Health Finding 2020 ? 006 Questioned Costs: None CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements Standards for Financial and Program Management, Section 200.331. Requirements for pass-through entities, requires that ?All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward? Required information includes: (1) Federal Award Identification. (x) Name of Federal awarding agency, pass-through entity and contact information for awarding official, (xi) CFDA Number and Name; the pass-through entity must identify the dollar amount made available under each Federal award and the CFDA number at the time of disbursement. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F?Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in ?200.207 Specific conditions. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by ?200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in ?200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F?Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in ?200.501 Audit requirements. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in ?200.338 Remedies for noncompliance of this part and in program regulations.? CONDITION During the current audit period, the Cook County Department of Public Health (DPH) did not document its procedures for monitoring its subrecipient as required by Federal regulations. CONTEXT Based on discussions with DPH?s management, it was noted that only one subrecipient was awarded funds, which were advanced by DPH during fiscal year 2020. Furthermore, management maintains that the subrecipient did not bill for any services until December 2020, and as a result, DPH?s did not perform any monitoring (i.e. invoice confirmation, payroll information, etc.) of the subrecipient. During our review, we noted that DPH?s does not have any written procedures to document its monitoring of the subrecipient, including documentation of DPH?s evaluation of the subrecipient risk of noncompliance. Also, while DPH?s management acknowledged receipt of a copy of the subrecipient?s Single Audit Report, we were not provided with any evidence of DPH?s review of the report, including and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.331d(3). In addition, we noted that the agreement with the subrecipient refers to them as a ?contractor? which can be misleading, and there is no reference to the name of the Federal Awarding Agency and CFDA number in the agreement. EFFECT Failure to adequately communicate and monitor the activities and performance of a subrecipient could result in Federal awards being used for unauthorized purposes and DPH?s inability to adequately perform risk assessments on its subrecipient(s). CAUSE Based on discussions with management, this occurred due to circumstances caused by the pandemic, DPH management was not able to prepare written procedures and document monitoring performed on the subrecipient. Having subrecipient is something new and policies and procedures will have to be updated to accommodate the 2 CFR Part 200 Uniform Guidance. RECOMMENDATION We recommend DPH develop written procedures to document the monitoring of its subrecipient. Also, adequate staff resources and training should be in place to oversee the process of completing the required subrecipient monitoring, including documentation of the evaluation of the subrecipient risk of noncompliance and review of the Single Audit report, as required by federal regulations. In addition, we recommend that DPH?s ensure the required federal award information is included in all its subrecipient agreement(s). VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County?s corrective action plan is on page 51.

Allowable Costs (Payroll) Federal Department ? U.S. Election Assistance Commission Pass-through the Illinois State Board of Elections COVID-19 - 2018 HAVA Election Security Grants, CFDA # 90.404 County Department ? County Clerk Finding 2020 ? 007 Questioned Costs: None CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D ? Post Federal Award Requirements, Section 200.430 Compensation ? personal services (a) (1) states Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards of Documentation of Personnel Expenses, when applicable. Section 200.430 (i) Standards for Documentation of Personnel Expenses states (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities?; (v) Comply with the established accounting policies and practices of the non-Federal entity. The grant agreement with the Illinois State Board of Elections states by accepting this grant, grantee agrees to document all expenditures for audit purposes in accordance with generally accepted auditing standards, Federal Single Audit requirements, and any specific additional provisions contained in HAVA (42 U.S.C Section 15542). CONDITION During the current audit period, the County Clerk did not adequately comply with federal regulations and its grant agreement over allowable costs relating to payroll. CONTEXT During our tests of 40 employees (covering pay periods ended November 7, 2020 and November 21, 2020) from a population of 312 employees; we were not provided any evidence of the supervisor?s approval of the 40 employees? timesheets. EFFECT The failure to maintain adequate supporting documentation and to ensure all payroll expenditures are reasonable and properly reviewed is a violation of federal regulations and could result in unallowable payroll costs being charged to the federally funded program. CAUSE Based on discussions with management, the e-Poll Books track the time in which the election workers log in and out of the system. This allows the County Clerk to know what judges showed up for the day to work the election. When on-site, the election workers log in to the e-Poll books. The system will trigger a message to the supervisor of election workers to let them know the person is on site and ready for the day and/or has ended the day. The supervisors of election workers input the worked hours incurred into the election management system (VRXG.) There is no detail audit report to indicate the person that entered the time and/or the approver. In preparation for the bi-monthly payroll, the supervisor downloads the VRXG file and compared to the email notifications. The downloaded paper log/spreadsheet was not signed off by the supervisor indicating verification had occurred. However, all payroll items selected by the auditor agreed to the detail listing. RECOMMENDATION We recommend County Clerk develop procedures to ensure payroll expenditures are properly reviewed and approved, and supporting documentation maintained in accordance with federal regulations. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County?s corrective action plan is on page 52.

Equipment and Real Property Management Federal Department ? U.S. Department of Homeland Security Federal Award Identification Number and Year: EMW-2017-SS-00051-S01 and 2017; EMW-2018-SS-00020 and 2018 Passed-through the Illinois Emergency Management Agency Homeland Security Grant Program, CFDA # 97.067 County Department ? Department of Emergency Management and Regional Security Finding 2019 ? 001 Questioned Costs: None CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements Standards for Financial and Program Management, Section 200.313(d) Management requirements requires that ?Procedures for managing equipment (including replacement equipment), whether acquired in whole or in part under a Federal award, until disposition takes place will, as a minimum, meet the following requirements: (1) Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the federal award identification number (FAIN)), who holds title, the acquisition date, and cost of the property, percentage of Federal participation in the project costs for the Federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sale price of the property. (2) A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. (3) A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. (4) Adequate maintenance procedures must be developed to keep the property in good condition. (5) If the non-Federal entity is authorized or required to sell the property, proper sales procedures must be established to ensure the highest possible return.? CONDITION During the current year, the Cook County Department of Emergency Management and Regional Security (DEMRS) did not maintain accurate and complete inventory records in accordance with the Federal regulations. CONTEXT In fiscal year 2018, DEMRS could not provide evidence that a complete physical inventory was performed on all its equipment items and the results reconciled to the property records (Comptroller?s records) over a two-year period, as required by Federal regulations. During the current audit period, we noted DEMRS has not fully implemented its corrective action plan regarding the prior year?s finding over equipment inventory. Based on review of the current year?s status provided, DEMRS plans to complete a full physical inventory of equipment by fiscal year 2021. Additionally, during our review of equipment inventory procedures, we noted DEMRS maintains a current master equipment listing, which includes the date equipment items were last inventoried. We selected 60 items from the master equipment listing and performed a physical observation and noted the following: ? Fifteen (15) items weren?t available for us to observe the equipment. ? Seven (7) items had asset tag numbers on the equipment which was different than the tag numbers on the master listing. ? Two (2) items did not have a proper asset description; it appears items were reported on the master listing by purchase order or invoice number. As such, items could not be located for observation. ? Three (3) items had a different tag and/or serial number on equipment when compared to the master asset listing. ? Two (2) items did not have tag number or serial number on the master listing or the equipment item. ? For the 60 items selected for testing, we noted that the last inventory date for 30 items was over the two-year required physical inventory period (date ranged from 7/14/2014 to 3/9/2016). The remaining 30 items did not have an inventory date on this master listing. As a result, it does not appear that the current master equipment listing has been updated to properly reflect the requirements of 2 CFR 200.313(d). IDENTIFICATION OF REPEATED FINDING Repeated (Prior Finding Nos. 2018-003, 2017-007, 2016-009, 2015-004, 2014-008). EFFECT The failure to maintain equipment records as required, and to document whether or not the required equipment physical inventory and reconciliation to property records was performed as required by Federal regulations could result in the misstatement of perpetual records and inaccurate reporting of federally funded equipment. CAUSE Based on our discussions with management, this finding occurred because of two events. First, procurement delays meant that the Elliot Data System was not purchased until FY 2020, delaying EMRS? proposed 2019 overhaul of its inventory system. Second, significant disruptions to EMRS operations were experienced in FY 2020 due to the COVID-19 pandemic, State and County Emergency Declarations, and the mobilization of EMRS since March 13, 2020 in an ongoing effort to manage and coordinate the County?s response to the public health emergency presented by the pandemic. RECOMMENDATION We recommend the DEMRS ensure adequate staff resources and training are in place to oversee the process of completing the required physical inventory and the documentation maintained to support to results of the inventory and; 2) the results reconciled to property records as required by Federal regulations. In addition, procedures should be in place to ensure the master asset listing is updated and in accordance with the requirements of 2 CFR 200.313(d). VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTION The County?s corrective action plan is on pages 30-31.

Subrecipient Monitoring Federal Department ? U.S. Department of Homeland Security Federal Award Identification Number and Year: EMW-2017-SS-00051-S01 and 2017; EMW-2018-SS-00020 and 2018 Pass-through the Illinois Emergency Management Agency Homeland Security Grant Program CFDA # 97.067 County Department ? Department of Emergency Management and Regional Security Finding 2019 ? 002 Questioned Costs: None CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements Standards for Financial and Program Management, Section 200.331. Requirements for pass-through entities, requires that ?All pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F?Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in ?200.207 Specific conditions. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by ?200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in ?200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F?Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in ?200.501 Audit requirements. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in ?200.338 Remedies for noncompliance of this part and in program regulations.? Additionally, the Department?s Internal Procedures for Subrecipient Monitoring states ?staff will complete all monitoring documentation, to include a monitoring close-out letter and any recommended actions or follow up needed to close-out the monitoring. This will be submitted via a formal letter from the Director of Financial Controls to the sub-recipient. The letter will outline the necessary timeline for completion of any corrective action and/ or recommendations.? It also states ?The Grant manager, upon completion of the monitoring, will ensure that the monitoring folder contains the above listed documentation, as well as all close-out documentation and related materials.? CONDITION During the current audit period, the Cook County Department of Emergency Management and Regional Security (DEMRS) did not perform adequate monitoring of its subrecipients as required by Federal regulations. CONTEXT During the current audit period, we noted DEMRS performed monitoring on 3 of its 21 subrecipients. The remaining subrecipients were given their awards late in fiscal year 2019 and had not begun any formal work yet. We reviewed all three (3) subrecipient files, noting that: 1) financial and programmatic monitoring was not adequately documented for all 3 subrecipients. Specifically, for all three subrecipients, we noted the following: ? The Sub-Grantee A-133 Audit Certification Form was not completed, which includes documentation to verify whether the subrecipient met the audit requirement for completion of a single audit in accordance with Subpart F-Audit Requirements of the Uniform Guidance. ? Documentation was not provided to support DEMRS?s evaluation of each subrecipients? risk of noncompliance. ? The Sub-Grant Monitoring Report/Checklist was not completed, which evidence the results of the site visit performed. ? The Monitoring Close-out Letter and any recommended actions or follow-up needed to close out the monitoring was not provided to the subrecipient in a timely manner. We noted site visits were conducted by DEMRS from April 19, 2019 to May 1, 2019. However, the formal letter close-out letter to each subrecipient was dated August 5, 2020. As a result, this does not allow either DEMRS or the subrecipient to take timely and appropriate action on the deficiencies noted through the on-site review. EFFECT Failure to adequately monitor the activities and performance of subrecipients could result in Federal awards being used for unauthorized purposes and the Department?s inability to adequately perform risk assessments on subrecipients. CAUSE Based on discussions with management, this occurred due to staff oversight and a failure to properly document subrecipient visits and/or conduct proper follow-up with each subrecipient to ensure observance of the Federal Uniform Guidance. RECOMMENDATION We recommend DEMRS ensure adequate staff resources and training are in place to oversee the process of completing the required subrecipient monitoring and that timely management decisions are issued to subrecipients to allow for appropriate follow-up on deficiencies noted. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTION The County?s corrective action plan is on page 31-32.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION