CITY OF INMAN

2025-002 Material Weakness in Internal Controls Over Major Program & Noncompliance Compliance Requirement: Allowable Cost/Cost Principles Federal Agency: U.S. Department of Agriculture – Rural Utilities Service Federal Program: Water and Waste Disposal System for Rural Communities Assistance Listing Number: 10.760 Criteria: Non-federal entities receiving federal awards are required to establish, document, and maintain effective internal control over federal programs that provide reasonable assurance that the entity is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (2 CFR 200.303). Condition: Management informed us during the audit that a fraudulent wire transfer occurred related to a payment associated with this federal program. We found that the entity did not have procedures in place requiring independent verification of requests to change vendor banking or payment information prior to processing wire transfers. The payment was made on June 5, 2025, and determined to be fraudulent by the City on June 19, 2025. The City took immediate action and reported the fraud to all appropriate entities; however, the program was not reimbursed until July 2025 (FY 2026). Questioned Cost: $2,621,526 Cause: The absence of internal control procedures requiring independent verification of requests to change vendor banking or payment information prior to processing wire transfers. Effect: As a result, the payment was processed based on a fraudulent request to modify payment instructions, resulting in funds being transferred to an unauthorized account. The City subsequently recovered approximately $1.3 million, while the remaining amount was replaced by the City’s sewer funds so that the federal program did not ultimately bear the loss. This incident exposed the City and the federal program to the risk of loss, misuse of funds, and noncompliance with federal requirements related to safeguarding federal awards. Recommendation: We recommend that management implement procedures requiring independent verification of all requests to change vendor banking or payment information using previously established vendor contact information. Establish a dual approval process for modifying vendor payment instructions, and provide training and awareness to staff responsible for accounts payable and contract payments on recognizing and preventing fraudulent payment requests. Management Response and Corrective Action: See views of responsible officials.

Corrective Action Plan – MW 2025-002 The City of Inman is committed to upholding the highest legal, ethical, and moral standards; however, fraud remains an ever-present risk. On June 5, 2025, the City of Inman was the victim of a fraudulent wire transfer. Upon discovery of this incident, the appropriate authorities were promptly notified, and all related banking activity was immediately frozen. In an effort to mitigate further risk, the City of Inman subsequently adopted a comprehensive Wire Transfer Policy. This policy establishes strong internal controls designed to detect and prevent wire transfer fraud. The prompt implementation of this policy, together with ongoing testing of its controls, significantly reduces the City’s risk of similar incidents occurring in the future. The Wire Transfer Policy requires the following procedures to be completed prior to the execution of any wire transfer: • Step 1: Instructions received via email must be verbally verified using established contact information on file. • Step 2: Banking credentials, security tokens, and passwords shall be maintained solely by authorized personnel and must not be shared. • Step 3: Multi-factor authentication and role-based access controls must be enforced at all times. • Step 4: All banking activity is subject to internal auditing on an ongoing basis as part of the financial reporting process. With these measures in place, the City of Inman is better protected against fraud.