Alamo Area Metropolitan Planning OrganizationLocal Government

Reporting – FFATA Subawards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Community Development Block Grants/Entitlement Grants Assistance Listing Number: 14.218 Award Number and Period: B-23-UC-48-0500, B-22-UC-48-0500 October 1, 2023–September 1, 2030, October 1, 2022–September 1, 2029 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Bexar County (The County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The County’s Auditors Office (CAO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting form has been created by the CAO that includes all required elements to be submitted. Program departments must complete and submit the form to the Grant Accountant in the CAO for all federal subawards with amounts over $30,000 as soon as the subaward contract is approved by the Commissioner’s Court so that it can be included in the next month’s submission. During our testing, we noted the following compliance exceptions: Transactions Tested Subawards not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 0 4 0 0 Dollar Amount of Tested Transactions Subawards not reported Report not timely Subaward amount incorrect Subaward missing key elements $1,102,564 $0 $1,102,564 $0 $0 Questioned costs: None. Context: See “Condition.” Cause: The delays were attributed to miscommunication between the Grant Accountant and the Program Department, as well as the Program Department not informing the Grant Accountant promptly when the subawards were approved in Commissioner’s Court. Effect: Failure to provide documentation of timely submission of subawards in FSRS will result in noncompliance with the federal grant guidelines. Repeat Finding: No. Recommendation: The County should enhance existing controls around the submission of required subawards in FSRS to ensure they are reported timely. Views of responsible officials: See corrective action plan.

Allowable Costs/Activities Allowed – Personal Services Federal Agency: U.S. Department of Housing and Urban Development U.S. Department of the Treasury Federal Program Name: Community Development Block Grants/Entitlement Grants (CDBG) Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Assistance Listing Number: 14.218 21.027 Award Number and Period: CDBG B-23-UC-48-0500, B-22-UC-48-0500, B-20-UW-48-0500 October 1, 2023–September 1, 2030, October 1, 2022–September 1, 2029, May 28, 2020–May 27, 2026 CSLFRF 1505-0271 March 3, 2021–December 31, 2026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Bexar County (the County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. Per 2 CFR 200.430 Standards for Documentation of Personnel Expenses, Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by an internal control system that ensures the charges are accurate, allowable, and properly allocated; (ii) be incorporated into the official records of the non-Federal entity; (iii) reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) encompass federally-assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) comply with the established accounting policies and practices of the non-Federal entity; (vi) support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition: Employees submit their timesheets for each pay period to their supervisors for review and approval. For those employees who work on multiple grants, cost distributions are assigned upon hire, which allocate a percentage of time for each grant. Each pay period, supervisors review the timesheets to verify the employee worked the number of hours on each grant in line with the cost distribution percentage. If the employee deviated from the usual hours worked on a certain grant, a payroll adjustment is made to reflect the actual hours worked. CDBG (14.218): Audit procedures included a selection of 40 payroll-related expenditures incurred during the fiscal year totaling $34,055. For one of the samples, the employee worked 50% of the hours charged during the pay period on the CDBG program. However, only 15% of the employees’ hours were applied resulting in an understatement of base salaries and wages of $1,071 charged to the grant. CSLFRF (21.027): Audit procedures included a selection of 40 payroll-related expenditures incurred during the fiscal year totaling $76,606. For one of the samples totaling $1,590, the approved timesheet for the employee was not maintained. Questioned costs: $1,590. Context: See “Condition.” Cause: The 15% charged to CDBG was the number of hours charged to the ESG grant. This was a one-time oversight. The missing timesheet was misplaced and could not be found. Effect: Failure to apply the correct percentage of hours worked on a program can result in a misstatement of charges to the grant award. Additionally, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No. Recommendation: Related to the incorrect charges to the grant, the County Auditor’s Office could implement an additional review layer to the existing process. Related to the missing timesheet, the County should enhance policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334 Views of responsible officials: See corrective action plan.

Earmarking – Revenue Loss Calculations Federal Agency: U.S. Department of the Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Assistance Listing Number: 21.027 Award Number and Period: 1505-0271 March 3, 2021–December 31, 2026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Bexar County (The County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the 2022 Final Rule (31 CFR Part 35), recipients may use payments from CSLFRF to replace lost public sector revenue to provide government services. Recipients may use this funding to provide government services to the extent of the reduction in revenue experienced due to the pandemic. Recipients can elect a one-time “standard allowance” of $10 million (not to exceed the recipient’s award amount) to spend on the “provision of government services” during the period of performance. Alternatively, recipients can calculate lost revenue for the years 2020, 2021, 2022, and 2023 based on the formula provided in the 2022 Final Rule to determine the amount of SLFRF funds that can be used for the “provision of government services.” In calculating revenue loss, recipients can choose whether to use calendar or fiscal year dates but must be consistent throughout the period of performance. Condition: Audit procedures included testing of the County’s 2020-2023 revenue loss calculations. When reviewing the calculation for 2023, actual revenues were calculated as $863,132,116. When comparing the actual revenues used in the calculation to general ledger supporting documentation, the amount used should have been $862,449,227. This understatement of revenues used in the calculation results in an overstatement of eligible revenue loss recoupment of $682,939. Questioned costs: $682,939. Context: See “Condition.” Cause: The discrepancies noted were due to management oversight. Effect: Failure to accurately calculate revenue loss can lead to payment of ineligible federal funds. Repeat Finding: No. Recommendation: We recommend management strengthen its internal controls to ensure errors are detected in calculations which are reported to the federal government prior to report submission. Views of responsible officials: See corrective action plan.

Reporting – Project and Expenditure Report Federal Agency: U.S. Department of the Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Assistance Listing Number: 21.027 Award Number and Period: 1505-0271 March 3, 2021–December 31, 2026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Bexar County (The County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the 2022 Final Rule (31 CFR Part 35), recipients may use payments from CSLFRF to replace lost public sector revenue to provide government services. Recipients may use this funding to provide government services to the extent of the reduction in revenue experienced due to the pandemic. Recipients can elect a one-time “standard allowance” of $10 million (not to exceed the recipient’s award amount) to spend on the “provision of government services” during the period of performance. Alternatively, recipients can calculate lost revenue for the years 2020, 2021, 2022, and 2023 based on the formula provided in the 2022 Final Rule to determine the amount of CSLFRF funds that can be used for the “provision of government services.” In calculating revenue loss, recipients can choose whether to use calendar or fiscal year dates but must be consistent throughout the period of performance. Per 2 CFR 200.329 (c )(1), the County must submit performance reports as required by the Federal award. Under the CSLFRF grant award, the Project and Expenditure Report is to be submitted to the Department of Treasury on a quarterly basis. The report includes key line items including but not limited to: • Current Period Obligations Condition: During the testing of the County’s 2020-2022 revenue loss calculations, we noted variances between what was reported on the September 30, 2024 Project and Expenditure Report and what was calculated in the revenue loss calculations for actual revenue and reduction in revenue amounts as noted below. Actual Revenue Year Reported Calculated Over/(Under) 2020 691,421,648 691,694,247 (272,599) 2021 716,918,907 709,654,962 7,263,945 2022 758,798,287 759,742,663 (944,376) Reduction in Revenue Year Reported Calculated Over/(Under) 2020 71,764,795 71,560,944 203,851 2021 98,439,601 92,632,081 5,807,520 2022 98,653,666 97,709,290 944,376 Audit procedures also included testing of the Project and Expenditure Reports for the quarters-ending March 31, 2024, and June 30, 2024. During the testing of the March 31, 2024 report, there were a total of 12 projects which should have shown a zero amount for current period obligations as the projects had already shown the full amount of the project being obligated in the previous quarter. The total current period obligations reported for these 12 projects was $1,327,226. Thus, the current period obligations for this report were overstated by this amount. Questioned costs: None. Context: See “Condition.” Cause: The Budget and Finance Department (BFD) submitted incorrect data to the County Auditor’s Office (CAO) related to the reporting of actual revenues and revenue reduction amounts in the revenue loss calculations. The current period obligation amounts inaccurately reported were due to Treasury Portal reporting system issues. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts to the federal government. Repeat Finding: Recommendation: We recommend the BFD revise its internal controls to ensure amounts sent to the CAO are correct before they are included in reports submitted to the federal government. In addition, we recommend the CAO maintain documented evidence that the Treasury reporting system wouldn’t allow for the proper amounts to input into certain required fields. Views of responsible officials: See corrective action plan.

Subrecipient Monitoring Federal Agency: U.S. Department of the Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Assistance Listing Number: 21.027 Award Number and Period: 1505-0271 March 3, 2021–December 31, 2026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Bexar County (The County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under Uniform Grant Guidance, the County must: • Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain required information including, but not limited to, the subrecipient’s unique entity identifier (UEI). (2 CFR 200.332 (b)(1)). • Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. (2 CFR 200.332 (c)). • Verify that a subrecipient is audited as required by 2 CFR 200.501 which states a non-Federal entity that expends $1,000,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. Condition: Audit procedures included testing of a sample of eight subrecipients who received subawards during the fiscal year. In conducting the testing, we noted the following: • The UEI numbers included in the contract for two subrecipient did not match the UEI numbers for the subrecipient as noted on SAM.gov. • A risk assessment was not performed for the four subrecipients. • Documentation of the review of the required single audit was not maintained for eight subrecipients. Questioned costs: None. Context: See “Condition.” Cause: The incorrect UEI numbers in the contracts were due to oversight. Related to the lack of risk assessments, the four subrecipients were all governmental entities which the County deemed a risk assessment not necessary. County management was unaware that risk assessments need to be performed on all subrecipients, including governmental entities. The missing documentation for the single audit reviews was due to the County’s lack of knowledge of documentation required to provide sufficient evidence of the completed review. Effect: Failure to properly document required contract information, perform the necessary risk assessments, and document the review of the subrecipient’s single audit may result in noncompliance with grant terms and conditions. Repeat Finding: No. Recommendation: The County should: (1) enhance existing controls over contract review to ensure the UEI numbers are correct; (2) perform risk assessments on all subrecipient contracts; (3) perform and maintain adequate documentation of the review of all subrecipient single audit submissions on an annual basis. Views of responsible officials: See corrective action plan.

Reporting – ERA Compliance Report Federal Agency: U.S. Department of the Treasury Federal Program Name: Emergency Rental Assistance Program (ERA) Assistance Listing Number: 21.023 Award Number and Period: 1505-0270 June 23, 2021–September 30, 2025 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Bexar County (The County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. Per 2 CFR 200.329 (c)(1), the County must submit performance reports as required by the Federal award. Under the ERA grant award, the ERA Compliance Report is to be submitted to the Department of Treasury on a quarterly basis. The report includes several key line items including but not limited to: • System for Prioritizing Assistance: The number of households with less than 50% Area Median Income (AMI) receiving financial assistance is greater than the number of households with greater than 50% AMI receiving assistance. • Participant Households at Certain Income Levels Eligibility: The total households receiving assistance is not greater than the sum of Area Median Income (AMI) banded eligible households with a 5 to 10% margin of error to avoid false positives for medium to large recipients.Condition: Audit procedures included testing of the ERA Compliance Reports for the quarters ending March 31, 2024, and June 30, 2024, with the following results noted. March 31, 2024, Report • Supporting documentation was not properly maintained as of the end of the quarter to support the amounts recorded for two key line items, (1) System for Prioritizing Assistance and (2) Participant Households at Certain Income Levels Eligibility. Thus, the amounts reported and used in the calculation for each of these line items could not be verified. • As reported, the total households receiving assistance (2,467) is greater than the sum of Area Median Income (AMI) branded eligible households with a 5 to 10% margin of error to avoid false positives for medium to large recipients (2,466). June 30, 2024, Report For the key line item, System for Prioritizing Assistance, amounts used and reported do not agree to supporting documentation as follows: Description Reported Calculated Over/Under) Less than 30% of AMI 1,287 1,339 (52) Between 30% and 50% of AMI 708 689 19 Between 50% and 80% of AMI 473 493 (20) Additionally, the number of households with less than 50% Area Median Income (AMI) receiving financial assistance is greater than the number of households with greater than 50% AMI receiving assistance. • For the key line item, Participant Households at Certain Income Levels Eligibility, amounts used and reported do not agree to supporting documentation as follows: Description Reported Calculated Over/(Under) Total Households Receiving Assistance 2,468 2,521 (53) Sum of AMI Banded Eligible Households 2,468 2,521 (53) Additionally, the total households receiving assistance is not greater than the sum of Area Median Income (AMI) banded eligible households with a 5 to 10% margin of error to avoid false positives for medium to large recipients. Questioned costs: None. Context: See “Condition.” Cause: The discrepancies noted were primarily due to employee turnover and limited available resources to assume the ERA reporting responsibilities during the fiscal year. Additionally, the review of the report does not appear to be at the correct precision level to detect the errors. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No. Recommendation: We recommend management revise its internal controls to reconcile amounts reported on federal reports to relevant supporting documentation prior to report submission. Additionally, the County should implement or revise policies and procedures to ensure proper documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Lastly, the County should ensure there are sufficient resources who are available and trained in the event of key employee turnover. Views of responsible officials: See corrective action plan.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Community Development Block Grants/Entitlement Grants Assistance Listing Number: 14.218 Award Number and Period: B-23-UC-48-0500, B-22-UC-48-0500 October 1, 2023–September 1, 2030, October 1, 2022–September 1, 2029 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Bexar County (The County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The County’s Auditors Office (CAO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting form has been created by the CAO that includes all required elements to be submitted. Program departments must complete and submit the form to the Grant Accountant in the CAO for all federal subawards with amounts over $30,000 as soon as the subaward contract is approved by the Commissioner’s Court so that it can be included in the next month’s submission. During our testing, we noted the following compliance exceptions: Transactions Tested Subawards not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 0 4 0 0 Dollar Amount of Tested Transactions Subawards not reported Report not timely Subaward amount incorrect Subaward missing key elements $1,102,564 $0 $1,102,564 $0 $0 Questioned costs: None. Context: See “Condition.” Cause: The delays were attributed to miscommunication between the Grant Accountant and the Program Department, as well as the Program Department not informing the Grant Accountant promptly when the subawards were approved in Commissioner’s Court. Effect: Failure to provide documentation of timely submission of subawards in FSRS will result in noncompliance with the federal grant guidelines. Repeat Finding: No. Recommendation: The County should enhance existing controls around the submission of required subawards in FSRS to ensure they are reported timely. Views of responsible officials: See corrective action plan.

Allowable Costs/Activities Allowed – Personal Services Federal Agency: U.S. Department of Housing and Urban Development U.S. Department of the Treasury Federal Program Name: Community Development Block Grants/Entitlement Grants (CDBG) Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Assistance Listing Number: 14.218 21.027 Award Number and Period: CDBG B-23-UC-48-0500, B-22-UC-48-0500, B-20-UW-48-0500 October 1, 2023–September 1, 2030, October 1, 2022–September 1, 2029, May 28, 2020–May 27, 2026 CSLFRF 1505-0271 March 3, 2021–December 31, 2026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Bexar County (the County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. Per 2 CFR 200.430 Standards for Documentation of Personnel Expenses, Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by an internal control system that ensures the charges are accurate, allowable, and properly allocated; (ii) be incorporated into the official records of the non-Federal entity; (iii) reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) encompass federally-assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) comply with the established accounting policies and practices of the non-Federal entity; (vi) support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition: Employees submit their timesheets for each pay period to their supervisors for review and approval. For those employees who work on multiple grants, cost distributions are assigned upon hire, which allocate a percentage of time for each grant. Each pay period, supervisors review the timesheets to verify the employee worked the number of hours on each grant in line with the cost distribution percentage. If the employee deviated from the usual hours worked on a certain grant, a payroll adjustment is made to reflect the actual hours worked. CDBG (14.218): Audit procedures included a selection of 40 payroll-related expenditures incurred during the fiscal year totaling $34,055. For one of the samples, the employee worked 50% of the hours charged during the pay period on the CDBG program. However, only 15% of the employees’ hours were applied resulting in an understatement of base salaries and wages of $1,071 charged to the grant. CSLFRF (21.027): Audit procedures included a selection of 40 payroll-related expenditures incurred during the fiscal year totaling $76,606. For one of the samples totaling $1,590, the approved timesheet for the employee was not maintained. Questioned costs: $1,590. Context: See “Condition.” Cause: The 15% charged to CDBG was the number of hours charged to the ESG grant. This was a one-time oversight. The missing timesheet was misplaced and could not be found. Effect: Failure to apply the correct percentage of hours worked on a program can result in a misstatement of charges to the grant award. Additionally, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No. Recommendation: Related to the incorrect charges to the grant, the County Auditor’s Office could implement an additional review layer to the existing process. Related to the missing timesheet, the County should enhance policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334 Views of responsible officials: See corrective action plan.

Earmarking – Revenue Loss Calculations Federal Agency: U.S. Department of the Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Assistance Listing Number: 21.027 Award Number and Period: 1505-0271 March 3, 2021–December 31, 2026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Bexar County (The County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the 2022 Final Rule (31 CFR Part 35), recipients may use payments from CSLFRF to replace lost public sector revenue to provide government services. Recipients may use this funding to provide government services to the extent of the reduction in revenue experienced due to the pandemic. Recipients can elect a one-time “standard allowance” of $10 million (not to exceed the recipient’s award amount) to spend on the “provision of government services” during the period of performance. Alternatively, recipients can calculate lost revenue for the years 2020, 2021, 2022, and 2023 based on the formula provided in the 2022 Final Rule to determine the amount of SLFRF funds that can be used for the “provision of government services.” In calculating revenue loss, recipients can choose whether to use calendar or fiscal year dates but must be consistent throughout the period of performance. Condition: Audit procedures included testing of the County’s 2020-2023 revenue loss calculations. When reviewing the calculation for 2023, actual revenues were calculated as $863,132,116. When comparing the actual revenues used in the calculation to general ledger supporting documentation, the amount used should have been $862,449,227. This understatement of revenues used in the calculation results in an overstatement of eligible revenue loss recoupment of $682,939. Questioned costs: $682,939. Context: See “Condition.” Cause: The discrepancies noted were due to management oversight. Effect: Failure to accurately calculate revenue loss can lead to payment of ineligible federal funds. Repeat Finding: No. Recommendation: We recommend management strengthen its internal controls to ensure errors are detected in calculations which are reported to the federal government prior to report submission. Views of responsible officials: See corrective action plan.

Reporting – Project and Expenditure Report Federal Agency: U.S. Department of the Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Assistance Listing Number: 21.027 Award Number and Period: 1505-0271 March 3, 2021–December 31, 2026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Bexar County (The County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the 2022 Final Rule (31 CFR Part 35), recipients may use payments from CSLFRF to replace lost public sector revenue to provide government services. Recipients may use this funding to provide government services to the extent of the reduction in revenue experienced due to the pandemic. Recipients can elect a one-time “standard allowance” of $10 million (not to exceed the recipient’s award amount) to spend on the “provision of government services” during the period of performance. Alternatively, recipients can calculate lost revenue for the years 2020, 2021, 2022, and 2023 based on the formula provided in the 2022 Final Rule to determine the amount of CSLFRF funds that can be used for the “provision of government services.” In calculating revenue loss, recipients can choose whether to use calendar or fiscal year dates but must be consistent throughout the period of performance. Per 2 CFR 200.329 (c )(1), the County must submit performance reports as required by the Federal award. Under the CSLFRF grant award, the Project and Expenditure Report is to be submitted to the Department of Treasury on a quarterly basis. The report includes key line items including but not limited to: • Current Period Obligations Condition: During the testing of the County’s 2020-2022 revenue loss calculations, we noted variances between what was reported on the September 30, 2024 Project and Expenditure Report and what was calculated in the revenue loss calculations for actual revenue and reduction in revenue amounts as noted below. Actual Revenue Year Reported Calculated Over/(Under) 2020 691,421,648 691,694,247 (272,599) 2021 716,918,907 709,654,962 7,263,945 2022 758,798,287 759,742,663 (944,376) Reduction in Revenue Year Reported Calculated Over/(Under) 2020 71,764,795 71,560,944 203,851 2021 98,439,601 92,632,081 5,807,520 2022 98,653,666 97,709,290 944,376 Audit procedures also included testing of the Project and Expenditure Reports for the quarters-ending March 31, 2024, and June 30, 2024. During the testing of the March 31, 2024 report, there were a total of 12 projects which should have shown a zero amount for current period obligations as the projects had already shown the full amount of the project being obligated in the previous quarter. The total current period obligations reported for these 12 projects was $1,327,226. Thus, the current period obligations for this report were overstated by this amount. Questioned costs: None. Context: See “Condition.” Cause: The Budget and Finance Department (BFD) submitted incorrect data to the County Auditor’s Office (CAO) related to the reporting of actual revenues and revenue reduction amounts in the revenue loss calculations. The current period obligation amounts inaccurately reported were due to Treasury Portal reporting system issues. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts to the federal government. Repeat Finding: Recommendation: We recommend the BFD revise its internal controls to ensure amounts sent to the CAO are correct before they are included in reports submitted to the federal government. In addition, we recommend the CAO maintain documented evidence that the Treasury reporting system wouldn’t allow for the proper amounts to input into certain required fields. Views of responsible officials: See corrective action plan.

Subrecipient Monitoring Federal Agency: U.S. Department of the Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Assistance Listing Number: 21.027 Award Number and Period: 1505-0271 March 3, 2021–December 31, 2026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Bexar County (The County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under Uniform Grant Guidance, the County must: • Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain required information including, but not limited to, the subrecipient’s unique entity identifier (UEI). (2 CFR 200.332 (b)(1)). • Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. (2 CFR 200.332 (c)). • Verify that a subrecipient is audited as required by 2 CFR 200.501 which states a non-Federal entity that expends $1,000,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. Condition: Audit procedures included testing of a sample of eight subrecipients who received subawards during the fiscal year. In conducting the testing, we noted the following: • The UEI numbers included in the contract for two subrecipient did not match the UEI numbers for the subrecipient as noted on SAM.gov. • A risk assessment was not performed for the four subrecipients. • Documentation of the review of the required single audit was not maintained for eight subrecipients. Questioned costs: None. Context: See “Condition.” Cause: The incorrect UEI numbers in the contracts were due to oversight. Related to the lack of risk assessments, the four subrecipients were all governmental entities which the County deemed a risk assessment not necessary. County management was unaware that risk assessments need to be performed on all subrecipients, including governmental entities. The missing documentation for the single audit reviews was due to the County’s lack of knowledge of documentation required to provide sufficient evidence of the completed review. Effect: Failure to properly document required contract information, perform the necessary risk assessments, and document the review of the subrecipient’s single audit may result in noncompliance with grant terms and conditions. Repeat Finding: No. Recommendation: The County should: (1) enhance existing controls over contract review to ensure the UEI numbers are correct; (2) perform risk assessments on all subrecipient contracts; (3) perform and maintain adequate documentation of the review of all subrecipient single audit submissions on an annual basis. Views of responsible officials: See corrective action plan.

Reporting – ERA Compliance Report Federal Agency: U.S. Department of the Treasury Federal Program Name: Emergency Rental Assistance Program (ERA) Assistance Listing Number: 21.023 Award Number and Period: 1505-0270 June 23, 2021–September 30, 2025 Pass-Through Agency: N/A Pass-Through Number(s): N/A Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Bexar County (The County) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. Per 2 CFR 200.329 (c)(1), the County must submit performance reports as required by the Federal award. Under the ERA grant award, the ERA Compliance Report is to be submitted to the Department of Treasury on a quarterly basis. The report includes several key line items including but not limited to: • System for Prioritizing Assistance: The number of households with less than 50% Area Median Income (AMI) receiving financial assistance is greater than the number of households with greater than 50% AMI receiving assistance. • Participant Households at Certain Income Levels Eligibility: The total households receiving assistance is not greater than the sum of Area Median Income (AMI) banded eligible households with a 5 to 10% margin of error to avoid false positives for medium to large recipients.Condition: Audit procedures included testing of the ERA Compliance Reports for the quarters ending March 31, 2024, and June 30, 2024, with the following results noted. March 31, 2024, Report • Supporting documentation was not properly maintained as of the end of the quarter to support the amounts recorded for two key line items, (1) System for Prioritizing Assistance and (2) Participant Households at Certain Income Levels Eligibility. Thus, the amounts reported and used in the calculation for each of these line items could not be verified. • As reported, the total households receiving assistance (2,467) is greater than the sum of Area Median Income (AMI) branded eligible households with a 5 to 10% margin of error to avoid false positives for medium to large recipients (2,466). June 30, 2024, Report For the key line item, System for Prioritizing Assistance, amounts used and reported do not agree to supporting documentation as follows: Description Reported Calculated Over/Under) Less than 30% of AMI 1,287 1,339 (52) Between 30% and 50% of AMI 708 689 19 Between 50% and 80% of AMI 473 493 (20) Additionally, the number of households with less than 50% Area Median Income (AMI) receiving financial assistance is greater than the number of households with greater than 50% AMI receiving assistance. • For the key line item, Participant Households at Certain Income Levels Eligibility, amounts used and reported do not agree to supporting documentation as follows: Description Reported Calculated Over/(Under) Total Households Receiving Assistance 2,468 2,521 (53) Sum of AMI Banded Eligible Households 2,468 2,521 (53) Additionally, the total households receiving assistance is not greater than the sum of Area Median Income (AMI) banded eligible households with a 5 to 10% margin of error to avoid false positives for medium to large recipients. Questioned costs: None. Context: See “Condition.” Cause: The discrepancies noted were primarily due to employee turnover and limited available resources to assume the ERA reporting responsibilities during the fiscal year. Additionally, the review of the report does not appear to be at the correct precision level to detect the errors. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No. Recommendation: We recommend management revise its internal controls to reconcile amounts reported on federal reports to relevant supporting documentation prior to report submission. Additionally, the County should implement or revise policies and procedures to ensure proper documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Lastly, the County should ensure there are sufficient resources who are available and trained in the event of key employee turnover. Views of responsible officials: See corrective action plan.