CITY OF CUPERTINO

2024-001 – Procurement, Suspension, and Debarment – Internal Control over Procurement and Verification Against the System for Award Management (“SAM”) (Significant Deficiency) Identification of the Federal Program: Assistance Listing Number: 20.205 Assistance Listing Title: Highway Planning and Construction Federal Agency: Department of Transportation Pass-Through Entity: State of California Department of Transportation Federal Award Number and Award Year: CML-5318(033) Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Suspension and Debarment, Non-Federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. “Covered transactions” include those procurement contracts for goods and services awarded under a nonprocurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220. All nonprocurement transactions entered into by a recipient (i.e., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR section 180.215. When a non-Federal entity enters into a covered transaction with an entity at a lower tier, the non-Federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA) and available at https://www.sam.gov/portal/public/SAM/ (Note: The OMB guidance at 2 CFR part 180 and agency implementing regulations still refer to the SAM Exclusions as the Excluded Parties List System (EPLS)), (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). Condition: During our audit, we noted that the City did not have documentation on verifying the vendors against the SAM to ensure that they were not suspended or debarred from federally funded purchases. Cause: The City does not have a process to require departments to perform suspension or debarment over vendors that the City makes contracts with federally-funded projects. Effect or Potential Effect: Without verifying whether vendors are suspended or debarred from working on federally-funded projects, the City could be contracting with vendors that are prohibited from working on federally-funded projects. Questioned Costs: None. Context: See condition above for context of the finding. Identification as a Repeat Finding, If Applicable: Not applicable. Recommendation: We recommend that the City establish internal control procedures to monitor compliance requirements to ensure vendors are not suspended or debarred from federally-funded purchases. View of Responsible Officials: Management concurs the finding.

2024-002 – Special Tests and Provisions – Internal Control over Quality Assurance Program (Significant Deficiency) Identification of the Federal Program: Assistance Listing Number: 20.205 Assistance Listing Title: Highway Planning and Construction Federal Agency: Department of Transportation Pass-Through Entity: State of California Department of Transportation Federal Award Number and Award Year: CML-5318(033) Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): In accordance with the City’s adopted Quality Assurance Program Manual, Quality Assurance Program (QAP) pertains to a sampling and testing program that will provide assurance that the materials and workmanship incorporated into the construction project are in conformance with the contract specifications. The main elements of a QAP are the Acceptance Testing (AT) and the Independent Assurance Program (IAP). AT refers to the sampling and testing, or inspection, to determine the degree of compliance with contract requirements while IAP refers to the verification that AT is being performed correctly by qualified testers and laboratories. The abovementioned QAP elements should be monitored through these forms/checklists: Materials Certificate (Appendix K), Checklist to Assist Local Agencies Monitor Acceptance Testing Requirements (Appendix E), and Checklist to Assist Local Agencies to Monitor Independent Assurance Requirements (Appendix L). Condition: Quality Assurance Tests were performed during the fiscal year for the federal project; however, we found that the corresponding monitoring forms and checklists were not completed in a timely manner in accordance with the adopted QAP Manual. The Appendices K, E, and L checklists were all accomplished after the project completion which deviates from the intended purpose of the QAP. Cause: The City did not follow the adopted QAP properly to complete Appendices K, E, and L forms/checklists timely. Effect or Potential Effect: Without completing the forms and checklists timely, the City might overlook some of the important matters and testing needed in monitoring the federal project. Questioned Costs: None. Context: See condition above for context of the finding. Identification as a Repeat Finding, If Applicable: Not applicable. Recommendation: We recommend that the City to adhere with the QAP manual on the timely accomplishment of the abovementioned forms and checklists in line with the federal project timeline. View of Responsible Officials: Management concurs the finding.

2023-002 - Reporting – Internal Control and Compliance over Reporting (Material Weakness) Identification of the Federal Programs: Assistance Listing Number: 21.027 Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: Department of Treasury Pass-Through Entity: N/A Federal Award Number and Award Year: 1505-0271 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Pursuant to 2 CFR 200.303(a), the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). These would include segregation of duties over report preparation and submission to ensure compliance with deadline requirements. Further, per State and Local Fiscal Recovery Funds (“SLRF”) requirements, the recipients are also required to obligate funds incurred related to revenue replacement under “provision of government services” sub-expenditure category. Condition: The City did not have proper segregation of duties in place for the preparation, approval and submission of the American Rescue Plan Act (“ARPA”) -related reportorial requirements to the U.S. Department of Treasury. Further, the audit team noted that the City did not properly obligate the funds related to revenue replacement category on its annual project and expenditures report resulting to incorrect reporting. Subsequently, the City corrected the obligation of funds during the March 2024 annual reporting. Cause: There was no policy and procedure in place to enhance the internal control over the report submission. In addition, the City was not familiar with the obligation requirement. Effect or Potential Effect: Failure to implement proper segregation of duties, and failure to report correct expended amounts under provision of government services in the annual report resulted in non liance requirements. Not obligating the fund timely could potentially lose the funding. Questioned Costs: None. Context: See condition above for the context of the finding. Identification as a Repeat Finding, If Applicable: Yes. See prior year finding 2022-001. Recommendation: We recommend that the City strengthen their report submission process and procedures to ensure all required reports are properly reviewed and approved and submitted. Further, we recommend the City to have in depth staff training with regard to the grant compliance requirements in order to avoid misinterpretation of the necessary requirements. Views of Responsible Officials: Management concurs the finding.

Criteria Title 2 U.S. Code of Federal Regulations Part 200 (2 CFR 200) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 303(a) states, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statues, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). These would include segregation of duties over report preparation and submission to ensure compliance with deadline requirements. Additionally, per the ?Compliance and Reporting Guidance ? State of Local Fiscal Recovery Funds? published by the U.S. Department of Treasury, the Interim Report is required to be submitted by August 31, 2021, while the Project and Expenditure Report is required to be submitted by April 30, 2022 and then annually thereafter. Condition During our assessment of the control activities for the American Rescue Plan Act of 2021 (ARPA), we observed that the City did not have a control in place to ensure proper segregation of duties between report preparation, approval and submission to the US. Department of Treasury, as well a control to ensure timely submission of ARPA reports. As such, the required Project and Expenditure report was not submitted on a timely basis. Questioned Costs None Context The City is required to submit an Interim Report and also a Project and Expenditure Report. For the Interim Report, there was no control in place to ensure segregation of duties between the report preparer and the report reviewer, although we did not note any exceptions in the data submitted by the City and the report was submitted timely. For the Project and Expenditure Report, there also was no control in place to ensure segregation of duties between the report preparer and the report reviewer, with the City not submitting the report (which had a due date of April 2022) until January 2023. However, we did not note any exceptions in the data submitted by the City in the Project and Expenditure Report. Effect Failure to implement sufficient internal controls to ensure the timely filing of reports in accordance with federal regulations could result in the program being noncompliant with federal statutes, regulations and the terms and conditions of the federal awards. Cause The City did not implement an effective control to ensure reports had proper segregation of duties and that reports were submitted timely. In addition, the City wasn?t aware that a Project and Expenditure was required to be submitted. Identification as a Repeat Finding, if Applicable N/A Recommendation We recommend the City revisit its control design and revise its procedures to ensure proper controls over preparation, review and submission of ARPA reports and also ensure the timely submission of all reports. Views of Responsible Officials and Planned Corrective Actions See Corrective Action Plan.