SOUTH TEXAS DEVELOPMENT COUNCIL

Finding 2025-001 - Untimely Submission of Financial Status and Expenditure Reports, All Major Programs (Repeat) Programs: Ryan White HIV/AIDS (ALN 93.917, $3,137,317); HOPWA (ALN 14.241, $1,851,237); HIV State Services (HHS001317000004, $2,889,482); LIHEAP/CEAP (ALN 93.568, $485,959; contracts 58240004035 and 58940004183); Regional Solid Waste, TCEQ ($214,792) Compliance Requirement: L - Reporting Classification: Significant Deficiency in internal control over compliance; Noncompliance Criteria: Grant contracts require financial status reports and expenditure reports to be submitted within 30 days after each reporting period end (monthly for Ryan White, HOPWA, State Services, and CEAP; quarterly for TCEQ). Condition: Late submissions occurred across all five major programs: Ryan White, 11 of 12 monthly B-13 reports late (average 37.8 days; worst April 2025 at 62 days); HOPWA, 11 of 12 late (average 37.8 days; worst August 2025 at 52 days); State Services, 10 of 12 monthly reports late (average 8.5 days; worst August 2025 at 22 days); CEAP contract 58240004035, 10 of 10 late (average 67 days; worst April 2025 at 103 days); CEAP IIJA contract 58940004183, 10 of 10 late (average 59 days; worst January 2025 at 101 days); TCEQ, 3 of 4 quarterly reports late (fourth quarter at 77 days). Cause: The Finance Director prepares all financial status reports for all programs. The FSR submission calendar implemented as the prior-year corrective action was not operating effectively, and resource constraints exist in a single-person finance preparation function. Effect: Grantor agencies received required financial reports late, impairing their ability to monitor award status, and creating risk of payment delays, award withholding, and high-risk designation consequences. Questioned Costs: None. Late reporting does not affect the allowability of the underlying expenditures. Repeat Finding: Yes. Repeat of Findings 2024-001 (Ryan White) and 2024-003 (State Services); the condition has expanded to all major programs. Recommendation: Implement a hard financial-report close calendar with preparation deadlines 10 days after each period end; cross-train a second preparer; require Executive Director review of the calendar monthly; and track submission dates against deadlines on a dashboard reviewed at each board finance committee meeting. Views of Responsible Officials and Planned Corrective Action: Management's response is presented in the accompanying Corrective Action Plan.

Finding 2025-002 - Untimely Submission of the Single Audit Reporting Package to the Federal Audit Clearinghouse (Repeat) Programs: Entity-wide, all federal awards Compliance Requirement: Audit submission, 2 CFR 200.512 (nine months after fiscal year end) Classification: Noncompliance Criteria: 2 CFR 200.512(a) requires submission of the single audit reporting package to the Federal Audit Clearinghouse within nine months after fiscal year end (June 30, 2026 for the fiscal year ended September 30, 2025). Condition: The fiscal year 2025 single audit is the fourth consecutive audit completed near or after the regulatory deadline. The fiscal year 2022, 2023, and 2024 packages were each submitted late; the fiscal year 2024 package was submitted in March 2026, approximately nine months late. Cause: Delays in audit readiness, including accounting system recovery issues in prior years, delayed availability of client records and monitoring documentation, and compressed engagement timelines. Effect: High-risk auditee designation; the Texas Department of Housing and Community Affairs withheld CEAP award funding as a direct consequence; and potential for additional grantor sanctions and enhanced monitoring. Questioned Costs: None Repeat Finding: Yes. Repeat of Finding 2024-004; fourth consecutive year. Recommendation: Adopt a board-approved audit readiness calendar with records closed and reconciled within 90 days of fiscal year end; engage the auditor by December; deliver complete supporting documentation by February; and target Federal Audit Clearinghouse submission by April each year. Views of Responsible Officials and Planned Corrective Action: Management's response is presented in the accompanying Corrective Action Plan.

Finding 2024-001 | Untimely Submission of Financial Status Reports — Ryan White HIV/AIDS Program Significant Deficiency in Internal Control over Compliance | Noncompliance | First-Time Finding

Program: Ryan White HIV/AIDS Program ALN: 93.917 Contract: HHS001122200004, Amendment No. 2 (DSHS pass-through) Compliance Requirement: L — Reporting Federal Award Year: April 1, 2023 – March 31, 2024 Questioned Costs: $0 Known / $0 Likely Repeat Finding: No — First-Time Finding

Condition: FSR #1 (April 1 – September 30, 2023) under Contract HHS001122200004 was submitted on February 14, 2024 — 106 days after the October 31, 2023 contractual due date.

Criteria: Contract HHS001122200004 and 2 CFR Part 200 require the submission of Financial Status Reports by specified deadlines. FSR #1 for the period April 1 through September 30, 2023 was due October 31, 2023.

Cause: No formal, cross-program FSR submission calendar with assigned responsibility and automated advance reminders was in place during FY2024. The former Finance Director, Ms. Julia C. Gonzalez, had prepared related reports but had not completed this FSR prior to her departure on October 13, 2023. The Interim Fiscal Officer, Mr. Josafat Saldivar, was newly appointed at the time. Additionally, on November 3, 2023, STDC suffered a ransomware attack that impacted the accounting system. Database recovery was completed in January 2024, after which staff began data entry and catching up on required reports for all funding agencies.

Effect: The late submission constitutes noncompliance with the reporting requirements of Contract HHS001122200004 and 2 CFR Part 200. No financial impact or loss of funding resulted from the late submission.

Recommendation: STDC should implement a formal, written FSR Submission Calendar covering all active federal and state programs, with assigned responsibility, contractual due dates, and automated advance reminder notifications to the Fiscal Officer and Executive Director at 30 and 7 days prior to each deadline.

Finding 2024-002 | Subrecipient Not Monitored — City of Laredo Across Three Programs Material Weakness in Internal Control over Compliance | First-Time Finding

Programs Affected: Ryan White HIV/AIDS Program (ALN 93.917) | HOPWA (ALN 14.241) | State Services (HHS001317000004) Compliance Requirement: N — Special Tests / Subrecipient Monitoring (2 CFR 200.332) Questioned Costs: $0 Known / $0 Likely — no noncompliance identified at City of Laredo Repeat Finding: No — First-Time Finding

Condition: City of Laredo was not monitored in FY2024 under any of the three programs for which it served as a subrecipient: Ryan White — $377,343 (11.7% of program total); State Services — $654,132 (24.5% of program total); HOPWA — $130,943 (7.5% of program total). Combined unmonitored expenditures: $1,162,418.

Criteria: 2 CFR §200.332 requires pass-through entities to monitor the activities of subrecipients to ensure that federal awards are used for authorized purposes in compliance with applicable laws, regulations, and the terms of the subaward. STDC's Subrecipient Monitoring Policy, adopted as part of the corrective action for Finding 2022-006, requires annual monitoring of all subrecipients under each program.

Cause: No formal, documented annual subrecipient monitoring schedule was maintained during FY2024. The absence of a structured tracking mechanism allowed the City of Laredo to go unmonitored across all three programs for the full fiscal year. STDC notes that five of six Ryan White and State Services subrecipients and three of four HOPWA subrecipients were monitored during FY2024; the lapse was isolated to the City of Laredo.

Effect: STDC did not fulfill its pass-through entity obligations under 2 CFR §200.332 for the City of Laredo across three programs with combined subrecipient expenditures of $1,162,418. No noncompliance was identified at the City of Laredo based on available documentation.

Recommendation: STDC should develop and maintain a formal Annual Subrecipient Monitoring Schedule at the start of each grant year, covering all active programs and all subrecipients. The schedule should identify the monitoring method, assigned staff, planned dates, and actual completion dates, and should be reviewed and approved by the Executive Director. A Monitoring Tracking Log should be maintained and reviewed weekly, with quarterly progress reports to the Executive Director.

Finding 2024-003 | Untimely Submission of Financial Status Reports — State Services HIV/SRVS Program Significant Deficiency in Internal Control over Compliance | Noncompliance | First-Time Finding

Program: State Services — HIV/SRVS Program Contract: HHS001317000004 (DSHS pass-through to STDC) Compliance Requirement: L — Reporting (Contract Attachment B §C) Federal Award Year: September 1, 2023 – August 31, 2024 Questioned Costs: $0 Known / $0 Likely Repeat Finding: No — First-Time Finding

Condition: FSR #1 (September 1, 2023 – February 29, 2024) under Contract HHS001317000004 was submitted on April 22, 2024 — 22 days after the March 31, 2024 contractual due date under Contract Attachment B §C.

Criteria: Contract HHS001317000004, Attachment B §C requires the timely submission of Financial Status Reports by specified contractual deadlines. FSR #1 for the period September 1, 2023 through February 29, 2024 was due March 31, 2024.

Cause: Finding 2024-003 shares the same root cause as Finding 2024-001: the absence of a formal, cross-program FSR submission calendar with assigned responsibility and advance reminder controls, compounded by the Fiscal Officer being new to the role during FY2024 and the recovery effort following the ransomware attack in November 2023.

Effect: The late submission constitutes noncompliance with the reporting requirements of Contract HHS001317000004. No financial impact or loss of funding resulted from the late submission.

Recommendation: The integrated corrective action described under Finding 2024-001 — implementation of a cross-program FSR Submission Calendar covering all active federal and state contracts — will address this finding simultaneously.

Finding 2024-004 | Untimely Submission of Single Audit Reporting Package Noncompliance | Repeat Finding | Third Consecutive Year (2022-001, 2023-006, 2024-004)

Program: Multiple Programs — Entity-Wide Compliance Requirement: 2 CFR §200.512(a) — Federal Audit Clearinghouse Submission Required Deadline: June 30, 2025 (9 months after September 30, 2024 fiscal year end) Questioned Costs: $0 Known / $0 Likely Repeat Finding: Yes — Repeat of Finding 2023-006 and Finding 2022-001 (third consecutive year)

Condition: The Single Audit reporting package for the fiscal year ended September 30, 2024, was not submitted to the Federal Audit Clearinghouse (FAC) by the required deadline of June 30, 2025, under 2 CFR §200.512(a). The package was submitted approximately nine months after the required deadline.

Criteria: 2 CFR §200.512(a) requires non-federal entities that expend $750,000 or more in federal awards during a fiscal year to submit their single audit reporting package to the FAC within the earlier of 30 calendar days after receipt of the auditor's reports, or nine months after the end of the audit period. For the fiscal year ended September 30, 2024, the required submission deadline was June 30, 2025.

Cause: The late submission is attributable to the cumulative effect of significant operational disruptions beginning in FY2022. On November 3, 2023, STDC suffered a ransomware attack that impacted its accounting system. Database recovery was not completed until January 2024, after which staff were required to perform extensive data entry and catch-up work for all reporting periods affected by the system outage. The transition to the AccuFund accounting system and the subsequent ransomware recovery created cascading delays in the preparation of financial records sufficient for audit, which in turn delayed the completion and submission of the FY2024 single audit reporting package. This finding represents the third consecutive year in which the single audit was submitted late, following Finding 2022-001 and Finding 2023-006.

Effect: The late submission constitutes noncompliance with 2 CFR §200.512(a). As a result of prior year late submissions, STDC has been designated as a high-risk auditee for the current audit year. Continued late submissions may result in additional oversight requirements, conditions on federal awards, or other adverse actions by federal oversight agencies.

Recommendation: STDC should establish a formal audit preparation timeline at the beginning of each fiscal year, with milestone dates for completion of the trial balance, resolution of audit adjustments, and delivery of final financial records to the auditor. The Executive Director and Finance Director should monitor progress against this timeline monthly and report status to the Board of Directors. STDC should target submission of the FY2025 single audit reporting package by June 30, 2026.

Federal Program: Ryan White HIV/AIDS Program – Part B (ALN 93.917) Compliance Requirement: Allowable Costs/Cost Principles (2 CFR Part 200, Subpart E) Type of Finding: Compliance and Internal Control Deficiency Condition: During our testing of the Ryan White Service Delivery program (grant period ending March 31, 2023), we noted that STDC initially submitted a final financial report to the Texas Department of State Health Services (DSHS) – Ryan White Division, reporting $491,993 in contractual expenditures and $69,458 in administrative expenditures. Subsequently, STDC submitted an additional reimbursement request via Form B-13, which included $162,433 in additional contractual costs and $12,153 in administrative costs. Upon review of the supporting documentation for this supplemental submission, we were unable to obtain sufficient appropriate evidence that the additional $12,153 in administrative expenditures were actually incurred. Despite the lack of adequate supporting documentation, the full amount was reimbursed by DSHS. Criteria: In accordance with 2 CFR §200.403(g), to be allowable under a federal award, costs must be adequately documented. Furthermore, §200.302(b)(3) requires recipients of federal funds to maintain records that identify adequately the source and application of funds, and §200.338(a) authorizes federal agencies to disallow costs that are not properly supported or allocable. Cause: STDC did not maintain contemporaneous or sufficient documentation to support administrative costs included in the post-period reimbursement request. Additionally, internal controls over the review and approval of financial reports and supplemental claims (e.g., Form B-13 submissions) were not operating effectively to prevent or detect the inclusion of unsupported expenditures. Effect: As a result, STDC received federal reimbursement for $12,153 in administrative costs without appropriate documentation, constituting noncompliance with federal cost principles. This condition may result in the disallowance of costs and repayment obligations to the funding agency. Recommendation: We recommend that STDC strengthen internal controls related to post-award financial reporting and reimbursement procedures by: • Ensuring that all costs claimed are supported by contemporaneous documentation clearly demonstrating that costs were incurred and allocable; • Establishing a formal review protocol for post-period adjustments, including documentation validation and supervisory sign-off; • Performing reconciliations of claimed expenditures before submission of final or supplemental reports to granting agencies; and • Consulting with DSHS to determine whether corrective action or repayment is necessary regarding the unsupported amount. Questioned Costs: $12,153

Federal Program: Community Services Block Grant (CSBG) – ALN 93.569 Compliance Requirement: Eligibility and Allowable Activities/Costs Type of Finding: Compliance and Internal Control Deficiency Condition: During our review of client case files under the CSBG program, we identified an instance in which services and benefits were provided to a single individual rather than to the household unit, contrary to CSBG program requirements. The intake documentation did not reflect an evaluation or approval at the household level, and the assistance was recorded and delivered as though the individual were the sole service recipient. Under CSBG guidance, eligibility and service determinations are required to be made at the household level, as the program is designed to address the needs of low-income families, not isolated individuals within those families.

Criteria: Per 45 CFR §96.30(a) and the U.S. Department of Health and Human Services CSBG Terms and Conditions, recipients must establish eligibility based on household income and provide services that are consistent with the needs of the family unit. In addition, the OMB Compliance Supplement for ALN 93.569 emphasizes that services must be targeted to eligible households to meet statutory intent and federal program objectives. Cause: The condition appears to have resulted from an oversight in case management procedures and a lack of clarity in intake protocols regarding the requirement to document and apply eligibility and benefits at the household level. Effect: Failure to assess and deliver services at the household level may result in noncompliance with CSBG program requirements and introduces the risk of inconsistent or inequitable benefit distribution among clients. If not addressed, this weakness may lead to systemic misapplication of eligibility standards. Recommendation: We recommend that STDC take the following steps to ensure compliance with CSBG eligibility and service delivery requirements: • Reinforce federal guidance through staff training for intake personnel and case managers, emphasizing that services must be assessed and provided based on household eligibility; • Update intake procedures and forms to ensure complete documentation of household composition, income, and eligibility status; • Implement periodic internal file reviews to verify that household-level eligibility determinations are consistently applied and properly documented in client records. Questioned Costs: None (isolated instance)

Federal Program: Area Agency on Aging (AAA) – Various ALNs under the Older Americans Act (e.g., 93.044, 93.045, 93.052) Compliance Requirement: Eligibility and Documentation Requirements Type of Finding: Internal Control Deficiency Condition: During our review of client intake documentation for services provided under the AAA programs, we identified multiple instances in which intake forms were not signed by the assigned case worker. While client demographic information and signatures were present, the absence of case worker signatures indicates that formal review and approval of client eligibility and service initiation was incomplete in accordance with established procedures. Criteria: Per Older Americans Act program guidance, eligibility determinations and service documentation must be reviewed and authorized by qualified staff. Standard internal control practices further require that intake forms be signed and dated by both the client and the case worker to provide audit evidence of eligibility assessment and case manager oversight. The case worker’s signature serves as confirmation that intake information was reviewed for accuracy, eligibility criteria were met, and services were appropriately initiated. Cause: The condition appears to result from inconsistent application of intake protocols and a lack of secondary review to ensure completion of required documentation fields, including the case worker’s signature. Effect: Incomplete intake documentation compromises the integrity of the client eligibility process and increases the risk of noncompliance with federal program standards. It may also impair the agency’s ability to demonstrate proper eligibility determination and oversight in the event of federal or state monitoring. Recommendation: We recommend that STDC strengthen controls over the intake and eligibility documentation process by: • Reinforcing existing policies that require case worker signatures on all intake forms; • Implementing a secondary review or quality assurance step prior to initiating services to verify that all required documentation, including signatures, is present; • Providing targeted training to intake and case management staff on documentation standards and accountability requirements under Older Americans Act programs. Questioned Costs: None

Federal Programs Affected: • 11.302 – Economic Development Administration (EDA) • 93.041 – Preventive Health and Health Services – Ombudsman • 93.043 – Prevention and Public Health – Evidence-Based Health Promotion (Title III-D) • 93.071 – Medicare Enrollment Assistance (MIPPA) • 93.324 – State Primary Care Offices (HICAP) • 93.499 – ACA – LIHWAP Cluster • 93.791 – Money Follows the Person – ADRC • 93.917 – HIV Care Formula Grants – Ryan White Service Delivery • 97.067 – Homeland Security Grant Program – SHSP Compliance Requirement: Allowable Costs/Cost Principles (2 CFR Part 200, Subpart E) Type of Finding: Compliance and Internal Control Deficiency Condition: During our review of administrative expenditures, we identified a utility payment to NRG Business that included sales tax, which is unallowable under federal cost principles for tax-exempt entities. Specifically, the utility invoice dated June 30, 2023, in the amount of $713.43 included $51.47 in sales tax. Although the vendor later issued a credit for the sales tax amount, the original charge—including the unallowable portion—was allocated to various federal grants through the administrative cost pool. It is not clear whether the vendor credit was properly reallocated to reverse the original federal charges. The table below summarizes the impacted programs and amounts: Federal Program ALN Check No. Amount Charged Economic Development Administration 11.302 #70335 $66.99 Preventive Health & Health Services – Ombudsman 93.041 #70076 $56.16 Evidence-Based Health – Title III-D 93.043 #70335 $66.99 Medicare Enrollment Assistance – MIPPA 93.071 #70583 $75.50 State Primary Care Offices – HICAP 93.324 #71046 $80.00 ACA – LIHWAP Cluster 93.499 #69835 $43.14 Money Follows the Person – ADRC 93.791 #70335 $66.99 HIV Care Formula Grants – Ryan White 93.917 #70460 $35.63 Homeland Security Grant Program – SHSP 97.067 #69835 $43.14

Criteria: In accordance with 2 CFR §200.403 and §200.405, costs charged to federal awards must be necessary, reasonable, allocable, and allowable under the cost principles. As a tax-exempt entity, sales taxes paid in error are considered unallowable unless excluded from reimbursement or properly credited. Additionally, per §200.302(b)(2), recipients must maintain effective control over and accountability for all funds and ensure proper allocation of costs.

Cause: STDC’s internal controls did not identify the inclusion of sales tax in the vendor invoice prior to payment. Furthermore, no mechanism was in place to ensure that vendor credits—once received—were retroactively applied to reverse the original allocations made to federal grants.

Effect: Although the vendor issued a credit for the unallowable sales tax, the original amount was temporarily charged to multiple federal programs. The lack of documented reallocation creates a risk that federal programs may have absorbed unallowable costs or that cost allocations remain inaccurate.

Recommendation: We recommend that STDC: • Strengthen internal controls to ensure that invoices are reviewed for unallowable costs (such as sales tax) prior to payment and allocation; • Establish procedures to track vendor credits and ensure that corresponding cost reallocations are applied to the correct funding sources; • Enhance documentation and reconciliation processes to demonstrate that post-payment adjustments are handled properly; • Train fiscal and grant staff on exempt status implications and cost allowability under Uniform Guidance.

Questioned Costs: None (vendor credit issued); however, audit adjustments or reallocations may be necessary to ensure grant charges are corrected.