Audit 301345

FINDING 2023-201 The Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) was understated by $18 million on the Schedule of Expenditures of Federal Awards (SEFA) Closing Package. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CRF) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR), 2 CFR 200.303, states that the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Additionally, 2 CFR 200.510 requires the State to prepare a SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department underreported $18 million in federal expenditures incurred under the CSLFRF program on the SEFA closing package. The expenditures were incurred for COVID-related claims covered under the State’s health plan using CSLFRF funds and should have been reported on the closing package. Cause: The CSLFRF funds were deposited to and expended from a non-federal fund. The SEFA closing package was prepared using similar procedures as the previous year by reporting federal expenditures included in federal funds. This approach did not consider that federal funds might have been expended through other means, and they were not reported. Additionally, there was staff turnover in a key financial position that contributed to this error. Effect: In the absence of the audit work completed and the resulting revised submission by the Department, the statewide SEFA would have included an understatement of $18 million for the Coronavirus State and Local Fiscal Recovery Fund, Assistance Listing number 21.027. Recommendation: We recommend that the Department strengthen the design and implementation of internal controls to ensure all federal funds are properly accounted for and those expenditures are included in the SEFA closing package. Management’s View: The Department of Administrations agrees that the SEF A was prepared using procedures similar to prior years, which failed to capture the expenditures related to the CSLFRF as those funds were deposited into a non-federal fund as directed by the legislature in HB752. Corrective Action: Prior to the issuance of this memo, the Department transferred the remaining $6,969,325.15 of CSLFRF funds into a separate reporting program. The Department will process quarterly reconciliations utilizing the quarterly reports from the insurance carrier. These transactions will then be queried each year, similar to other federal funding sources, and reported on the SEFA. Future federal awards will be deposited into a federal funding source or clearly delineated from non-federal funding sources to ensure proper reporting on the SEFA. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-202 Closing package submissions and revisions completed prior to the draft of the Schedule of Expenditures of Federal Awards (SEFA) being submitted for audit were not included in the schedule resulting in misstatements. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund; Medical Assistance Program; and Children’s Health Insurance Fund Assistance Listing Number: 21.027; 93.778; 93.767 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502. • Total amount provided to subrecipients from each federal program. Condition: The SEFA submitted for audit purposes included misstatements for Direct Awards for Assistance Listing (AL) number 21.027 (Coronavirus State and Local Fiscal Recovery Fund (CSLFRF)), 93.778 (Medical Assistance Program (Medicaid)), and 93.767 (Children’s Health Insurance Program (CHIP)). We noted the following errors in Direct Award Expenditures: • AL number 21.027 was understated $21,358,086 for Direct Award Expenditures reported by the Department of Health and Welfare and by an additional $500,000 reported by the Department of Correction. • AL number 93.778 was understated by $25,108,923 for Direct Expenditures reported by the Department of Health and Welfare. • AL number 93.767 was overstated by $3,469,677 for Direct Expenditures reported by the Department of Health and Welfare. Cause: Each year, State agencies report total federal awards expended on a closing package. The Office uses these closing packages to compile the SEFA. The Office’s review procedures over this process did not include the revised closing package submitted by the Department of Health and Welfare or the revisions communicated between the Office and the Department of Corrections. These revisions occurred prior to the draft of the SEFA submitted for audit. Effect: The SEFA submitted for audit contained misstatements; however, these errors have been corrected. In the absence of audit work completed, the statewide SEFA would have included an understatement of $21,858,086 for the CSLFRF program; an understatement of $25,108,923for the Medicaid program; and an overstatement of $3,469,677 for the CHIP program. Recommendation: We recommend that the Office design and implement procedures to ensure amounts reported on closing package submissions and later revisions are properly reviewed and reported on the statewide SEFA. Management’s View: The Office aAgrees with this finding. Corrective Action: An agency submitted a revised SEFA template in November 2023. We inadvertently excluded those revisions from the draft of the SEFA provided for audit. To prevent this error from happening again, we will document each agency that submits a revised SEFA template(s) on our SEFA review checklist. This will require the preparer and reviewer(s) to verify and sign off on changes made to the SEFA master file. Errors identified were corrected before issuance of the Single Audit report. Corrective actions will be implemented for fiscal year 2024 reporting. Auditor’s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

FINDING 2023-202 Closing package submissions and revisions completed prior to the draft of the Schedule of Expenditures of Federal Awards (SEFA) being submitted for audit were not included in the schedule resulting in misstatements. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund; Medical Assistance Program; and Children’s Health Insurance Fund Assistance Listing Number: 21.027; 93.778; 93.767 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502. • Total amount provided to subrecipients from each federal program. Condition: The SEFA submitted for audit purposes included misstatements for Direct Awards for Assistance Listing (AL) number 21.027 (Coronavirus State and Local Fiscal Recovery Fund (CSLFRF)), 93.778 (Medical Assistance Program (Medicaid)), and 93.767 (Children’s Health Insurance Program (CHIP)). We noted the following errors in Direct Award Expenditures: • AL number 21.027 was understated $21,358,086 for Direct Award Expenditures reported by the Department of Health and Welfare and by an additional $500,000 reported by the Department of Correction. • AL number 93.778 was understated by $25,108,923 for Direct Expenditures reported by the Department of Health and Welfare. • AL number 93.767 was overstated by $3,469,677 for Direct Expenditures reported by the Department of Health and Welfare. Cause: Each year, State agencies report total federal awards expended on a closing package. The Office uses these closing packages to compile the SEFA. The Office’s review procedures over this process did not include the revised closing package submitted by the Department of Health and Welfare or the revisions communicated between the Office and the Department of Corrections. These revisions occurred prior to the draft of the SEFA submitted for audit. Effect: The SEFA submitted for audit contained misstatements; however, these errors have been corrected. In the absence of audit work completed, the statewide SEFA would have included an understatement of $21,858,086 for the CSLFRF program; an understatement of $25,108,923for the Medicaid program; and an overstatement of $3,469,677 for the CHIP program. Recommendation: We recommend that the Office design and implement procedures to ensure amounts reported on closing package submissions and later revisions are properly reviewed and reported on the statewide SEFA. Management’s View: The Office aAgrees with this finding. Corrective Action: An agency submitted a revised SEFA template in November 2023. We inadvertently excluded those revisions from the draft of the SEFA provided for audit. To prevent this error from happening again, we will document each agency that submits a revised SEFA template(s) on our SEFA review checklist. This will require the preparer and reviewer(s) to verify and sign off on changes made to the SEFA master file. Errors identified were corrected before issuance of the Single Audit report. Corrective actions will be implemented for fiscal year 2024 reporting. Auditor’s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

FINDING 2023-202 Closing package submissions and revisions completed prior to the draft of the Schedule of Expenditures of Federal Awards (SEFA) being submitted for audit were not included in the schedule resulting in misstatements. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund; Medical Assistance Program; and Children’s Health Insurance Fund Assistance Listing Number: 21.027; 93.778; 93.767 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502. • Total amount provided to subrecipients from each federal program. Condition: The SEFA submitted for audit purposes included misstatements for Direct Awards for Assistance Listing (AL) number 21.027 (Coronavirus State and Local Fiscal Recovery Fund (CSLFRF)), 93.778 (Medical Assistance Program (Medicaid)), and 93.767 (Children’s Health Insurance Program (CHIP)). We noted the following errors in Direct Award Expenditures: • AL number 21.027 was understated $21,358,086 for Direct Award Expenditures reported by the Department of Health and Welfare and by an additional $500,000 reported by the Department of Correction. • AL number 93.778 was understated by $25,108,923 for Direct Expenditures reported by the Department of Health and Welfare. • AL number 93.767 was overstated by $3,469,677 for Direct Expenditures reported by the Department of Health and Welfare. Cause: Each year, State agencies report total federal awards expended on a closing package. The Office uses these closing packages to compile the SEFA. The Office’s review procedures over this process did not include the revised closing package submitted by the Department of Health and Welfare or the revisions communicated between the Office and the Department of Corrections. These revisions occurred prior to the draft of the SEFA submitted for audit. Effect: The SEFA submitted for audit contained misstatements; however, these errors have been corrected. In the absence of audit work completed, the statewide SEFA would have included an understatement of $21,858,086 for the CSLFRF program; an understatement of $25,108,923for the Medicaid program; and an overstatement of $3,469,677 for the CHIP program. Recommendation: We recommend that the Office design and implement procedures to ensure amounts reported on closing package submissions and later revisions are properly reviewed and reported on the statewide SEFA. Management’s View: The Office aAgrees with this finding. Corrective Action: An agency submitted a revised SEFA template in November 2023. We inadvertently excluded those revisions from the draft of the SEFA provided for audit. To prevent this error from happening again, we will document each agency that submits a revised SEFA template(s) on our SEFA review checklist. This will require the preparer and reviewer(s) to verify and sign off on changes made to the SEFA master file. Errors identified were corrected before issuance of the Single Audit report. Corrective actions will be implemented for fiscal year 2024 reporting. Auditor’s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

FINDING 2023-202 Closing package submissions and revisions completed prior to the draft of the Schedule of Expenditures of Federal Awards (SEFA) being submitted for audit were not included in the schedule resulting in misstatements. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund; Medical Assistance Program; and Children’s Health Insurance Fund Assistance Listing Number: 21.027; 93.778; 93.767 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502. • Total amount provided to subrecipients from each federal program. Condition: The SEFA submitted for audit purposes included misstatements for Direct Awards for Assistance Listing (AL) number 21.027 (Coronavirus State and Local Fiscal Recovery Fund (CSLFRF)), 93.778 (Medical Assistance Program (Medicaid)), and 93.767 (Children’s Health Insurance Program (CHIP)). We noted the following errors in Direct Award Expenditures: • AL number 21.027 was understated $21,358,086 for Direct Award Expenditures reported by the Department of Health and Welfare and by an additional $500,000 reported by the Department of Correction. • AL number 93.778 was understated by $25,108,923 for Direct Expenditures reported by the Department of Health and Welfare. • AL number 93.767 was overstated by $3,469,677 for Direct Expenditures reported by the Department of Health and Welfare. Cause: Each year, State agencies report total federal awards expended on a closing package. The Office uses these closing packages to compile the SEFA. The Office’s review procedures over this process did not include the revised closing package submitted by the Department of Health and Welfare or the revisions communicated between the Office and the Department of Corrections. These revisions occurred prior to the draft of the SEFA submitted for audit. Effect: The SEFA submitted for audit contained misstatements; however, these errors have been corrected. In the absence of audit work completed, the statewide SEFA would have included an understatement of $21,858,086 for the CSLFRF program; an understatement of $25,108,923for the Medicaid program; and an overstatement of $3,469,677 for the CHIP program. Recommendation: We recommend that the Office design and implement procedures to ensure amounts reported on closing package submissions and later revisions are properly reviewed and reported on the statewide SEFA. Management’s View: The Office aAgrees with this finding. Corrective Action: An agency submitted a revised SEFA template in November 2023. We inadvertently excluded those revisions from the draft of the SEFA provided for audit. To prevent this error from happening again, we will document each agency that submits a revised SEFA template(s) on our SEFA review checklist. This will require the preparer and reviewer(s) to verify and sign off on changes made to the SEFA master file. Errors identified were corrected before issuance of the Single Audit report. Corrective actions will be implemented for fiscal year 2024 reporting. Auditor’s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

Finding 2023-203 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller did not properly report expenditures for the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), 2 CFR 200.510(b), requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a non-federal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department did not identify expenditures accurately when completing the schedule of expenditures of federal awards closing package. The closing package includes different tabs to report total expenditures and expenditures made to subrecipients. Reported expenditures to subrecipients should be a subset of total expenditures. However, The Department reported zero total expenditures related to the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program but $10.5 million of expenditures to subrecipients. However, $10 million of that were funds that had been transferred to the Division of Public Works for the Wastewater Lagoon project. Because they are transferred from one state agency to another, these funds have not yet been expended by the State and, as such, should not be reported as expenditures. Cause: The Department did not appear to fully understand how to prepare the closing package, and it was not reviewed with enough detail or knowledge to identify the error. Effect: The statewide SEFA was understated by $500,000 that was truly expended, but only reported as a subrecipient expenditure and thus not included in total expenditures for the CSLFRF program. Recommendation: We recommend that the Department improve training and the review process for the SEFA closing package to ensure all amounts are correctly reported. Management’s View: The Department agrees with this finding. Corrective Action: After management review the department will improve training and process review of preparation of the SEFA closing package to ensure all amounts are correctly reported. This lack of understanding of the SEFA was due to staff turnover and lack of subject matter experts regarding the SEFA for Fiscal Year 2023. The agency will implement the following to fix this issue: a) Financial Manager (or delegate) expenditure detail report shall include grant fund 344 (ARPA grants), 348 fund (grants), and any additional funds designated by the legislature or agency, for the specific purpose of tracking federal grant funding. b) Once prepared by the Financial Manager (or delegate), review of the SEFA by the Financial Officer for completeness, verifying all required grant federal funds appropriated to the agency are included on the SEFA closing package. c) Financial Manager and Financial Officer meet to review the SEFA for agreement of grant expenditure amounts reported on the SEFA. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-204 The Schedule of Expenditures of Federal Awards (SEFA) closing package understated the Education Stabilization Fund - Governor’s Emergency Education Relief (GEER II) by $1,039,753 and overstated the Education Stabilization Fund – Emergency Assistance to Non-Public Schools (EANS) program by the same amount. Related to Prior Finding: 2021-202 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Governors Emergency Education Relief Fund; Emergency Assistance for Non-Public Schools Assistance Listing Number: 84.425C; 84.425R Federal Award Number: S425C210043; S425R210024 Program Year: January 8, 2021 – September 30, 2023; February 11, 2021 – September 30, 2023 Federal Agency: Department of Education Compliance Requirement: SEFA MisstatementU.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions. It provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR § 200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR § 200.502, and • Total amount provided to subrecipients from each federal program The Office of Management and Budget (OMB) Compliance Supplement also indicates that the SEFA should include the individual subprograms the funds were expended under, including each separate Assistance Listing (AL) number with the applicable alpha character. Condition: The Board completed a SEFA closing package to report federal grant expenditures. This closing package included errors in reporting for the Education Stabilization Fund. The Governor’s Emergency Education Relief (GEER II, Assistance Listing number 84.425C) expenditures were understated by $1,039,753 and the Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (EANS, Assistance Listing number 84.425R) expenditures were overstated by $1,039,753. Cause: The State was given a specific period of time to obligate funds under the EANS program. Unobligated funds were then required to be reverted to the governor to be redistributed and used under the GEER II program. The Board had difficulty tracking available funds for each program. When preparing the SEFA, Board staff found errors in the total amounts reported for each program and made unsupported adjustments to these two programs. Effect: Total federal expenditures reported on the Board’s SEFA was correct. However, specific identification by program, as required, was understated by $1,039,753 for one program, and one program was overstated by the same amount. Recommendation: We recommend that the Board design and implement procedures to ensure federal expenditure amounts for each program are properly reported and proper adjustments are made prior to the reporting deadline. Management’s View: The Board agrees with the finding. Corrective Action: The Report states “the State was given a specific period of time to obligate funds under the EANS program. Unobligated funds were then required to be reverted to the governor to be redistributed and used under the GEER II program. The Board had difficulty tracking available funds for each program. When preparing the SEFA, Board staff found errors in the total amounts reported for each program and made unsupported adjustments to these two programs.” The Finding states that total federal expenditures reported on the Board’s SEFA was correct. However, specific identification by program, as required, was understated by $1,039,753 for one program, and overstated for another program, by the same amount. Patrick Coulson, Chief Financial Officer and Scott Christie, Financial Manager met with Amy Brown, LSO Audit Manager. Ms. Brown indicated that the EANS funds should have been moved from the State Department of Education (SDE) federal DoE G5 system to OSBE G5 system for better management of the funds. Mr. Christie asked Gideon Tolman, Chief Financial Officer for SDE whether the EANS funds in G5 would move to OSBE G5. Mr. Tolman said they would not. At this point OSBE was working with three PCAs used for the same Budget Unit and Fund for all GEER II funds: GEER II 29410, EANS 29710 and GEANS (which was created for the reverted EANS funds now GEER II funds). The GEER II PCA 29410 had a specific CFDA number based on the Grant Award Notification. EANS PCA 29710 had a specific CFDA number based on the example Grant Award Notification provided by SDE. OSBE was not aware of, nor was it provided, a unique CFDA number that should be used for the reverted EANS/GEER II funds. Mr. Christie considered the SDE EANS GEER funds the same as the OSBE GEER funds. In other words, once unobligated EANS moneys were reverted (by operation of law) to the Governor,1 all moneys in the GEER II fund were considered fungible.2 They were in the same OSBE appropriation, Budget Unit and Fund. The only distinction was that OSBE and SDE had access to separate buckets of GEER cash. When a large contract came up for payment on June 29th, Mr. Christie was also looking ahead at the implementation of the new statewide ERP Luma system. Mr. Christie wasn’t confident that Project Contracts had been set up correctly in Luma. Mr. Christie also understood that there would be considerably more work reconciling grant to cash balances in Luma compared to the legacy ERP system. For these reasons, on June 29th Mr. Christie drew down all the remaining GEER II funds to zero out that grant by the end of the fiscal year. When the coding for the contract payment came across, it was coded to PCA 29410, GEER II. OSBE could have coded the payment to either PCA 29450 or 29710, as they were now all considered GEER II funds. We do not believe that there were unsupported adjustments to these two programs. The adjustments were based on making sure the SEFA was accurate, and accuracy was confirmed in the Report: “total federal expenditures reported on the Board’s SEFA was [sic] correct.” We wanted to ensure we were not overstating the expenses for GEER II on the SEFA. We believe the adjustments can be, and have been, explained and are supported by the simple fact that one PCA was chosen instead of another for the same fungible GEER II funds. Nevertheless, we will agree with the audit finding. Corrective Action: The corrective action is to reclass any GEER II Project transactions in FY 2024 to EANS/GEER II Project. That will ensure there are no GEER II transactions in FY 2024 that would need to be adjusted. This was done on March 21, 2024. Auditor’s Concluding Remarks: We thank the Board for its cooperation and assistance throughout the audit. We continue to assert that the Board submitted the SEFA closing package with errors, and that it was not aware there were errors until the audit team identified them as part of the procedures completed for this audit. If adjustments were being made to ensure an accurate SEFA, they failed. Our statement that “total federal expenditures reported on the Board’s SEFA was correct” is related to the material accuracy of the SEFA as a whole. This finding identifies errors made in reporting required by the Office of Management and Budget, as communicated in the Compliance Supplement, where it states that that the SEFA should include the individual subprograms the funds were expended under, including each separate Assistance Listing number with the applicable alpha character. There are many requirements related to the presentation of the SEFA beyond total expenditures that are reviewed for accuracy, such as amounts paid to subrecipients, or COVID-19 and non-cash expenditures. The errors made by the Board were between programs with different applicable alpha characters, and those programs serve different purposes. Accurate reporting that meets all requirements is important to ensure compliance with the terms of the grant.

FINDING 2023-204 The Schedule of Expenditures of Federal Awards (SEFA) closing package understated the Education Stabilization Fund - Governor’s Emergency Education Relief (GEER II) by $1,039,753 and overstated the Education Stabilization Fund – Emergency Assistance to Non-Public Schools (EANS) program by the same amount. Related to Prior Finding: 2021-202 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Governors Emergency Education Relief Fund; Emergency Assistance for Non-Public Schools Assistance Listing Number: 84.425C; 84.425R Federal Award Number: S425C210043; S425R210024 Program Year: January 8, 2021 – September 30, 2023; February 11, 2021 – September 30, 2023 Federal Agency: Department of Education Compliance Requirement: SEFA MisstatementU.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions. It provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR § 200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR § 200.502, and • Total amount provided to subrecipients from each federal program The Office of Management and Budget (OMB) Compliance Supplement also indicates that the SEFA should include the individual subprograms the funds were expended under, including each separate Assistance Listing (AL) number with the applicable alpha character. Condition: The Board completed a SEFA closing package to report federal grant expenditures. This closing package included errors in reporting for the Education Stabilization Fund. The Governor’s Emergency Education Relief (GEER II, Assistance Listing number 84.425C) expenditures were understated by $1,039,753 and the Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (EANS, Assistance Listing number 84.425R) expenditures were overstated by $1,039,753. Cause: The State was given a specific period of time to obligate funds under the EANS program. Unobligated funds were then required to be reverted to the governor to be redistributed and used under the GEER II program. The Board had difficulty tracking available funds for each program. When preparing the SEFA, Board staff found errors in the total amounts reported for each program and made unsupported adjustments to these two programs. Effect: Total federal expenditures reported on the Board’s SEFA was correct. However, specific identification by program, as required, was understated by $1,039,753 for one program, and one program was overstated by the same amount. Recommendation: We recommend that the Board design and implement procedures to ensure federal expenditure amounts for each program are properly reported and proper adjustments are made prior to the reporting deadline. Management’s View: The Board agrees with the finding. Corrective Action: The Report states “the State was given a specific period of time to obligate funds under the EANS program. Unobligated funds were then required to be reverted to the governor to be redistributed and used under the GEER II program. The Board had difficulty tracking available funds for each program. When preparing the SEFA, Board staff found errors in the total amounts reported for each program and made unsupported adjustments to these two programs.” The Finding states that total federal expenditures reported on the Board’s SEFA was correct. However, specific identification by program, as required, was understated by $1,039,753 for one program, and overstated for another program, by the same amount. Patrick Coulson, Chief Financial Officer and Scott Christie, Financial Manager met with Amy Brown, LSO Audit Manager. Ms. Brown indicated that the EANS funds should have been moved from the State Department of Education (SDE) federal DoE G5 system to OSBE G5 system for better management of the funds. Mr. Christie asked Gideon Tolman, Chief Financial Officer for SDE whether the EANS funds in G5 would move to OSBE G5. Mr. Tolman said they would not. At this point OSBE was working with three PCAs used for the same Budget Unit and Fund for all GEER II funds: GEER II 29410, EANS 29710 and GEANS (which was created for the reverted EANS funds now GEER II funds). The GEER II PCA 29410 had a specific CFDA number based on the Grant Award Notification. EANS PCA 29710 had a specific CFDA number based on the example Grant Award Notification provided by SDE. OSBE was not aware of, nor was it provided, a unique CFDA number that should be used for the reverted EANS/GEER II funds. Mr. Christie considered the SDE EANS GEER funds the same as the OSBE GEER funds. In other words, once unobligated EANS moneys were reverted (by operation of law) to the Governor,1 all moneys in the GEER II fund were considered fungible.2 They were in the same OSBE appropriation, Budget Unit and Fund. The only distinction was that OSBE and SDE had access to separate buckets of GEER cash. When a large contract came up for payment on June 29th, Mr. Christie was also looking ahead at the implementation of the new statewide ERP Luma system. Mr. Christie wasn’t confident that Project Contracts had been set up correctly in Luma. Mr. Christie also understood that there would be considerably more work reconciling grant to cash balances in Luma compared to the legacy ERP system. For these reasons, on June 29th Mr. Christie drew down all the remaining GEER II funds to zero out that grant by the end of the fiscal year. When the coding for the contract payment came across, it was coded to PCA 29410, GEER II. OSBE could have coded the payment to either PCA 29450 or 29710, as they were now all considered GEER II funds. We do not believe that there were unsupported adjustments to these two programs. The adjustments were based on making sure the SEFA was accurate, and accuracy was confirmed in the Report: “total federal expenditures reported on the Board’s SEFA was [sic] correct.” We wanted to ensure we were not overstating the expenses for GEER II on the SEFA. We believe the adjustments can be, and have been, explained and are supported by the simple fact that one PCA was chosen instead of another for the same fungible GEER II funds. Nevertheless, we will agree with the audit finding. Corrective Action: The corrective action is to reclass any GEER II Project transactions in FY 2024 to EANS/GEER II Project. That will ensure there are no GEER II transactions in FY 2024 that would need to be adjusted. This was done on March 21, 2024. Auditor’s Concluding Remarks: We thank the Board for its cooperation and assistance throughout the audit. We continue to assert that the Board submitted the SEFA closing package with errors, and that it was not aware there were errors until the audit team identified them as part of the procedures completed for this audit. If adjustments were being made to ensure an accurate SEFA, they failed. Our statement that “total federal expenditures reported on the Board’s SEFA was correct” is related to the material accuracy of the SEFA as a whole. This finding identifies errors made in reporting required by the Office of Management and Budget, as communicated in the Compliance Supplement, where it states that that the SEFA should include the individual subprograms the funds were expended under, including each separate Assistance Listing number with the applicable alpha character. There are many requirements related to the presentation of the SEFA beyond total expenditures that are reviewed for accuracy, such as amounts paid to subrecipients, or COVID-19 and non-cash expenditures. The errors made by the Board were between programs with different applicable alpha characters, and those programs serve different purposes. Accurate reporting that meets all requirements is important to ensure compliance with the terms of the grant.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Finding 2023-206 The Department did not fully disclose required information to subrecipients, document subrecipient risk assessments, or ensure subrecipient audits were received for the Coronavirus State and Local Fiscal Recovery Fund. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 - December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. The requirements for pass-through entities are in 2 CFR 200.332, which states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and include the following information at the time of the subaward or if information changes. Required information includes: • Federal Award Identification 1. Subrecipient’s name (which must match the name associated with its unique entity identifier); 2. Subrecipient’s unique entity identifier; 3. Federal Award Identification Number (FAIN); 4. Federal award date of award to the recipient by the federal agency 5. Subaward period of performance start and end date; 6. Subaward budget period start and end date; 7. Amount of federal funds obligated by this action by the pass-through entity to the subrecipient; 8. Total amount of federal funds obligated to the subrecipient by the pass-through entity to the subrecipient; 9. Total amount of the federal award committed to the subrecipient by the pass-through entity; 10. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); 11. Name of awarding agency, pass-though entity, and contact information for awarding official of the pass-through entity; 12. Assistance Listings (AL) number and title; 13. Identification of whether the award is research and development (R&D); and 14. Indirect cost rate for the federal award • All requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the federal award. • Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the federal awarding agency, included identification of any required financial and performance reports. Pass-through entities must also: • Evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. • Consider imposing specific subaward conditions upon a subrecipient, if appropriate. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subawards, and that subaward performance goals are achieved. • Verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, and follow up on the results of those audits. Condition: The Department received funds for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF, AL number 21.027) from the U.S. Department of Treasury through the Idaho Division of Financial Management. The Department passed through $18,941,327 from the SLFRF to 74 subrecipients. We selected a sample of 8 subrecipients to test compliance with these requirements. We found the Department complied with some, but not all, of the pass-through entity requirements. The Department did not provide the following required information in all 8 of the items tested: • Federal Award Identification Number (FAIN) • Federal award date of award to the recipient by the federal agency • Subaward period of performance start and end dates • Total amount of federal award committed to the subrecipient • Identification of whether the award is for (R&D) • Indirect cost rate for the federal award The Department did not provide the AL number to 3 of the 8 subrecipients tested and provided an incorrect AL number to 4 of the 8 subrecipients tested. The Department implemented the grant in the Waste Management and Remediation Division and the Grants and Loans Bureau. Single Audit reports are required to be submitted to pass-through entities no later than 9 months after the subrecipient’s fiscal year end or within 60 days of the issuance of the report. The Department passed funds through to subrecipients beginning in fiscal year 2023; therefore, no subrecipient Single Audit reports would be due during our audit period. However, we reviewed procedures the Department implemented to ensure that these audits would be collected when due. We found that the Grants and Loans Bureau had procedures in place that would be effective in collecting and evaluating the subrecipient reports; however, the Waste Management and Remediation Division did not have effective procedures to collect the reports. Cause: The Department used a basic template in creating an award letter and grant agreement. The template did not include all the required information. The FAIN was not communicated to the Department by the Division of Financial Management. The Department was also unaware that the FAIN and AL number were different. The period of performance was not included because the Department provided the budget period for the project and was concerned that subrecipients would be confused about the spending period for their grants. The Department did not identify whether the grant was for R&D because they felt it was sufficiently communicated that the funds were for planning, construction, or waste management projects and not for R&D. The indirect rate was not included because the Department communicated that the funds were for construction costs only, which does not include indirect costs. The Department did not have a formal documented risk assessment because they believed that this was sufficiently done during the application process and during the actual grant award period. However, these procedures are informal, and no documentation is retained that specifically identifies risks of noncompliance with federal grant rules for the purpose of determining monitoring procedures. The Waste Management and Remediation Division did not have procedures to collect subrecipient Single Audit reports because they believed that the fiscal operations division would perform that function. Our discussions with the fiscal operations found that there was a position with the assigned duties to collect subrecipient Single Audits, but that position was vacant during fiscal year 2023, and the Department had difficulty filling the position. Effect: Subrecipient monitoring is a critical requirement as part of accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other guidelines provided by the grantor. Subrecipients need the required grant information to properly implement, manage, and report the federal award. Without this information, subrecipients have an increased risk of noncompliance with the federal award requirements. Assessing the risk of subrecipient noncompliance enables a pass-through entity to determine the proper level of monitoring procedures. Without completing the risk assessment process, a pass-thought entity may increase the risk that appropriate monitoring procedures will not be performed at a sufficient level to detect noncompliance or that a subrecipient will not comply with the grant terms. There were no subrecipient Single Audit reports due during our audit period; however, a well-designed procedure for collecting these reports is an important pass-through entity responsibility. Subrecipient audit reports may identify internal control issues and noncompliance with federal award requirements. Reviewing these reports and ensuring that potential issues are addressed decreases the overall risk of noncompliance with the federal award requirements. Recommendation: We recommend that the Department design and implement appropriate procedures to ensure that all required information is communicated to subrecipients at the time of the award, subrecipient risk assessments are properly completed and documented, and subrecipient audits are completed and reviewed in accordance with federal grant regulations. Management’s View: The department agrees with the lack of certain required subrecipient information datapoints for the CSLFRF projects. Corrective Action: The department had an imperfect implementation of the initial subawards for CSLFRF documentation for subrecipients. Our general practice includes providing the identified federal award identification datapoints; however, this was not the case with the initial CSLFRF subrecipients. As an example, the period of performance was truncated to ensure that we were able to meet the aggressive timeline outlined in the American Rescue Plan Act; we will include both the true period of performance as set forth in the grant and the budgetary period in which the subrecipient will need to complete their work. Carrie Champlin, Contracts Manager, and Rob Sepich, Chief Financial Officer will implement these changes by April 15, 2024. The department had processes for evaluating the risk of subrecipients, however it could be improved and made clearer for auditors and we will implement a process used by other agencies to memorialize the risk factors outside of email in a clear and concise manner. Additionally, the department is currently implementing a new software system, Amplifund, to aid in registering subrecipients, monitoring them, and closing out subawards. This system will include all of the relevant information necessary for both the subrecipient and the department in one location and will provide consistency across the department. Amplifund implementation is currently underway and will be used department- wide by August 2024. Doug McRoberts, Grants Manager, Jeri Ann Fogg, Accounting Manager, Carrie Champlin, Contracts Manager are working on the integration of Amplifund. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-207 The Division overstated federal expenditures by incorrectly including $6.6 million expended under the State Small Business Credit Initiative (SSBCI) on the Schedule of Expenditures of Federal Awards (SEFA) closing package. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: State Small Business Credit Initiative Assistance Listing Number: 21.031 Federal Award Number: Not Applicable Program Year: Not Applicable Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 2 CFR 200.510, requires the State to prepare a SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. The SSBCI statute, 12 U.S.C. § 5702(c)(5), specifically states that capital funds transferred to jurisdictions are not considered federal financial assistance for the purposes of 31 U.S.C. subtitle V. As such, capital funds are not subject to the single audit requirements of the Single Audit Act or 2 CFR 200, Subpart F. Condition: The Division reported $6.6 million in federal expenditures incurred under the SSBCI program on the SEFA closing package. These SSBCI funds includes two programs: the Capital Program and the Technical Assistance (TA) Grant Program. Under the Capital Program, participating jurisdictions implement credit and equity/venture capital programs to provide capital to small businesses. The Division received funding under the Capital Program, these funds are not subject to the Single Audit requirements of 2 CFR Subpart F. Cause: The Division was unaware that the Capital Program funds should not have been included on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Division, the statewide SEFA would have included an overstatement of $6.6 million for the SSBCI program. Recommendation: We recommend that the Division improve training and the review process for the SEFA closing package to ensure appropriate reporting of federal expenditures on the SEFA. Management’s View: The Division of Financial Management concurs with the finding. Corrective Action: The agency will implement improved training and review for the SEFA closing package prior to submission to ensure appropriate reporting of federal expenditures on the SEFA. The SSBCI funds were included in an abundance of caution to ensure reporting of all federal funds received, as it is rare that federal monies are to be excluded from the SEFA. Moving forward, preparation of the SEFA will include an analysis of all new federal awards to be included to confirm if the amounts are to be included, and a side-by-side comparison of the prospective list to the prior year report to note any differences and investigation of any that exist. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-210 Low-Income Home Energy Assistance Program (LIHEAP) performance and special reports did not include a review for accuracy and compliance prior to submission. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Federal Award Number: 2101IDLWC6; 2201IDLIEA; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024; October 1, 2021 – September 30, 2023; October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: During fiscal year 2023, the LIHEAP program was required to submit one program performance report and six program special reports to the federal government. The Department’s LIHEAP program manager compiles the program performance report and program special reports. The reports are submitted by the same program manager to the Office of Community Services. The reviews and the approvals for all seven reports tested were not documented. There was no documented review for accuracy nor approval of the reports. In addition, three of the annual special reports were not submitted timely. Cause: The Department staff indicated that there is no official approval process as reports are submitted online and the data source is either collaborated or provided by internal sources and verified. The Department did not consider that documentation to support the review and the approval of these reports was necessary to ensure accuracy and compliance with reporting requirements. Effect: Three of the annual LIHEAP special reports were not submitted timely. We did not identify any other errors in the performance or special reports. However, in the absence of a documented appropriate internal control, there is an increased risk of errors occurring and going undetected. Further, the Department could submit the performance and special reports with incomplete or inaccurate information required by the grant agreement. Recommendation: We recommend that the Department design and implement internal controls to ensure sufficient documentation is maintained to support the completion of a review for accuracy and compliance for required LIHEAP reports, prior to submission. Management’s View: The Department agrees with the finding. Corrective Action: The Program will develop a process to work with the Information Management and Analysis Team (IMAT) within the division to compile the data for the Low-Income Home Energy Assistance Program (LIHEAP) reports. Program will review the completed reports for accuracy. All reports will then be submitted to the Bureau Chief, as a second review of accuracy, prior to submission to Federal Partners. Documentation will be maintained to support the preparation, review, and approval steps. The process outlines a timeline to have reports prepared and reviewed ahead of the established deadline. Program will communicate with our Federal Partner if circumstances arise that would prevent a report from being submitted by an established deadline to receive an extension. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-211 The review and approval of the annual updates to the Low-Income Home Energy Assistance Program (LIHEAP) benefits matrix were not documented. Type of Finding: Significant Deficiency Assistance Listing Title: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Federal Award Number: 2101IDLWC6; 2201IDLIEA; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024; October 1, 2021 – September 30, 2023; October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP utilizes a software to determine eligibility and benefit amounts for applicants based on energy burden and qualifying factors. There is a benefits matrix within the software, which is updated annually. Each year, the Department’s LIHEAP program staff update the benefits matrix with any required changes. The review and approval of the changes were completed by program staff, who met in-person and completed testing scenarios to verify the accuracy of the information. After the test results were reviewed and no errors identified, the matrix information was uploaded into software production prior to the start of the heating season. The review and approval of the changes to the benefits matrix were not documented. Verbal confirmation was provided to the program manager. Cause: The Department did not consider that documentation to support the review and approval of the updates to the benefits matrix was necessary. Effect: We did not identify errors in the 60 approved and 60 denied eligibility determinations that we reviewed. However, without review (documented) there is an increased risk of errors in the matrix either because of erroneous changes or no changes occurring and then going undetected in eligibility determinations. Recommendation: We recommend that the Department design and implement procedures to ensure sufficient documentation is maintained that supports the review and approval of the updates to the benefits matrix. Management’s View: The Department agrees with the finding. Corrective Action: Testing of the updated benefits matrix will be completed by the Program annually, and the results will be documented using an established scenario testing script. Results of the testing will be documented and submitted to the Bureau Chief, as a second review of accuracy and compliance, prior to moving the updated matrix into the production environment. Documentation will be maintained to support the review and approval. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-212 The review of the Low-Income Home Energy Assistance Program (LIHEAP) earmarking compliance requirements was not documented. Type of Finding: Material Weakness Assistance Listing Title: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Federal Award Number: 2101IDLWC6; 2201IDLIEA; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024; October 1, 2021 – September 30, 2023; October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Matching; LOE; Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP requires earmarking which limits the percentage of grant funds that can be spent on administration, weatherization, and leveraging programs. The monitoring of LIHEAP earmarking requirements was completed by the program manager on a spreadsheet that tracked expenditures and appropriate limitations to ensure compliance was met. However, there was no documented review for accuracy nor approval of the tracking spreadsheet. Cause: The Department did not consider that documentation to support the review and approval of the earmarking tracking spreadsheet was necessary to ensure accuracy and compliance. Effect: We did not identify any errors in compliance with earmarking requirements during completion of audit procedures, but the lack of a documented review increases the risk of errors occurring and going undetected. Recommendation: We recommend that the Department design and implement procedures to ensure sufficient documentation is maintained that supports the review and approval of the earmarking tracking spreadsheet. Management’s View: The Department agrees with the finding. Corrective Action: The Program will document the current process regarding the preparation, review, and approval of the Low-Income Home Energy Assistance Program (LIHEAP) budget that includes maintaining the documentation of the earmarking reviews that are being completed. The program will prepare the Low-Income Home Energy Assistance Program (LIHEAP) budget. This budget will be submitted to the Bureau Chief, as a second review of accuracy and compliance, to include review of earmarking limits, prior to routing the Annual State Plan for review and submittal or the allocation of any funding. Documentation will be maintained to support the review and approval. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-213 The Department erroneously determined that two recipients of Temporary Assistance for Needy Families (TANF) funding were contractors instead of subrecipients resulting in noncompliance with the subrecipient monitoring requirements. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Federal Award Number: 2201IDTANF; 2301IDTANF Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.331 describes the Department’s, a pass-through entity, responsibility for completing subrecipient and contractor determinations. The Uniform Guidance included in 2 CFR 200.332 (a) states that pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward. Also, if any of these data elements change, include the changes in subsequent subaward modification.   (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal award date (see the definition of federal award date in 2 CFR 200.1 of this part) of award to the recipient by the federal agency; (v) Subaward period of performance start and end date; (vi) Subaward budget period start and end date; (vii) Amount of federal funds obligated by this action by the pass-through entity to the subrecipient; (viii) Total amount of federal funds obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total amount of the federal award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of federal awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity; (xii) Assistance Listings number and title; the pass-through entity must identify the dollar amount made available under each federal award and the Assistance Listings number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the federal award, including if the de minimis rate is charged per 2 CFR 200.414. If any of the required information is not available, the pass-through entity must provide the best information available to describe the federal award and subaward. The Uniform Guidance included 2 CFR 200.332(b) states that pass-through entities must evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a single audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of federal awarding agency monitoring (for example, if the subrecipient also receives federal awards directly from a federal awarding agency). Condition: The Department erroneously determined that two recipients of TANF funding were contractors instead of subrecipients. A contractor provides services or goods while a subrecipient has additional responsibilities related to the grant administration. Because of that, there are additional requirements when passing through funds to a subrecipient, rather than making a payment to a vendor. We tested one of the two subrecipients for compliance purposes. The award was not identified to the subrecipient as a subaward and did not include all the necessary information at the time of the subaward. In addition, the subrecipient's risk of noncompliance was not evaluated. Cause: During our analysis of the subrecipient monitoring compliance requirement, we learned that the Department’s program staff determined that some of the recipients of TANF funding were contractors. However, the Department’s financial staff reported the expenditures as payments to subrecipients on the SEFA. After investigation, we found that the expenditures were made to subrecipients, not contractors. Effect: The Department is exposed to increased risk of noncompliance related to subrecipients and improper payments in the TANF program. The Department provided a total amount of $1.4 million to subrecipients during fiscal year 2023. Recommendation: We recommend that the Department implement proper training of personnel involved in subrecipient and contractor determinations. In addition, we recommend that the Department design and implement effective internal control procedures to ensure all required information is provided to subrecipients at the time of subawards and that the Department complete the required evaluations of each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. Management’s View: The Department agrees with the finding. Corrective Action: The Department has revised our training of personnel involved in subrecipient and contractor determinations. These contract managers and monitors completed grant training on March 12th-13th, 2024 which included sections about subrecipient and contractor determinations, risk assessment and documentation. All newly hired employees will be trained beginning April 2024 with an on-line module. For the impacted vendor, an updated Risk Assessment was completed and submitted to LSO. Additionally, the Department has started the work to effectively change the designation of the vendor and ensure all required information is provided to this subrecipient. This process will be completed by April 30th, 2024. The Department will develop internal control procedures to ensure all required information is provided to the subrecipients at the time of the subawards. These updated internal control procedures will be completed by June 30th, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-214 The Department did not maintain sufficient documentation to support eligibility award decisions for the Community Partners Grants within the Child Care and Development Fund (CCDF) program. Type of Finding: Material Weakness Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2101IDCDC6 (ARPA); 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2020 – September 30, 2024; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility; Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Child Care and Development Fund (CCDF) program received additional funding through the Coronavirus Aid, Relief, and Economic Security (CARES) Act and American Rescue Plan Act (ARPA). During testing for eligibility within the CCDF program, we reviewed ARPA provider applications to determine if they were properly reviewed and approved by appropriate personnel. For four of the sixty providers tested (or 6.67 percent), there was no documentation to show who completed the eligibility evaluation or when the evaluation was completed. All four providers were Community Partners Grant recipients. Cause: The Department did not design and properly document a review process that would identify who participated, what was evaluated, what each applicant scored on the evaluation criteria, and the final decision made for the Community Partners Grant recipients. The Department stated that review and approval of the grants was a group effort and agreed that the process was not properly documented. Additionally, there was an indication of high turnover during grant processing, which could have contributed to missing documentation. Effect: The Department did not maintain adequate support for the Community Partners Grant application approvals, which could have resulted in grant funds being awarded to ineligible recipients. Recommendation: We recommend that the Department ensure that internal controls are consistently performed to ensure adequate evaluations of grant applications are properly documented. Management’s View: The Department agrees with the finding. It should be noted that the Community Partner Grants have ended. Corrective Action: The division will: • All employees who administer grants will be required to complete training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. • The Division will work closely with the Division of Management Services to support the development and implementation of updated record retention policies and processes which will result in relevant documents being centrally retained. Estimated completion date December 31, 2024. Between now and when that central repository is available, individual rubrics and their supporting documents related to grant awards will be retained. • All employees will complete an annual employee conflict-of-interest disclosure and recertification process. Current completion of the new employee conflict of interest from will be completed by April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-214 The Department did not maintain sufficient documentation to support eligibility award decisions for the Community Partners Grants within the Child Care and Development Fund (CCDF) program. Type of Finding: Material Weakness Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2101IDCDC6 (ARPA); 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2020 – September 30, 2024; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility; Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Child Care and Development Fund (CCDF) program received additional funding through the Coronavirus Aid, Relief, and Economic Security (CARES) Act and American Rescue Plan Act (ARPA). During testing for eligibility within the CCDF program, we reviewed ARPA provider applications to determine if they were properly reviewed and approved by appropriate personnel. For four of the sixty providers tested (or 6.67 percent), there was no documentation to show who completed the eligibility evaluation or when the evaluation was completed. All four providers were Community Partners Grant recipients. Cause: The Department did not design and properly document a review process that would identify who participated, what was evaluated, what each applicant scored on the evaluation criteria, and the final decision made for the Community Partners Grant recipients. The Department stated that review and approval of the grants was a group effort and agreed that the process was not properly documented. Additionally, there was an indication of high turnover during grant processing, which could have contributed to missing documentation. Effect: The Department did not maintain adequate support for the Community Partners Grant application approvals, which could have resulted in grant funds being awarded to ineligible recipients. Recommendation: We recommend that the Department ensure that internal controls are consistently performed to ensure adequate evaluations of grant applications are properly documented. Management’s View: The Department agrees with the finding. It should be noted that the Community Partner Grants have ended. Corrective Action: The division will: • All employees who administer grants will be required to complete training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. • The Division will work closely with the Division of Management Services to support the development and implementation of updated record retention policies and processes which will result in relevant documents being centrally retained. Estimated completion date December 31, 2024. Between now and when that central repository is available, individual rubrics and their supporting documents related to grant awards will be retained. • All employees will complete an annual employee conflict-of-interest disclosure and recertification process. Current completion of the new employee conflict of interest from will be completed by April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-214 The Department did not maintain sufficient documentation to support eligibility award decisions for the Community Partners Grants within the Child Care and Development Fund (CCDF) program. Type of Finding: Material Weakness Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2101IDCDC6 (ARPA); 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2020 – September 30, 2024; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility; Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Child Care and Development Fund (CCDF) program received additional funding through the Coronavirus Aid, Relief, and Economic Security (CARES) Act and American Rescue Plan Act (ARPA). During testing for eligibility within the CCDF program, we reviewed ARPA provider applications to determine if they were properly reviewed and approved by appropriate personnel. For four of the sixty providers tested (or 6.67 percent), there was no documentation to show who completed the eligibility evaluation or when the evaluation was completed. All four providers were Community Partners Grant recipients. Cause: The Department did not design and properly document a review process that would identify who participated, what was evaluated, what each applicant scored on the evaluation criteria, and the final decision made for the Community Partners Grant recipients. The Department stated that review and approval of the grants was a group effort and agreed that the process was not properly documented. Additionally, there was an indication of high turnover during grant processing, which could have contributed to missing documentation. Effect: The Department did not maintain adequate support for the Community Partners Grant application approvals, which could have resulted in grant funds being awarded to ineligible recipients. Recommendation: We recommend that the Department ensure that internal controls are consistently performed to ensure adequate evaluations of grant applications are properly documented. Management’s View: The Department agrees with the finding. It should be noted that the Community Partner Grants have ended. Corrective Action: The division will: • All employees who administer grants will be required to complete training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. • The Division will work closely with the Division of Management Services to support the development and implementation of updated record retention policies and processes which will result in relevant documents being centrally retained. Estimated completion date December 31, 2024. Between now and when that central repository is available, individual rubrics and their supporting documents related to grant awards will be retained. • All employees will complete an annual employee conflict-of-interest disclosure and recertification process. Current completion of the new employee conflict of interest from will be completed by April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-215 The Department’s review of child care providers health and safety inspections for the Child Care and Development Fund (CCDF) were not completed timely. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Grant Guidance included in 42 USC 98859c(c)(2)(i) - (I) Health and Safety requirements states that the plan shall include a certification that there are in effect within the State, under State or local law, requirements designed to protect the health and safety of children that are applicable to child care providers that provide services for which assistance is made available in accordance with this subchapter. The Department has contracted with the Idaho Central District Health (ICDH) to complete required health and safety inspections. The Department’s policy is to monitor the contracted inspections. The Department’s Contracts and External Resource Management (CERM) team is tasked with conducting reviews of the monitoring completed by ICDH. The CERM team review includes randomly sampling the health and safety inspections based on a calculation per Department operating procedures. Contract monitoring done by the CERM team includes verifying compliance with contract requirements, such as reviewing expenditures, approving invoices for payment based on compliance to the contract terms, reviewing, performance standards, and ensuring compliance with record keeping provisions. Condition: During our audit, we determined that all eight of the monitoring reviews conducted by the CERM team, for health and safety inspections completed by the ICDH for fiscal year 2022, were completed on January 30, 2024. The Department reviews were completed after the audit of the program commenced. Based on our analysis, it appeared that the ICDH was properly completing the health and safety inspections. However, the Department cannot ensure that childcare providers serving children who receive subsidies meet applicable health and safety standards when monitoring the contracted reviews occurs so far after the date of review. Additionally, when the Department contracted these inspections out to the ICDH, they did not include a time frame to complete the reviews of the inspections in its policies and procedures. Completing reviews more than 12-months after the inspection greatly increases the risk of noncompliance and reduces the Department’s ability to enforce compliance. Cause: According to the Department, personnel staffing issues led to the delay of the Department’s reviews over the health and safety inspections. Effect: The CERM team did not review the providers’ health and safety inspections in a timely manner. Providers receiving subsidies could have been noncompliant with all applicable health and safety requirements and children could have been unduly at risk. Recommendation: We recommend that the Department complete reviews of the health and safety inspections in a timely manner. We also recommend that the Department define due dates for completion of these reviews within the program guidelines to provide an appropriate time to remediate issues raised during the inspections and ensure compliance. Management’s View: The Department agrees with the finding. The Department review of contracted health and safety inspections was not performed timely. Completion of childcare provider health and safety inspections is very important to the Department. Childcare providers are not certified for program subsidy participation without an inspection. Corrective Action: The division will complete reviews of the health and safety inspections in a timely manner. The division will review and update the existing process document to support this corrective action plan defining timeframes for completion of these reviews so that there is appropriate time to remediate issues raised during the inspections and ensure compliance. The updated process document will be in place and appropriate staff will implement by 9/30/2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-215 The Department’s review of child care providers health and safety inspections for the Child Care and Development Fund (CCDF) were not completed timely. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Grant Guidance included in 42 USC 98859c(c)(2)(i) - (I) Health and Safety requirements states that the plan shall include a certification that there are in effect within the State, under State or local law, requirements designed to protect the health and safety of children that are applicable to child care providers that provide services for which assistance is made available in accordance with this subchapter. The Department has contracted with the Idaho Central District Health (ICDH) to complete required health and safety inspections. The Department’s policy is to monitor the contracted inspections. The Department’s Contracts and External Resource Management (CERM) team is tasked with conducting reviews of the monitoring completed by ICDH. The CERM team review includes randomly sampling the health and safety inspections based on a calculation per Department operating procedures. Contract monitoring done by the CERM team includes verifying compliance with contract requirements, such as reviewing expenditures, approving invoices for payment based on compliance to the contract terms, reviewing, performance standards, and ensuring compliance with record keeping provisions. Condition: During our audit, we determined that all eight of the monitoring reviews conducted by the CERM team, for health and safety inspections completed by the ICDH for fiscal year 2022, were completed on January 30, 2024. The Department reviews were completed after the audit of the program commenced. Based on our analysis, it appeared that the ICDH was properly completing the health and safety inspections. However, the Department cannot ensure that childcare providers serving children who receive subsidies meet applicable health and safety standards when monitoring the contracted reviews occurs so far after the date of review. Additionally, when the Department contracted these inspections out to the ICDH, they did not include a time frame to complete the reviews of the inspections in its policies and procedures. Completing reviews more than 12-months after the inspection greatly increases the risk of noncompliance and reduces the Department’s ability to enforce compliance. Cause: According to the Department, personnel staffing issues led to the delay of the Department’s reviews over the health and safety inspections. Effect: The CERM team did not review the providers’ health and safety inspections in a timely manner. Providers receiving subsidies could have been noncompliant with all applicable health and safety requirements and children could have been unduly at risk. Recommendation: We recommend that the Department complete reviews of the health and safety inspections in a timely manner. We also recommend that the Department define due dates for completion of these reviews within the program guidelines to provide an appropriate time to remediate issues raised during the inspections and ensure compliance. Management’s View: The Department agrees with the finding. The Department review of contracted health and safety inspections was not performed timely. Completion of childcare provider health and safety inspections is very important to the Department. Childcare providers are not certified for program subsidy participation without an inspection. Corrective Action: The division will complete reviews of the health and safety inspections in a timely manner. The division will review and update the existing process document to support this corrective action plan defining timeframes for completion of these reviews so that there is appropriate time to remediate issues raised during the inspections and ensure compliance. The updated process document will be in place and appropriate staff will implement by 9/30/2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-215 The Department’s review of child care providers health and safety inspections for the Child Care and Development Fund (CCDF) were not completed timely. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Grant Guidance included in 42 USC 98859c(c)(2)(i) - (I) Health and Safety requirements states that the plan shall include a certification that there are in effect within the State, under State or local law, requirements designed to protect the health and safety of children that are applicable to child care providers that provide services for which assistance is made available in accordance with this subchapter. The Department has contracted with the Idaho Central District Health (ICDH) to complete required health and safety inspections. The Department’s policy is to monitor the contracted inspections. The Department’s Contracts and External Resource Management (CERM) team is tasked with conducting reviews of the monitoring completed by ICDH. The CERM team review includes randomly sampling the health and safety inspections based on a calculation per Department operating procedures. Contract monitoring done by the CERM team includes verifying compliance with contract requirements, such as reviewing expenditures, approving invoices for payment based on compliance to the contract terms, reviewing, performance standards, and ensuring compliance with record keeping provisions. Condition: During our audit, we determined that all eight of the monitoring reviews conducted by the CERM team, for health and safety inspections completed by the ICDH for fiscal year 2022, were completed on January 30, 2024. The Department reviews were completed after the audit of the program commenced. Based on our analysis, it appeared that the ICDH was properly completing the health and safety inspections. However, the Department cannot ensure that childcare providers serving children who receive subsidies meet applicable health and safety standards when monitoring the contracted reviews occurs so far after the date of review. Additionally, when the Department contracted these inspections out to the ICDH, they did not include a time frame to complete the reviews of the inspections in its policies and procedures. Completing reviews more than 12-months after the inspection greatly increases the risk of noncompliance and reduces the Department’s ability to enforce compliance. Cause: According to the Department, personnel staffing issues led to the delay of the Department’s reviews over the health and safety inspections. Effect: The CERM team did not review the providers’ health and safety inspections in a timely manner. Providers receiving subsidies could have been noncompliant with all applicable health and safety requirements and children could have been unduly at risk. Recommendation: We recommend that the Department complete reviews of the health and safety inspections in a timely manner. We also recommend that the Department define due dates for completion of these reviews within the program guidelines to provide an appropriate time to remediate issues raised during the inspections and ensure compliance. Management’s View: The Department agrees with the finding. The Department review of contracted health and safety inspections was not performed timely. Completion of childcare provider health and safety inspections is very important to the Department. Childcare providers are not certified for program subsidy participation without an inspection. Corrective Action: The division will complete reviews of the health and safety inspections in a timely manner. The division will review and update the existing process document to support this corrective action plan defining timeframes for completion of these reviews so that there is appropriate time to remediate issues raised during the inspections and ensure compliance. The updated process document will be in place and appropriate staff will implement by 9/30/2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-216 The Department did not have appropriate documentation to support allowability of transactions for the Foster Care Title IV-E program. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Costs Principles Questioned Costs: Known $4,555; Projected $213,387 Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 U.S. Code (USC) 675(4)(A) states that the term “foster care maintenance payments” means payments to cover the cost of (and the cost of providing) food, clothing, shelter, daily supervision, school supplies, a child’s personal incidentals, liability insurance with respect to a child, reasonable travel to the child’s home for visitation, and reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement. The Uniform Guidance included in 45 CFR 1356.60(c)(3) states that allowable administrative costs do not include the costs of social services provided to the child, the child's family or foster family, which provide counseling or treatment to ameliorate or remedy personal problems, behaviors, or home conditions. The Uniform Guidance states that costs claimed as foster maintenance payments that include medical, educational (except for school supplies and the cost of reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement in foster care), or other expenses not outlined in 42 USC 675(4)(A) are unallowed. Condition: We tested 61 expenditure transactions charged to the Foster Care - Title IV-E program. The sample included 4 expenditures that were for unallowable costs charged to the program or that were missing supporting documentation making it difficult to determine if the costs were allowable. We also identified one transaction that did not have evidence of review and approval prior to payment but appears to be for an allowable expenditure. The details for the 5 of 61, or 8 percent, transactions with exceptions is as follows: 1) We determined that 2 out of 61 transactions tested (or 3.2 percent) were unallowable. The first transaction was paid for the family therapy service. The total cost was $206. This type of activity is specifically unallowable under 45 CFR 1356.60(c)(3). The second transaction was paid for an intensive reading program for a child. The total cost was $3,200. This type of activity is unallowable under 42 USC 675(4)(A), which only allows for educational activities for school supplies and the cost of reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement in foster care. 2) For 2 out of 61 transactions tested (or 3.2 percent), we were not able to determine allowability due to missing support documentation. For the first transaction, we were unable to determine the purpose for a car rental and gasoline purchase totaling $780. The supporting documentation did not include enough detail to ensure allowability. For the second transaction, we were unable to determine the purpose and allowability for a travel expenditure totaling $349. The supporting documentation for the purchase of an airline ticket did not include a travel voucher or agenda. 3) The review and approval of 1 out of 61 transactions tested (or 1.6 percent) was not documented. The transaction totaled $61. Cause: The Department could not locate additional support documentation to justify the payments. In addition, the Department did not consider that additional support should be retained to ensure compliance. The Department considered the activities for the family therapy services and the intensive reading program as allowable. Effect: Federal funds were expended for unallowable activities. The total for unallowable activities and activities lacking supporting documentation was $4,555. The total projected questioned costs for allowable activities are $213,387. Further, other expenditures in our sample did not have appropriate supporting documentation which increases the likelihood of additional unallowable activities. Recommendation: We recommend that the Department strengthen internal control procedures to ensure that expenditures are allowable and that sufficient documentation is retained to support that determination. Management’s View: The Department agrees with the finding. Corrective Action: A new feature was added to ESPI on 1/9/24 to record the reason (purpose) for certain service types, including transportation. The system is programmed to disallow Title IV-E if the reason listed does not meet IV-E eligibility criteria (see image below). An additional control will be added to the system to have the same control procedure used for a medical service type and education service type. Further development is underway for additional control procedures and should be completed by April of 2025. P-card transactions do not process through ESPI. Quarterly reports will be obtained to review any P-card transactions that utilized Title IV-E to confirm appropriate documentation is on record. This will be completed by April 30, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-217 The Department does not have documented internal controls for adjustments processed to the Foster Care -Title IV—E program. Type of Finding: Material Weakness Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Foster Care - Title IV-E program maintenance payments are processed through the Ensuring Safety & Permanency in Idaho system (ESPI). Those payments include recurring, non-recurring, and adjustment transactions. Adjustments transactions are processed by the Department’s program personnel on a monthly basis. Adjustments are a function of the pace at which the Department is able to obtain the documents and information for eligibility determinations. Court documents can take extended periods to obtain. In addition, the intermittent nature of child support payments also drives adjustments in the program. We were not able to identify documented internal controls over the adjustment transactions for 60 out of 62 adjustment transactions (or 96.7 percent) that were processed through ESPI. Cause: The review and approval over the adjustment transactions were not documented within the program software. Effect: We did not identify any substantive or compliance errors during testing over adjustment transactions. However, without documentation of a review and approval, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department design and implement internal controls to document the review and approval of the adjustment transactions processed in ESPI. Management’s View: The Department agrees with the finding. Corrective Action: The Department will continue to record adjustment activity through Help Desk tickets, SharePoint documentation, and ESPI. The Department will ensure improved visibility to the adjustment and approval process and documentation by ensuring all roles who need access (including auditors), have access to all relevant systems and storage locations such as access to SharePoint and Help Desk tickets. This step will be completed by April 30, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-218 The Department failed to provide necessary documentation to support the eligibility determination for two foster care providers within the Foster Care -Title IV—E program. Type of Finding: Noncompliance Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Questioned Costs: Known $884; Projected $126,091 Criteria: Federal law 42 U.S. Code (USC) 672(b) states that foster care maintenance payments may be made under this part only on behalf of a child described in subsection (a) of this section who is: (1) in the foster family home of an individual, whether the payments therefor are made to such individual or to a public or private child-placement or child-care agency, or (2) in a child-care institution, whether the payments therefor are made to such institution or to a public or private child-placement or child-care agency, which payments shall be limited so as to include in such payments only those items which are included in the term “foster care maintenance payments” (as defined in section 475(4)).   Federal Law 42 USC 672(c) defines a foster family home as: (A) In general. The term “foster family home” means the home of an individual or family: (i) that is licensed or approved by the State in which it is situated as a foster family home that meets the standards established for the licensing or approval, and (ii) in which a child in foster care has been placed in the care of an individual, who resides with the child and who has been licensed or approved by the State to be a foster parent (I) that the State deems capable of adhering to the reasonable and prudent parent standard, (II) that provides 24-hour substitute care for children placed away from their parents or other caretakers, and (III) that provides the care for not more than six children in foster care. The Uniform Guidance included in 42 USC 671(a)(20)(A) states that the foster family home provider must have satisfactorily met a criminal records check, including a fingerprint-based check with respect to prospective foster and adoptive parents. The Uniform Guidance included in 42 USC 671(a)(20)(B) states that a Title IV-E agency must check, or request a check of, a state-maintained child abuse and neglect registry in each state the prospective foster and adoptive parent(s) and any other adult(s) living in the home have resided in the preceding five years before the State can license or approve a prospective foster or adoptive parent. Condition: During our review of the eligibility determination for foster care providers, the Department could not locate the foster home license documentation for 2 out of 65 foster homes reviewed (or 3 percent). For those same 2 foster homes, child abuse and neglect registry checks were not provided, and for 1 of those 2 foster homes a criminal record check and a fingerprint-based check were not provided. Cause: The Department was unable to locate the proper backup eligibility documentation. In addition, the Department mentioned that this situation was caused by the migration of data from an old system, iCare, to the new system, Ensuring Safety & Permanency in Idaho (ESPI), which was fully implemented on November 26, 2020. Effect: Foster families could be receiving subsidies without proper licensing and without passing background checks, fingerprint-based checks, and child abuse and neglect checks. This also increases the risk to the safety of the children placed in these homes. The total amount associated with the exceptions noted was $884. The total projected questioned costs for eligibility items are $126,091. Recommendation: We recommend that the Department design procedures to ensure that background, fingerprint-based, and child abuse and neglect checks are completed and properly maintained for Foster Care -Title IV—E eligibility determinations. Management’s View: The Department agrees with this finding. Corrective Action: The department agrees with the finding related to the critical importance of obtaining and maintaining documentation for all necessary background checks. Although the department was ultimately able to verify background checks were completed, we agree that we were unable to readily pull the needed documentation on these in a timely manner. To correct the issue, the department will add an additional point of verification that the Enhanced Criminal History Background Check clearance letter from the Background Check Unit’s system is uploaded to eCabinet, by having supervisors view the document within eCabinet prior to approving the initial foster care license. Supervisors will also confirm that all ICPC home studies address results of background checks for all adults in the home and any additional potential caregivers. This will be completed April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-219 The level of effort spending requirements for the Adoption Assistance Title IV-E program were not met. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Adoption Assistance Assistance Listing Number: 93.659 Federal Award Number: 2201IDADPT; 2301IDADPT Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Matching; LOE; Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 USC 673(a)(8)(A) states that a state must calculate the adoption savings (if any) resulting from the application of different program eligibility rules (42 USC 673 (a)(2)(A)(ii)) to all applicable children for a fiscal year using methodology proposed by the state and approved by ACF. The Uniform Guidance included in 42 USC 673(a)(8)(D)(i) states that a state shall spend an amount equal to the amount of the savings (if any) in state expenditures under this part resulting from the application of paragraph (2)(A)(ii) to all applicable children for a fiscal year, to provide to children of families any service that may be provided under part B or this part. A state shall spend not less than 30 percent of any such savings on post-adoption services, post-guardianship services, and services to support and sustain positive permanent outcomes for children who otherwise might enter into foster care under the responsibility of the state, with at least two-thirds (2/3) of the spending by the state to comply with such 30 percent requirement being spent on post-adoption and post-guardianship services. Condition: During fiscal year 2023, the minimum spending amount to meet level of effort requirements for the Adoption Assistance Title IV-E program was $362,738. The Department only spent $276,658 of the required amount of adoption savings, calculated for federal fiscal year 2022, on post-adoption services, post-guardianship services, and services to support positive permanent outcomes for children at risk of entering foster care. The difference was $86,080. The amount spent was only 22.9 percent and the program requirement is 30 percent of adoption savings. Cause: Population growth, COVID impacts, staff turnover, and increasing residential treatment costs have reached a point that the Department’s budget was strained beyond capacity. The Department stated that the dollars to meet level of effort requirements come from its state General Fund appropriation, and the Department prioritized those limited General Fund dollars to emergent, critical, and safety related needs of kids in foster care over complying with the matching requirements for this program. Effect: Adoptive families in Idaho did not receive the full benefits of post-adoption services, post-guardianship services, and services to support positive permanent outcomes for children at risk of entering foster care that are required under this program. Recommendation: We recommend that the Department design, implement and maintain internal control procedures to ensure compliance with level of effort requirements for Adoption Assistance Title IV-E program. We further recommend that the Department improve budgeting and monitoring for General Fund spending plans and actual expenditures to ensure that they can comply with federal requirements. Management’s View: The Department agrees with the finding. Corrective Action: Beginning 07/01/2023, FACS implemented a monthly review of post-permanency services invoices and payments to support correct usage of adoption assistance funds including 30% spending of adoption savings for prevention. Progress toward fully effective integration of this process has been hindered by limited access to timely and accurate budget data from LUMA. FACS will refine the monthly review process to ensure current and accurate tracking and use of funds. This will be completed July 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-220 The Department failed to provide necessary supporting documentation for five Adoption Assistance Title IV-E eligibility determinations. Type of Finding: Material Noncompliance Assistance Listing Title: Adoption Assistance Assistance Listing Number: 93.659 Federal Award Number: 2201IDADPT; 2301IDADPT Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Questioned Costs: Known $2,249; Projected $711,238 Criteria: The Uniform Guidance included in 42 U.S. Code (USC) 671(a)(20)(A) states that the prospective adoptive parent(s) must have satisfactorily met a criminal record check, including a fingerprint-based check. The Uniform Guidance included in 42 USC 671(a)(20)(B) states that the prospective adoptive parent(s) and any other adult living in the home who has resided in the provider home in the preceding five years must satisfactorily have met a child abuse and neglect registry check. The Uniform Guidance in the 42 USC 675(3) states that the agreement for the subsidy was signed and was in effect before the final decree of adoption and contains information concerning the nature of services. Condition: The Department could not locate criminal records check, fingerprint-based check, and child abuse and neglect registry check for 3 out of 65 adoption cases reviewed (or 4.6 percent). In addition, the Department could not locate 2 of the 65 adoption agreements we tested (or 3 percent). Cause: The Department was unable to locate the proper supporting eligibility documentation. In addition, the Department mentioned that this situation was caused by the migration of data from an old system, iCare, to the new system, Ensuring Safety & Permanency in Idaho (ESPI), which was fully implemented on November 26, 2020. Effect: Adoption families could be receiving subsidies without proper adoption agreement and without passing background check, fingerprint-based check, and child abuse and neglect checks. The total amount associated with the exceptions noted was $2,249. The total projected questioned costs for eligibility items are $711,238. Recommendation: We recommend that the Department maintain supporting documentation for Adoption Assistance Title IV—E eligibility determinations. Management’s View: The Department agrees with the finding. Corrective Action: The department agrees with the finding related to the critical importance of obtaining and maintaining documentation for all necessary background checks. Although the department was ultimately able to verify background checks were completed, we agree that we were unable to readily pull the needed documentation on these in a timely manner. The department will assure supporting documentation for Adoption Assistance Title IV-E eligibility determinations are maintained within the electronic filing system by adding an additional verification to the current process. When a supervisor reviews a departmental adoption for finalization, they will verify that a copy of the Enhanced Criminal History Background clearance letter for all adults residing in the home is uploaded to the prospective adoptive parents’ profile in eCabinet (the electronic case management system), and the signed copy of the adoption assistance agreement is uploaded to the child’s profile. The application process for Adoption Assistance Title IV-E eligibility for private adoptions will be updated to include the addition of the Enhanced Criminal History Background clearance letters for all adults residing in the home to the child’s eCabinet file. When a supervisor approves an adoption assistance agreement for a private adoption, they will verify a copy of the signed adoption assistance agreement is uploaded to the adoptive child’s profile. This will be completed by August 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-221 The Department did not review subrecipient application information for the Coronavirus State and Local Fiscal Recovery Funds at a sufficient level to identify missing information. Related to Prior Finding: 2022-210 Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: 20-1982-0-1-806 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.332 describes the pass-through entities’ responsibility for administering necessary requirements on subrecipients so that the federal award is used in accordance with federal regulations. The Uniform Guidance included in 2 CFR 200.332(a)(1)(iii) states that pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal Award Identification Number (FAIN) at the time of subaward. Condition: The Department used COVID State and Local Fiscal Recovery funds to respond to the public health and negative economic impacts resulting from the COVID-19 pandemic. The Division of Public Health and the Idaho Council on Domestic Violence and Victim Assistance were responsible for distributing these funds and created a process for their prospective recipients to apply and receive funding. During testing, we noted 2 applications out of our sample of 8 (25 percent) that did not include FAINs in application documentation, as required. Cause: The Department had review procedures in place; however, the reviews of subrecipient application documentation were not completed at a level sufficient to identify missing FAINs. Effect: The Department is exposed to increased risk of improper payments and noncompliance with federal requirements when applications do not meet all requirements for receiving funding. Recommendation: We recommend that the Department design and implement effective internal control procedures to ensure subrecipient applications are completed accurately and in compliance with federal requirements. Management’s View: The Department agrees with the finding. Corrective Action: The Division of Public Health and Idaho Council on Domestic Violence and Victim Assistance (ICDVVA) will take steps to ensure new staff receive training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. All newly hired employees will be trained beginning April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-222 Supporting documentation to demonstrate the completion of subrecipient risk assessments for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program was not available for review. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Number: 1 NH75OT000105-01-00; 6 NH75OT000105-01-00 Program Year: June 1, 2021 – May 31, 2024 Federal Agency: Department of Health and Human Services   Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.332(b) states that all pass-through entities must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: The Department was unable to provide a subrecipient risk assessment for 1 out of 8 (or 12.5 percent) subrecipients we reviewed. The Department was compliant with all other aspects of the subrecipient monitoring compliance requirements for that subrecipient. Cause: During the time in which the missing documentation was supposed to be created, the Department’s program staff were in the process of being hired and trained. Responsibilities were also being transitioned to the newly onboarded staff from the other program staff that assisted in the implementation of the grant. Effect: The Department is exposed to increased risk of noncompliance related to subrecipients and improper payments in the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program. Recommendation: We recommend that the Department strengthen internal controls to ensure required risk assessments are completed and supporting documentation is retained. Management’s View: The Department agrees with the finding. Corrective Action: The division will ensure new staff receive training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. All newly hired employees will be trained beginning April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-223 Managed Care providers lacked documentation to support continued eligibility within the Medicaid Program. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR section 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. The Uniform Guidance included in 42 CFR section 455.412 states that the Medicaid State Plan gives assurance that the State Medicaid Agency has a method for verifying providers licensed by the State and that such provider licenses have not expired or have no current limitations. Condition: Managed Care Organizations (MCO) providers are monitored by the Bureau of Care Management using a provider roster. The Department receives and tracks the provider roster for all MCO annually. We noted four of the sixty-two managed care providers tested (6.5 percent) did not have documentation to support their provider eligibility; however, those providers were included in the roster as of December 2023. The Department was not able to provide documentation that these providers had the applicable licenses and certifications, entered into a provider agreement, and have made the required disclosures to the State. The four providers did not have an active contract with MCO during the period, nor did they have any claim payments associated with the provider. However, a Medicaid recipient could possibly utilize a provider from the roster, including these four providers, and claim payments could be processed by an MCO and go undetected by the Department. Cause: Two of the four providers initiated the provider enrollment process, but ultimately did not fully enroll. This situation caused the provider to appear as being contracted with MCO. The other two providers were terminated by an MCO in the spring of 2023, but the providers remained on the roster through the end of the term. The provider roster as of December 2023 was not updated to reflect these changes. Effect: We reviewed the fiscal year 2023 expenditure data and confirmed that there were no claimant payments made to these providers during fiscal year 2023. However, there is increased risk surrounding managed care eligibility due to the reliability of the provider roster. Recommendation: We recommend that the Department strengthen internal controls to ensure required documentation is maintained for Managed Care providers, including applicable licenses and certifications, provider agreements, and required disclosures to the State.   Management’s View: The Department agrees with the finding. While a provider cannot be reimbursed without an active contract or an executed single case agreement, we agree that it is best practice to have a provider directory reflective of active, enrolled and fully credentialed providers. The Division has two efforts underway to address this finding. Corrective Action: The 21st Century Cures Act requires all states to enroll both fee-for-service and managed care providers. Idaho Medicaid is currently out of compliance with this requirement for most of the providers within managed care contractor networks. The state is also working to come into compliance with a requirement in the Affordable Care Act to revalidate all enrolled providers at least every 5 years. The Division has begun the systems work necessary to come into compliance with both of these requirements and anticipates working through enrollment and revalidation activities into CY2025. Once completed, the Division will have an accurate and complete provider file that will be shared with contracted managed care plans to support their contracting efforts. Any providers who contract with the managed care plans will be required to be fully enrolled and credentialed with Idaho Medicaid before rendering services and billing. Pursuant to the Consolidated Appropriations Act of 2023, states are required by July 2025 to have a searchable and regularly updated provider directory for both managed care plans and fee-for-service programs. Idaho Medicaid is working to develop processes to validate directories and ensure that providers are providing updates to their information as necessary. Through this effort, Idaho Medicaid will further bolster internal processes and controls to ensure accurate provider network information is shared with Medicaid participants and maintained within our systems. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-223 Managed Care providers lacked documentation to support continued eligibility within the Medicaid Program. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR section 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. The Uniform Guidance included in 42 CFR section 455.412 states that the Medicaid State Plan gives assurance that the State Medicaid Agency has a method for verifying providers licensed by the State and that such provider licenses have not expired or have no current limitations. Condition: Managed Care Organizations (MCO) providers are monitored by the Bureau of Care Management using a provider roster. The Department receives and tracks the provider roster for all MCO annually. We noted four of the sixty-two managed care providers tested (6.5 percent) did not have documentation to support their provider eligibility; however, those providers were included in the roster as of December 2023. The Department was not able to provide documentation that these providers had the applicable licenses and certifications, entered into a provider agreement, and have made the required disclosures to the State. The four providers did not have an active contract with MCO during the period, nor did they have any claim payments associated with the provider. However, a Medicaid recipient could possibly utilize a provider from the roster, including these four providers, and claim payments could be processed by an MCO and go undetected by the Department. Cause: Two of the four providers initiated the provider enrollment process, but ultimately did not fully enroll. This situation caused the provider to appear as being contracted with MCO. The other two providers were terminated by an MCO in the spring of 2023, but the providers remained on the roster through the end of the term. The provider roster as of December 2023 was not updated to reflect these changes. Effect: We reviewed the fiscal year 2023 expenditure data and confirmed that there were no claimant payments made to these providers during fiscal year 2023. However, there is increased risk surrounding managed care eligibility due to the reliability of the provider roster. Recommendation: We recommend that the Department strengthen internal controls to ensure required documentation is maintained for Managed Care providers, including applicable licenses and certifications, provider agreements, and required disclosures to the State.   Management’s View: The Department agrees with the finding. While a provider cannot be reimbursed without an active contract or an executed single case agreement, we agree that it is best practice to have a provider directory reflective of active, enrolled and fully credentialed providers. The Division has two efforts underway to address this finding. Corrective Action: The 21st Century Cures Act requires all states to enroll both fee-for-service and managed care providers. Idaho Medicaid is currently out of compliance with this requirement for most of the providers within managed care contractor networks. The state is also working to come into compliance with a requirement in the Affordable Care Act to revalidate all enrolled providers at least every 5 years. The Division has begun the systems work necessary to come into compliance with both of these requirements and anticipates working through enrollment and revalidation activities into CY2025. Once completed, the Division will have an accurate and complete provider file that will be shared with contracted managed care plans to support their contracting efforts. Any providers who contract with the managed care plans will be required to be fully enrolled and credentialed with Idaho Medicaid before rendering services and billing. Pursuant to the Consolidated Appropriations Act of 2023, states are required by July 2025 to have a searchable and regularly updated provider directory for both managed care plans and fee-for-service programs. Idaho Medicaid is working to develop processes to validate directories and ensure that providers are providing updates to their information as necessary. Through this effort, Idaho Medicaid will further bolster internal processes and controls to ensure accurate provider network information is shared with Medicaid participants and maintained within our systems. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-223 Managed Care providers lacked documentation to support continued eligibility within the Medicaid Program. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR section 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. The Uniform Guidance included in 42 CFR section 455.412 states that the Medicaid State Plan gives assurance that the State Medicaid Agency has a method for verifying providers licensed by the State and that such provider licenses have not expired or have no current limitations. Condition: Managed Care Organizations (MCO) providers are monitored by the Bureau of Care Management using a provider roster. The Department receives and tracks the provider roster for all MCO annually. We noted four of the sixty-two managed care providers tested (6.5 percent) did not have documentation to support their provider eligibility; however, those providers were included in the roster as of December 2023. The Department was not able to provide documentation that these providers had the applicable licenses and certifications, entered into a provider agreement, and have made the required disclosures to the State. The four providers did not have an active contract with MCO during the period, nor did they have any claim payments associated with the provider. However, a Medicaid recipient could possibly utilize a provider from the roster, including these four providers, and claim payments could be processed by an MCO and go undetected by the Department. Cause: Two of the four providers initiated the provider enrollment process, but ultimately did not fully enroll. This situation caused the provider to appear as being contracted with MCO. The other two providers were terminated by an MCO in the spring of 2023, but the providers remained on the roster through the end of the term. The provider roster as of December 2023 was not updated to reflect these changes. Effect: We reviewed the fiscal year 2023 expenditure data and confirmed that there were no claimant payments made to these providers during fiscal year 2023. However, there is increased risk surrounding managed care eligibility due to the reliability of the provider roster. Recommendation: We recommend that the Department strengthen internal controls to ensure required documentation is maintained for Managed Care providers, including applicable licenses and certifications, provider agreements, and required disclosures to the State.   Management’s View: The Department agrees with the finding. While a provider cannot be reimbursed without an active contract or an executed single case agreement, we agree that it is best practice to have a provider directory reflective of active, enrolled and fully credentialed providers. The Division has two efforts underway to address this finding. Corrective Action: The 21st Century Cures Act requires all states to enroll both fee-for-service and managed care providers. Idaho Medicaid is currently out of compliance with this requirement for most of the providers within managed care contractor networks. The state is also working to come into compliance with a requirement in the Affordable Care Act to revalidate all enrolled providers at least every 5 years. The Division has begun the systems work necessary to come into compliance with both of these requirements and anticipates working through enrollment and revalidation activities into CY2025. Once completed, the Division will have an accurate and complete provider file that will be shared with contracted managed care plans to support their contracting efforts. Any providers who contract with the managed care plans will be required to be fully enrolled and credentialed with Idaho Medicaid before rendering services and billing. Pursuant to the Consolidated Appropriations Act of 2023, states are required by July 2025 to have a searchable and regularly updated provider directory for both managed care plans and fee-for-service programs. Idaho Medicaid is working to develop processes to validate directories and ensure that providers are providing updates to their information as necessary. Through this effort, Idaho Medicaid will further bolster internal processes and controls to ensure accurate provider network information is shared with Medicaid participants and maintained within our systems. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-223 Managed Care providers lacked documentation to support continued eligibility within the Medicaid Program. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR section 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. The Uniform Guidance included in 42 CFR section 455.412 states that the Medicaid State Plan gives assurance that the State Medicaid Agency has a method for verifying providers licensed by the State and that such provider licenses have not expired or have no current limitations. Condition: Managed Care Organizations (MCO) providers are monitored by the Bureau of Care Management using a provider roster. The Department receives and tracks the provider roster for all MCO annually. We noted four of the sixty-two managed care providers tested (6.5 percent) did not have documentation to support their provider eligibility; however, those providers were included in the roster as of December 2023. The Department was not able to provide documentation that these providers had the applicable licenses and certifications, entered into a provider agreement, and have made the required disclosures to the State. The four providers did not have an active contract with MCO during the period, nor did they have any claim payments associated with the provider. However, a Medicaid recipient could possibly utilize a provider from the roster, including these four providers, and claim payments could be processed by an MCO and go undetected by the Department. Cause: Two of the four providers initiated the provider enrollment process, but ultimately did not fully enroll. This situation caused the provider to appear as being contracted with MCO. The other two providers were terminated by an MCO in the spring of 2023, but the providers remained on the roster through the end of the term. The provider roster as of December 2023 was not updated to reflect these changes. Effect: We reviewed the fiscal year 2023 expenditure data and confirmed that there were no claimant payments made to these providers during fiscal year 2023. However, there is increased risk surrounding managed care eligibility due to the reliability of the provider roster. Recommendation: We recommend that the Department strengthen internal controls to ensure required documentation is maintained for Managed Care providers, including applicable licenses and certifications, provider agreements, and required disclosures to the State.   Management’s View: The Department agrees with the finding. While a provider cannot be reimbursed without an active contract or an executed single case agreement, we agree that it is best practice to have a provider directory reflective of active, enrolled and fully credentialed providers. The Division has two efforts underway to address this finding. Corrective Action: The 21st Century Cures Act requires all states to enroll both fee-for-service and managed care providers. Idaho Medicaid is currently out of compliance with this requirement for most of the providers within managed care contractor networks. The state is also working to come into compliance with a requirement in the Affordable Care Act to revalidate all enrolled providers at least every 5 years. The Division has begun the systems work necessary to come into compliance with both of these requirements and anticipates working through enrollment and revalidation activities into CY2025. Once completed, the Division will have an accurate and complete provider file that will be shared with contracted managed care plans to support their contracting efforts. Any providers who contract with the managed care plans will be required to be fully enrolled and credentialed with Idaho Medicaid before rendering services and billing. Pursuant to the Consolidated Appropriations Act of 2023, states are required by July 2025 to have a searchable and regularly updated provider directory for both managed care plans and fee-for-service programs. Idaho Medicaid is working to develop processes to validate directories and ensure that providers are providing updates to their information as necessary. Through this effort, Idaho Medicaid will further bolster internal processes and controls to ensure accurate provider network information is shared with Medicaid participants and maintained within our systems. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-224 The required audited financial reports were not collected as required to ensure compliance with the Managed Care Organization contracts. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR Section 438.3(m) requires the contract with Managed Care Organizations (MCO) to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all four MCO contracts that were active during fiscal year 2023. We noted that 3 out of 4 Managed Care Organization’s contracts tested did not have specific clauses clearly requiring the MCO to submit an audited financial report as required by 42 CFR Section 438.3(m). In addition, three of the four (or 75 percent) audited financial reports were not submitted until after the current single audit inquiry about the reports occurred. Cause: The contracts were not clearly written to directly require the MCO to submit an audited financial report. The Bureau of Care Management stated that the MCOs were not contractually obligated to submit the audited financial reports. However, the Department is obligated to comply with federal requirements, and we found a reference to the 42 CFR Section 438.3(m) requirement in two of the four MCO contracts, which would indicate some knowledge that the grantor required audited financial statements. However, only one of the contracts included the clear specific requirements included in the 42 CFR Section 438.3(m). The Department requested the reports from the MCOs after receiving the request for the reports from our auditors. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules and regulations. Collecting these reports, and reviewing them, provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCOs. Additionally, the Department is not in compliance with federal requirements to collect these reports. Recommendation: We recommend that the Department amend the MCO contracts to include a requirement to submit audited financial reports on an annual basis and design and implement internal controls to monitor the receipt and review of the reports. Management’s View: The Department agrees with the finding. Corrective Action: The Division will amend all current managed care contracts to include the requirement to submit an audited financial report annually. This contract language will also be incorporated into all future Medicaid managed care procurements. The Division will also review and confirm all required contract elements outlined in 42 CFR 438.3 are clearly outlined in Medicaid managed care contracts. Lastly, the Division intends to coordinate with the Department of Insurance to learn more about their review process of audited financial statements and determine if there is an opportunity to coordinate oversight efforts for Medicaid managed care contracts going forward. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-224 The required audited financial reports were not collected as required to ensure compliance with the Managed Care Organization contracts. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR Section 438.3(m) requires the contract with Managed Care Organizations (MCO) to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all four MCO contracts that were active during fiscal year 2023. We noted that 3 out of 4 Managed Care Organization’s contracts tested did not have specific clauses clearly requiring the MCO to submit an audited financial report as required by 42 CFR Section 438.3(m). In addition, three of the four (or 75 percent) audited financial reports were not submitted until after the current single audit inquiry about the reports occurred. Cause: The contracts were not clearly written to directly require the MCO to submit an audited financial report. The Bureau of Care Management stated that the MCOs were not contractually obligated to submit the audited financial reports. However, the Department is obligated to comply with federal requirements, and we found a reference to the 42 CFR Section 438.3(m) requirement in two of the four MCO contracts, which would indicate some knowledge that the grantor required audited financial statements. However, only one of the contracts included the clear specific requirements included in the 42 CFR Section 438.3(m). The Department requested the reports from the MCOs after receiving the request for the reports from our auditors. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules and regulations. Collecting these reports, and reviewing them, provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCOs. Additionally, the Department is not in compliance with federal requirements to collect these reports. Recommendation: We recommend that the Department amend the MCO contracts to include a requirement to submit audited financial reports on an annual basis and design and implement internal controls to monitor the receipt and review of the reports. Management’s View: The Department agrees with the finding. Corrective Action: The Division will amend all current managed care contracts to include the requirement to submit an audited financial report annually. This contract language will also be incorporated into all future Medicaid managed care procurements. The Division will also review and confirm all required contract elements outlined in 42 CFR 438.3 are clearly outlined in Medicaid managed care contracts. Lastly, the Division intends to coordinate with the Department of Insurance to learn more about their review process of audited financial statements and determine if there is an opportunity to coordinate oversight efforts for Medicaid managed care contracts going forward. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-224 The required audited financial reports were not collected as required to ensure compliance with the Managed Care Organization contracts. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR Section 438.3(m) requires the contract with Managed Care Organizations (MCO) to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all four MCO contracts that were active during fiscal year 2023. We noted that 3 out of 4 Managed Care Organization’s contracts tested did not have specific clauses clearly requiring the MCO to submit an audited financial report as required by 42 CFR Section 438.3(m). In addition, three of the four (or 75 percent) audited financial reports were not submitted until after the current single audit inquiry about the reports occurred. Cause: The contracts were not clearly written to directly require the MCO to submit an audited financial report. The Bureau of Care Management stated that the MCOs were not contractually obligated to submit the audited financial reports. However, the Department is obligated to comply with federal requirements, and we found a reference to the 42 CFR Section 438.3(m) requirement in two of the four MCO contracts, which would indicate some knowledge that the grantor required audited financial statements. However, only one of the contracts included the clear specific requirements included in the 42 CFR Section 438.3(m). The Department requested the reports from the MCOs after receiving the request for the reports from our auditors. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules and regulations. Collecting these reports, and reviewing them, provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCOs. Additionally, the Department is not in compliance with federal requirements to collect these reports. Recommendation: We recommend that the Department amend the MCO contracts to include a requirement to submit audited financial reports on an annual basis and design and implement internal controls to monitor the receipt and review of the reports. Management’s View: The Department agrees with the finding. Corrective Action: The Division will amend all current managed care contracts to include the requirement to submit an audited financial report annually. This contract language will also be incorporated into all future Medicaid managed care procurements. The Division will also review and confirm all required contract elements outlined in 42 CFR 438.3 are clearly outlined in Medicaid managed care contracts. Lastly, the Division intends to coordinate with the Department of Insurance to learn more about their review process of audited financial statements and determine if there is an opportunity to coordinate oversight efforts for Medicaid managed care contracts going forward. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-224 The required audited financial reports were not collected as required to ensure compliance with the Managed Care Organization contracts. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR Section 438.3(m) requires the contract with Managed Care Organizations (MCO) to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all four MCO contracts that were active during fiscal year 2023. We noted that 3 out of 4 Managed Care Organization’s contracts tested did not have specific clauses clearly requiring the MCO to submit an audited financial report as required by 42 CFR Section 438.3(m). In addition, three of the four (or 75 percent) audited financial reports were not submitted until after the current single audit inquiry about the reports occurred. Cause: The contracts were not clearly written to directly require the MCO to submit an audited financial report. The Bureau of Care Management stated that the MCOs were not contractually obligated to submit the audited financial reports. However, the Department is obligated to comply with federal requirements, and we found a reference to the 42 CFR Section 438.3(m) requirement in two of the four MCO contracts, which would indicate some knowledge that the grantor required audited financial statements. However, only one of the contracts included the clear specific requirements included in the 42 CFR Section 438.3(m). The Department requested the reports from the MCOs after receiving the request for the reports from our auditors. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules and regulations. Collecting these reports, and reviewing them, provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCOs. Additionally, the Department is not in compliance with federal requirements to collect these reports. Recommendation: We recommend that the Department amend the MCO contracts to include a requirement to submit audited financial reports on an annual basis and design and implement internal controls to monitor the receipt and review of the reports. Management’s View: The Department agrees with the finding. Corrective Action: The Division will amend all current managed care contracts to include the requirement to submit an audited financial report annually. This contract language will also be incorporated into all future Medicaid managed care procurements. The Division will also review and confirm all required contract elements outlined in 42 CFR 438.3 are clearly outlined in Medicaid managed care contracts. Lastly, the Division intends to coordinate with the Department of Insurance to learn more about their review process of audited financial statements and determine if there is an opportunity to coordinate oversight efforts for Medicaid managed care contracts going forward. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-225 Review of federal suspension and debarment status is not adequately performed or documented to demonstrate compliance with the federal requirements for the Coronavirus State and Local Fiscal Recovery Funds program. Type of Finding: Significant Deficiency Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 2 CFR Part 180.300) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Also, 2 CFR 200.303 requires that the Department establish and maintain effective internal control over the federal award that provides reasonable assurance that the Department is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: During fiscal year 2023, the Department completed covered transactions and later verified that a vendor was not suspended or debarred when quarterly reporting was submitted to the Division of Financial Management (DFM). To document this verification, the Department listed the unique entity identifier (UEI) number on an excel workbook. However, this verification was performed after payments had been made to these vendors. Cause: The Department did not consider completing this verification prior to issuing payment and properly documenting the verification, such as printing a report or some other form of documentation to confirm that a check had been performed, since they are able to review this verification at any time. The Department did not consider any vendor to be a significant risk and indicated the timing of the check issuance, which was also impacted by the implementation of Luma (new ERP system) and staffing issues, may have factored into the late verification. Effect: We did not identify suspended or debarred vendors receiving federal funds during our testing. However, the Department does not have procedures in place to identify a suspended or debarred vendor prior to issuance of payment. Performing a verification after payment creates a risk that the Department may enter into covered transactions with suspended and debarred parties. Recommendation: We recommend that the Department ensure that sufficient documentation is maintained to comply with the suspension and debarment requirements and that a verification is performed before any payment is issued. Management’s View: The Department agrees with this finding. Corrective Action: In response to the Internal Control Deficiency identified as "Finding 1" in your letter, we have already implemented the following corrective action plan. 1. Our Development Bureau has revised their "Notice of Intent to Award" letter to include the collection of the Federally issued Unique Entity ID (UEI) for all projects funded with Federal funds. 2. The UEI information will be used to check the proposed contractor's exclusion status on the System for Award Management (SAM.gov) website and a printed report, or a printed screen shot of the exclusion status will be preserved prior to issuing the contract. 3. The person responsible for ensuring that this plan is followed is our Financial Officer, Steve Martin who can be reached by telephone at 208.514.2460, or by email at steve.martin@idpr.idaho.gov. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-226 The Department did not develop and execute a Value Engineering work plan in compliance with the regulations for the federal Highway Planning and Construction grant. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Highway Planning and Construction Grant Assistance Listing Number: 20.205 Federal Award Number: Various Program Year: Various Federal Agency: Department of Transportation Compliance Requirement: Special Tests – Value Engineering Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Title 23, Part 627 contains the regulations for Value Engineering (VE). Subsection c of 23 CFR part 627.7 states, “STAs (State Transportation Agencies) shall designate a VE Program Coordinator to promote and advance VE program activities and functions. The VE Coordinator's responsibilities should include establishing and maintaining the STA's VE policies and procedures; facilitating VE training; ensuring VE analyses are conducted on applicable projects; monitoring, assessing, and reporting on the VE analyses conducted and VE program; participating in periodic VE program and project reviews; submitting the required annual VE report to the Federal Highway Administration (FHWA); and supporting the other elements of the VE program.” The Department’s Value Engineering Manual contains the policies and procedures for the VE program. Section 1.4 of the manual contains the policies for the Statewide Value Engineering Work Plan and states, “The Districts are responsible to develop and execute an annual Value Engineering Work Plan. Upon completion of the Draft State Transportation Improvement Plan (STIP), the districts will identify projects that require VE studies and select additional projects for VE studies. The districts will also select the timing and schedule to complete VE studies for their district. The Statewide VE Work Plan will be compiled annually by the Headquarters (HQ) VE Coordinator upon submittal by the districts. The HQ VE Coordinator will prepare and submit an annual Value Engineering Program Summary Report to FHWA.” Section 6 of the Department’s VE manual, titled Reporting/Tracking, states, “The VE coordinator shall be responsible for monitoring program compliance and annually reporting to FHWA. Value engineering operations will be monitored for compliance with the policies, procedures and standards identified in the preceding sections. Specific areas to be monitored include District Value Engineering work plan and schedule, District Value Engineering accomplishments (accepted cost savings, return-on-investment, functional enhancements), documentation of value engineering activities, Economic analysis methods being used in cost/benefit determinations for project decisions, compliance with the provisions of the Value Engineering procedures.” Finally, 2 CFR 200.303 requires the Department to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Department is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: While developing our understanding of the VE program, we found that the procedures described in the Department’s VE manual to monitor the Department’s VE programs were not being followed. The requirement to develop and execute a VE work plan has not been completed in the past two years, and the Department does not have a formal process for ensuring that the annual VE reporting to FHWA is completed. Cause: The Department was not aware of the CFR requirement to establish, maintain, and follow Value Engineering policies and procedures. The Department did not have a procedure to ensure the annual VE report was submitted to the FHWA and waited for the FHWA to request it. Effect: The goals of VE analysis are to ensure that projects are providing the needed functions while considering community and environmental commitments, safety, reliability, efficiency, overall life cycle, optimizing value and quality, and reducing the time to develop and deliver the project. Without an effective VE work plan in place, there is a risk that these goals will not be met. Recommendation: We recommend that the Department implement controls for monitoring and assessment of the Value Engineering Program to ensure the VE guidelines are being followed. Management’s View: The Idaho Transportation Department (ITD) concurs with the audit finding and recommendation. Corrective Action: ITD will develop a new standard operating procedure (SOP) to follow to ensure that the Districts develop an Annual Value Engineering Work Plan and that the Statewide Work Plan is compiled annually by the Headquarters Value Engineering Coordinator. This SOP will be developed in collaboration with FHWA staff to ensure 2 CFR 200.303 and 23 CFR Part 627 compliance. The SOP will include details as to who, what, where and when the specific tasks will occur so to provide clarity and control with regard to developing the work plan as well as monitoring, assessing and reporting on the Departments Value Engineering Program. The new SOP will be developed prior to FFY 2025, and statewide outreach and education will follow shortly thereafter. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-226 The Department did not develop and execute a Value Engineering work plan in compliance with the regulations for the federal Highway Planning and Construction grant. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Highway Planning and Construction Grant Assistance Listing Number: 20.205 Federal Award Number: Various Program Year: Various Federal Agency: Department of Transportation Compliance Requirement: Special Tests – Value Engineering Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Title 23, Part 627 contains the regulations for Value Engineering (VE). Subsection c of 23 CFR part 627.7 states, “STAs (State Transportation Agencies) shall designate a VE Program Coordinator to promote and advance VE program activities and functions. The VE Coordinator's responsibilities should include establishing and maintaining the STA's VE policies and procedures; facilitating VE training; ensuring VE analyses are conducted on applicable projects; monitoring, assessing, and reporting on the VE analyses conducted and VE program; participating in periodic VE program and project reviews; submitting the required annual VE report to the Federal Highway Administration (FHWA); and supporting the other elements of the VE program.” The Department’s Value Engineering Manual contains the policies and procedures for the VE program. Section 1.4 of the manual contains the policies for the Statewide Value Engineering Work Plan and states, “The Districts are responsible to develop and execute an annual Value Engineering Work Plan. Upon completion of the Draft State Transportation Improvement Plan (STIP), the districts will identify projects that require VE studies and select additional projects for VE studies. The districts will also select the timing and schedule to complete VE studies for their district. The Statewide VE Work Plan will be compiled annually by the Headquarters (HQ) VE Coordinator upon submittal by the districts. The HQ VE Coordinator will prepare and submit an annual Value Engineering Program Summary Report to FHWA.” Section 6 of the Department’s VE manual, titled Reporting/Tracking, states, “The VE coordinator shall be responsible for monitoring program compliance and annually reporting to FHWA. Value engineering operations will be monitored for compliance with the policies, procedures and standards identified in the preceding sections. Specific areas to be monitored include District Value Engineering work plan and schedule, District Value Engineering accomplishments (accepted cost savings, return-on-investment, functional enhancements), documentation of value engineering activities, Economic analysis methods being used in cost/benefit determinations for project decisions, compliance with the provisions of the Value Engineering procedures.” Finally, 2 CFR 200.303 requires the Department to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Department is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: While developing our understanding of the VE program, we found that the procedures described in the Department’s VE manual to monitor the Department’s VE programs were not being followed. The requirement to develop and execute a VE work plan has not been completed in the past two years, and the Department does not have a formal process for ensuring that the annual VE reporting to FHWA is completed. Cause: The Department was not aware of the CFR requirement to establish, maintain, and follow Value Engineering policies and procedures. The Department did not have a procedure to ensure the annual VE report was submitted to the FHWA and waited for the FHWA to request it. Effect: The goals of VE analysis are to ensure that projects are providing the needed functions while considering community and environmental commitments, safety, reliability, efficiency, overall life cycle, optimizing value and quality, and reducing the time to develop and deliver the project. Without an effective VE work plan in place, there is a risk that these goals will not be met. Recommendation: We recommend that the Department implement controls for monitoring and assessment of the Value Engineering Program to ensure the VE guidelines are being followed. Management’s View: The Idaho Transportation Department (ITD) concurs with the audit finding and recommendation. Corrective Action: ITD will develop a new standard operating procedure (SOP) to follow to ensure that the Districts develop an Annual Value Engineering Work Plan and that the Statewide Work Plan is compiled annually by the Headquarters Value Engineering Coordinator. This SOP will be developed in collaboration with FHWA staff to ensure 2 CFR 200.303 and 23 CFR Part 627 compliance. The SOP will include details as to who, what, where and when the specific tasks will occur so to provide clarity and control with regard to developing the work plan as well as monitoring, assessing and reporting on the Departments Value Engineering Program. The new SOP will be developed prior to FFY 2025, and statewide outreach and education will follow shortly thereafter. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-216 The Department did not have appropriate documentation to support allowability of transactions for the Foster Care Title IV-E program. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Costs Principles Questioned Costs: Known $4,555; Projected $213,387 Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 U.S. Code (USC) 675(4)(A) states that the term “foster care maintenance payments” means payments to cover the cost of (and the cost of providing) food, clothing, shelter, daily supervision, school supplies, a child’s personal incidentals, liability insurance with respect to a child, reasonable travel to the child’s home for visitation, and reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement. The Uniform Guidance included in 45 CFR 1356.60(c)(3) states that allowable administrative costs do not include the costs of social services provided to the child, the child's family or foster family, which provide counseling or treatment to ameliorate or remedy personal problems, behaviors, or home conditions. The Uniform Guidance states that costs claimed as foster maintenance payments that include medical, educational (except for school supplies and the cost of reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement in foster care), or other expenses not outlined in 42 USC 675(4)(A) are unallowed. Condition: We tested 61 expenditure transactions charged to the Foster Care - Title IV-E program. The sample included 4 expenditures that were for unallowable costs charged to the program or that were missing supporting documentation making it difficult to determine if the costs were allowable. We also identified one transaction that did not have evidence of review and approval prior to payment but appears to be for an allowable expenditure. The details for the 5 of 61, or 8 percent, transactions with exceptions is as follows: 1) We determined that 2 out of 61 transactions tested (or 3.2 percent) were unallowable. The first transaction was paid for the family therapy service. The total cost was $206. This type of activity is specifically unallowable under 45 CFR 1356.60(c)(3). The second transaction was paid for an intensive reading program for a child. The total cost was $3,200. This type of activity is unallowable under 42 USC 675(4)(A), which only allows for educational activities for school supplies and the cost of reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement in foster care. 2) For 2 out of 61 transactions tested (or 3.2 percent), we were not able to determine allowability due to missing support documentation. For the first transaction, we were unable to determine the purpose for a car rental and gasoline purchase totaling $780. The supporting documentation did not include enough detail to ensure allowability. For the second transaction, we were unable to determine the purpose and allowability for a travel expenditure totaling $349. The supporting documentation for the purchase of an airline ticket did not include a travel voucher or agenda. 3) The review and approval of 1 out of 61 transactions tested (or 1.6 percent) was not documented. The transaction totaled $61. Cause: The Department could not locate additional support documentation to justify the payments. In addition, the Department did not consider that additional support should be retained to ensure compliance. The Department considered the activities for the family therapy services and the intensive reading program as allowable. Effect: Federal funds were expended for unallowable activities. The total for unallowable activities and activities lacking supporting documentation was $4,555. The total projected questioned costs for allowable activities are $213,387. Further, other expenditures in our sample did not have appropriate supporting documentation which increases the likelihood of additional unallowable activities. Recommendation: We recommend that the Department strengthen internal control procedures to ensure that expenditures are allowable and that sufficient documentation is retained to support that determination. Management’s View: The Department agrees with the finding. Corrective Action: A new feature was added to ESPI on 1/9/24 to record the reason (purpose) for certain service types, including transportation. The system is programmed to disallow Title IV-E if the reason listed does not meet IV-E eligibility criteria (see image below). An additional control will be added to the system to have the same control procedure used for a medical service type and education service type. Further development is underway for additional control procedures and should be completed by April of 2025. P-card transactions do not process through ESPI. Quarterly reports will be obtained to review any P-card transactions that utilized Title IV-E to confirm appropriate documentation is on record. This will be completed by April 30, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-217 The Department does not have documented internal controls for adjustments processed to the Foster Care -Title IV—E program. Type of Finding: Material Weakness Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Foster Care - Title IV-E program maintenance payments are processed through the Ensuring Safety & Permanency in Idaho system (ESPI). Those payments include recurring, non-recurring, and adjustment transactions. Adjustments transactions are processed by the Department’s program personnel on a monthly basis. Adjustments are a function of the pace at which the Department is able to obtain the documents and information for eligibility determinations. Court documents can take extended periods to obtain. In addition, the intermittent nature of child support payments also drives adjustments in the program. We were not able to identify documented internal controls over the adjustment transactions for 60 out of 62 adjustment transactions (or 96.7 percent) that were processed through ESPI. Cause: The review and approval over the adjustment transactions were not documented within the program software. Effect: We did not identify any substantive or compliance errors during testing over adjustment transactions. However, without documentation of a review and approval, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department design and implement internal controls to document the review and approval of the adjustment transactions processed in ESPI. Management’s View: The Department agrees with the finding. Corrective Action: The Department will continue to record adjustment activity through Help Desk tickets, SharePoint documentation, and ESPI. The Department will ensure improved visibility to the adjustment and approval process and documentation by ensuring all roles who need access (including auditors), have access to all relevant systems and storage locations such as access to SharePoint and Help Desk tickets. This step will be completed by April 30, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-218 The Department failed to provide necessary documentation to support the eligibility determination for two foster care providers within the Foster Care -Title IV—E program. Type of Finding: Noncompliance Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Questioned Costs: Known $884; Projected $126,091 Criteria: Federal law 42 U.S. Code (USC) 672(b) states that foster care maintenance payments may be made under this part only on behalf of a child described in subsection (a) of this section who is: (1) in the foster family home of an individual, whether the payments therefor are made to such individual or to a public or private child-placement or child-care agency, or (2) in a child-care institution, whether the payments therefor are made to such institution or to a public or private child-placement or child-care agency, which payments shall be limited so as to include in such payments only those items which are included in the term “foster care maintenance payments” (as defined in section 475(4)).   Federal Law 42 USC 672(c) defines a foster family home as: (A) In general. The term “foster family home” means the home of an individual or family: (i) that is licensed or approved by the State in which it is situated as a foster family home that meets the standards established for the licensing or approval, and (ii) in which a child in foster care has been placed in the care of an individual, who resides with the child and who has been licensed or approved by the State to be a foster parent (I) that the State deems capable of adhering to the reasonable and prudent parent standard, (II) that provides 24-hour substitute care for children placed away from their parents or other caretakers, and (III) that provides the care for not more than six children in foster care. The Uniform Guidance included in 42 USC 671(a)(20)(A) states that the foster family home provider must have satisfactorily met a criminal records check, including a fingerprint-based check with respect to prospective foster and adoptive parents. The Uniform Guidance included in 42 USC 671(a)(20)(B) states that a Title IV-E agency must check, or request a check of, a state-maintained child abuse and neglect registry in each state the prospective foster and adoptive parent(s) and any other adult(s) living in the home have resided in the preceding five years before the State can license or approve a prospective foster or adoptive parent. Condition: During our review of the eligibility determination for foster care providers, the Department could not locate the foster home license documentation for 2 out of 65 foster homes reviewed (or 3 percent). For those same 2 foster homes, child abuse and neglect registry checks were not provided, and for 1 of those 2 foster homes a criminal record check and a fingerprint-based check were not provided. Cause: The Department was unable to locate the proper backup eligibility documentation. In addition, the Department mentioned that this situation was caused by the migration of data from an old system, iCare, to the new system, Ensuring Safety & Permanency in Idaho (ESPI), which was fully implemented on November 26, 2020. Effect: Foster families could be receiving subsidies without proper licensing and without passing background checks, fingerprint-based checks, and child abuse and neglect checks. This also increases the risk to the safety of the children placed in these homes. The total amount associated with the exceptions noted was $884. The total projected questioned costs for eligibility items are $126,091. Recommendation: We recommend that the Department design procedures to ensure that background, fingerprint-based, and child abuse and neglect checks are completed and properly maintained for Foster Care -Title IV—E eligibility determinations. Management’s View: The Department agrees with this finding. Corrective Action: The department agrees with the finding related to the critical importance of obtaining and maintaining documentation for all necessary background checks. Although the department was ultimately able to verify background checks were completed, we agree that we were unable to readily pull the needed documentation on these in a timely manner. To correct the issue, the department will add an additional point of verification that the Enhanced Criminal History Background Check clearance letter from the Background Check Unit’s system is uploaded to eCabinet, by having supervisors view the document within eCabinet prior to approving the initial foster care license. Supervisors will also confirm that all ICPC home studies address results of background checks for all adults in the home and any additional potential caregivers. This will be completed April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-201 The Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) was understated by $18 million on the Schedule of Expenditures of Federal Awards (SEFA) Closing Package. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CRF) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR), 2 CFR 200.303, states that the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Additionally, 2 CFR 200.510 requires the State to prepare a SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department underreported $18 million in federal expenditures incurred under the CSLFRF program on the SEFA closing package. The expenditures were incurred for COVID-related claims covered under the State’s health plan using CSLFRF funds and should have been reported on the closing package. Cause: The CSLFRF funds were deposited to and expended from a non-federal fund. The SEFA closing package was prepared using similar procedures as the previous year by reporting federal expenditures included in federal funds. This approach did not consider that federal funds might have been expended through other means, and they were not reported. Additionally, there was staff turnover in a key financial position that contributed to this error. Effect: In the absence of the audit work completed and the resulting revised submission by the Department, the statewide SEFA would have included an understatement of $18 million for the Coronavirus State and Local Fiscal Recovery Fund, Assistance Listing number 21.027. Recommendation: We recommend that the Department strengthen the design and implementation of internal controls to ensure all federal funds are properly accounted for and those expenditures are included in the SEFA closing package. Management’s View: The Department of Administrations agrees that the SEF A was prepared using procedures similar to prior years, which failed to capture the expenditures related to the CSLFRF as those funds were deposited into a non-federal fund as directed by the legislature in HB752. Corrective Action: Prior to the issuance of this memo, the Department transferred the remaining $6,969,325.15 of CSLFRF funds into a separate reporting program. The Department will process quarterly reconciliations utilizing the quarterly reports from the insurance carrier. These transactions will then be queried each year, similar to other federal funding sources, and reported on the SEFA. Future federal awards will be deposited into a federal funding source or clearly delineated from non-federal funding sources to ensure proper reporting on the SEFA. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-202 Closing package submissions and revisions completed prior to the draft of the Schedule of Expenditures of Federal Awards (SEFA) being submitted for audit were not included in the schedule resulting in misstatements. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund; Medical Assistance Program; and Children’s Health Insurance Fund Assistance Listing Number: 21.027; 93.778; 93.767 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502. • Total amount provided to subrecipients from each federal program. Condition: The SEFA submitted for audit purposes included misstatements for Direct Awards for Assistance Listing (AL) number 21.027 (Coronavirus State and Local Fiscal Recovery Fund (CSLFRF)), 93.778 (Medical Assistance Program (Medicaid)), and 93.767 (Children’s Health Insurance Program (CHIP)). We noted the following errors in Direct Award Expenditures: • AL number 21.027 was understated $21,358,086 for Direct Award Expenditures reported by the Department of Health and Welfare and by an additional $500,000 reported by the Department of Correction. • AL number 93.778 was understated by $25,108,923 for Direct Expenditures reported by the Department of Health and Welfare. • AL number 93.767 was overstated by $3,469,677 for Direct Expenditures reported by the Department of Health and Welfare. Cause: Each year, State agencies report total federal awards expended on a closing package. The Office uses these closing packages to compile the SEFA. The Office’s review procedures over this process did not include the revised closing package submitted by the Department of Health and Welfare or the revisions communicated between the Office and the Department of Corrections. These revisions occurred prior to the draft of the SEFA submitted for audit. Effect: The SEFA submitted for audit contained misstatements; however, these errors have been corrected. In the absence of audit work completed, the statewide SEFA would have included an understatement of $21,858,086 for the CSLFRF program; an understatement of $25,108,923for the Medicaid program; and an overstatement of $3,469,677 for the CHIP program. Recommendation: We recommend that the Office design and implement procedures to ensure amounts reported on closing package submissions and later revisions are properly reviewed and reported on the statewide SEFA. Management’s View: The Office aAgrees with this finding. Corrective Action: An agency submitted a revised SEFA template in November 2023. We inadvertently excluded those revisions from the draft of the SEFA provided for audit. To prevent this error from happening again, we will document each agency that submits a revised SEFA template(s) on our SEFA review checklist. This will require the preparer and reviewer(s) to verify and sign off on changes made to the SEFA master file. Errors identified were corrected before issuance of the Single Audit report. Corrective actions will be implemented for fiscal year 2024 reporting. Auditor’s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

FINDING 2023-202 Closing package submissions and revisions completed prior to the draft of the Schedule of Expenditures of Federal Awards (SEFA) being submitted for audit were not included in the schedule resulting in misstatements. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund; Medical Assistance Program; and Children’s Health Insurance Fund Assistance Listing Number: 21.027; 93.778; 93.767 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502. • Total amount provided to subrecipients from each federal program. Condition: The SEFA submitted for audit purposes included misstatements for Direct Awards for Assistance Listing (AL) number 21.027 (Coronavirus State and Local Fiscal Recovery Fund (CSLFRF)), 93.778 (Medical Assistance Program (Medicaid)), and 93.767 (Children’s Health Insurance Program (CHIP)). We noted the following errors in Direct Award Expenditures: • AL number 21.027 was understated $21,358,086 for Direct Award Expenditures reported by the Department of Health and Welfare and by an additional $500,000 reported by the Department of Correction. • AL number 93.778 was understated by $25,108,923 for Direct Expenditures reported by the Department of Health and Welfare. • AL number 93.767 was overstated by $3,469,677 for Direct Expenditures reported by the Department of Health and Welfare. Cause: Each year, State agencies report total federal awards expended on a closing package. The Office uses these closing packages to compile the SEFA. The Office’s review procedures over this process did not include the revised closing package submitted by the Department of Health and Welfare or the revisions communicated between the Office and the Department of Corrections. These revisions occurred prior to the draft of the SEFA submitted for audit. Effect: The SEFA submitted for audit contained misstatements; however, these errors have been corrected. In the absence of audit work completed, the statewide SEFA would have included an understatement of $21,858,086 for the CSLFRF program; an understatement of $25,108,923for the Medicaid program; and an overstatement of $3,469,677 for the CHIP program. Recommendation: We recommend that the Office design and implement procedures to ensure amounts reported on closing package submissions and later revisions are properly reviewed and reported on the statewide SEFA. Management’s View: The Office aAgrees with this finding. Corrective Action: An agency submitted a revised SEFA template in November 2023. We inadvertently excluded those revisions from the draft of the SEFA provided for audit. To prevent this error from happening again, we will document each agency that submits a revised SEFA template(s) on our SEFA review checklist. This will require the preparer and reviewer(s) to verify and sign off on changes made to the SEFA master file. Errors identified were corrected before issuance of the Single Audit report. Corrective actions will be implemented for fiscal year 2024 reporting. Auditor’s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

FINDING 2023-202 Closing package submissions and revisions completed prior to the draft of the Schedule of Expenditures of Federal Awards (SEFA) being submitted for audit were not included in the schedule resulting in misstatements. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund; Medical Assistance Program; and Children’s Health Insurance Fund Assistance Listing Number: 21.027; 93.778; 93.767 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502. • Total amount provided to subrecipients from each federal program. Condition: The SEFA submitted for audit purposes included misstatements for Direct Awards for Assistance Listing (AL) number 21.027 (Coronavirus State and Local Fiscal Recovery Fund (CSLFRF)), 93.778 (Medical Assistance Program (Medicaid)), and 93.767 (Children’s Health Insurance Program (CHIP)). We noted the following errors in Direct Award Expenditures: • AL number 21.027 was understated $21,358,086 for Direct Award Expenditures reported by the Department of Health and Welfare and by an additional $500,000 reported by the Department of Correction. • AL number 93.778 was understated by $25,108,923 for Direct Expenditures reported by the Department of Health and Welfare. • AL number 93.767 was overstated by $3,469,677 for Direct Expenditures reported by the Department of Health and Welfare. Cause: Each year, State agencies report total federal awards expended on a closing package. The Office uses these closing packages to compile the SEFA. The Office’s review procedures over this process did not include the revised closing package submitted by the Department of Health and Welfare or the revisions communicated between the Office and the Department of Corrections. These revisions occurred prior to the draft of the SEFA submitted for audit. Effect: The SEFA submitted for audit contained misstatements; however, these errors have been corrected. In the absence of audit work completed, the statewide SEFA would have included an understatement of $21,858,086 for the CSLFRF program; an understatement of $25,108,923for the Medicaid program; and an overstatement of $3,469,677 for the CHIP program. Recommendation: We recommend that the Office design and implement procedures to ensure amounts reported on closing package submissions and later revisions are properly reviewed and reported on the statewide SEFA. Management’s View: The Office aAgrees with this finding. Corrective Action: An agency submitted a revised SEFA template in November 2023. We inadvertently excluded those revisions from the draft of the SEFA provided for audit. To prevent this error from happening again, we will document each agency that submits a revised SEFA template(s) on our SEFA review checklist. This will require the preparer and reviewer(s) to verify and sign off on changes made to the SEFA master file. Errors identified were corrected before issuance of the Single Audit report. Corrective actions will be implemented for fiscal year 2024 reporting. Auditor’s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

FINDING 2023-202 Closing package submissions and revisions completed prior to the draft of the Schedule of Expenditures of Federal Awards (SEFA) being submitted for audit were not included in the schedule resulting in misstatements. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund; Medical Assistance Program; and Children’s Health Insurance Fund Assistance Listing Number: 21.027; 93.778; 93.767 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502. • Total amount provided to subrecipients from each federal program. Condition: The SEFA submitted for audit purposes included misstatements for Direct Awards for Assistance Listing (AL) number 21.027 (Coronavirus State and Local Fiscal Recovery Fund (CSLFRF)), 93.778 (Medical Assistance Program (Medicaid)), and 93.767 (Children’s Health Insurance Program (CHIP)). We noted the following errors in Direct Award Expenditures: • AL number 21.027 was understated $21,358,086 for Direct Award Expenditures reported by the Department of Health and Welfare and by an additional $500,000 reported by the Department of Correction. • AL number 93.778 was understated by $25,108,923 for Direct Expenditures reported by the Department of Health and Welfare. • AL number 93.767 was overstated by $3,469,677 for Direct Expenditures reported by the Department of Health and Welfare. Cause: Each year, State agencies report total federal awards expended on a closing package. The Office uses these closing packages to compile the SEFA. The Office’s review procedures over this process did not include the revised closing package submitted by the Department of Health and Welfare or the revisions communicated between the Office and the Department of Corrections. These revisions occurred prior to the draft of the SEFA submitted for audit. Effect: The SEFA submitted for audit contained misstatements; however, these errors have been corrected. In the absence of audit work completed, the statewide SEFA would have included an understatement of $21,858,086 for the CSLFRF program; an understatement of $25,108,923for the Medicaid program; and an overstatement of $3,469,677 for the CHIP program. Recommendation: We recommend that the Office design and implement procedures to ensure amounts reported on closing package submissions and later revisions are properly reviewed and reported on the statewide SEFA. Management’s View: The Office aAgrees with this finding. Corrective Action: An agency submitted a revised SEFA template in November 2023. We inadvertently excluded those revisions from the draft of the SEFA provided for audit. To prevent this error from happening again, we will document each agency that submits a revised SEFA template(s) on our SEFA review checklist. This will require the preparer and reviewer(s) to verify and sign off on changes made to the SEFA master file. Errors identified were corrected before issuance of the Single Audit report. Corrective actions will be implemented for fiscal year 2024 reporting. Auditor’s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

Finding 2023-203 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller did not properly report expenditures for the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), 2 CFR 200.510(b), requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a non-federal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department did not identify expenditures accurately when completing the schedule of expenditures of federal awards closing package. The closing package includes different tabs to report total expenditures and expenditures made to subrecipients. Reported expenditures to subrecipients should be a subset of total expenditures. However, The Department reported zero total expenditures related to the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program but $10.5 million of expenditures to subrecipients. However, $10 million of that were funds that had been transferred to the Division of Public Works for the Wastewater Lagoon project. Because they are transferred from one state agency to another, these funds have not yet been expended by the State and, as such, should not be reported as expenditures. Cause: The Department did not appear to fully understand how to prepare the closing package, and it was not reviewed with enough detail or knowledge to identify the error. Effect: The statewide SEFA was understated by $500,000 that was truly expended, but only reported as a subrecipient expenditure and thus not included in total expenditures for the CSLFRF program. Recommendation: We recommend that the Department improve training and the review process for the SEFA closing package to ensure all amounts are correctly reported. Management’s View: The Department agrees with this finding. Corrective Action: After management review the department will improve training and process review of preparation of the SEFA closing package to ensure all amounts are correctly reported. This lack of understanding of the SEFA was due to staff turnover and lack of subject matter experts regarding the SEFA for Fiscal Year 2023. The agency will implement the following to fix this issue: a) Financial Manager (or delegate) expenditure detail report shall include grant fund 344 (ARPA grants), 348 fund (grants), and any additional funds designated by the legislature or agency, for the specific purpose of tracking federal grant funding. b) Once prepared by the Financial Manager (or delegate), review of the SEFA by the Financial Officer for completeness, verifying all required grant federal funds appropriated to the agency are included on the SEFA closing package. c) Financial Manager and Financial Officer meet to review the SEFA for agreement of grant expenditure amounts reported on the SEFA. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-204 The Schedule of Expenditures of Federal Awards (SEFA) closing package understated the Education Stabilization Fund - Governor’s Emergency Education Relief (GEER II) by $1,039,753 and overstated the Education Stabilization Fund – Emergency Assistance to Non-Public Schools (EANS) program by the same amount. Related to Prior Finding: 2021-202 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Governors Emergency Education Relief Fund; Emergency Assistance for Non-Public Schools Assistance Listing Number: 84.425C; 84.425R Federal Award Number: S425C210043; S425R210024 Program Year: January 8, 2021 – September 30, 2023; February 11, 2021 – September 30, 2023 Federal Agency: Department of Education Compliance Requirement: SEFA MisstatementU.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions. It provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR § 200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR § 200.502, and • Total amount provided to subrecipients from each federal program The Office of Management and Budget (OMB) Compliance Supplement also indicates that the SEFA should include the individual subprograms the funds were expended under, including each separate Assistance Listing (AL) number with the applicable alpha character. Condition: The Board completed a SEFA closing package to report federal grant expenditures. This closing package included errors in reporting for the Education Stabilization Fund. The Governor’s Emergency Education Relief (GEER II, Assistance Listing number 84.425C) expenditures were understated by $1,039,753 and the Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (EANS, Assistance Listing number 84.425R) expenditures were overstated by $1,039,753. Cause: The State was given a specific period of time to obligate funds under the EANS program. Unobligated funds were then required to be reverted to the governor to be redistributed and used under the GEER II program. The Board had difficulty tracking available funds for each program. When preparing the SEFA, Board staff found errors in the total amounts reported for each program and made unsupported adjustments to these two programs. Effect: Total federal expenditures reported on the Board’s SEFA was correct. However, specific identification by program, as required, was understated by $1,039,753 for one program, and one program was overstated by the same amount. Recommendation: We recommend that the Board design and implement procedures to ensure federal expenditure amounts for each program are properly reported and proper adjustments are made prior to the reporting deadline. Management’s View: The Board agrees with the finding. Corrective Action: The Report states “the State was given a specific period of time to obligate funds under the EANS program. Unobligated funds were then required to be reverted to the governor to be redistributed and used under the GEER II program. The Board had difficulty tracking available funds for each program. When preparing the SEFA, Board staff found errors in the total amounts reported for each program and made unsupported adjustments to these two programs.” The Finding states that total federal expenditures reported on the Board’s SEFA was correct. However, specific identification by program, as required, was understated by $1,039,753 for one program, and overstated for another program, by the same amount. Patrick Coulson, Chief Financial Officer and Scott Christie, Financial Manager met with Amy Brown, LSO Audit Manager. Ms. Brown indicated that the EANS funds should have been moved from the State Department of Education (SDE) federal DoE G5 system to OSBE G5 system for better management of the funds. Mr. Christie asked Gideon Tolman, Chief Financial Officer for SDE whether the EANS funds in G5 would move to OSBE G5. Mr. Tolman said they would not. At this point OSBE was working with three PCAs used for the same Budget Unit and Fund for all GEER II funds: GEER II 29410, EANS 29710 and GEANS (which was created for the reverted EANS funds now GEER II funds). The GEER II PCA 29410 had a specific CFDA number based on the Grant Award Notification. EANS PCA 29710 had a specific CFDA number based on the example Grant Award Notification provided by SDE. OSBE was not aware of, nor was it provided, a unique CFDA number that should be used for the reverted EANS/GEER II funds. Mr. Christie considered the SDE EANS GEER funds the same as the OSBE GEER funds. In other words, once unobligated EANS moneys were reverted (by operation of law) to the Governor,1 all moneys in the GEER II fund were considered fungible.2 They were in the same OSBE appropriation, Budget Unit and Fund. The only distinction was that OSBE and SDE had access to separate buckets of GEER cash. When a large contract came up for payment on June 29th, Mr. Christie was also looking ahead at the implementation of the new statewide ERP Luma system. Mr. Christie wasn’t confident that Project Contracts had been set up correctly in Luma. Mr. Christie also understood that there would be considerably more work reconciling grant to cash balances in Luma compared to the legacy ERP system. For these reasons, on June 29th Mr. Christie drew down all the remaining GEER II funds to zero out that grant by the end of the fiscal year. When the coding for the contract payment came across, it was coded to PCA 29410, GEER II. OSBE could have coded the payment to either PCA 29450 or 29710, as they were now all considered GEER II funds. We do not believe that there were unsupported adjustments to these two programs. The adjustments were based on making sure the SEFA was accurate, and accuracy was confirmed in the Report: “total federal expenditures reported on the Board’s SEFA was [sic] correct.” We wanted to ensure we were not overstating the expenses for GEER II on the SEFA. We believe the adjustments can be, and have been, explained and are supported by the simple fact that one PCA was chosen instead of another for the same fungible GEER II funds. Nevertheless, we will agree with the audit finding. Corrective Action: The corrective action is to reclass any GEER II Project transactions in FY 2024 to EANS/GEER II Project. That will ensure there are no GEER II transactions in FY 2024 that would need to be adjusted. This was done on March 21, 2024. Auditor’s Concluding Remarks: We thank the Board for its cooperation and assistance throughout the audit. We continue to assert that the Board submitted the SEFA closing package with errors, and that it was not aware there were errors until the audit team identified them as part of the procedures completed for this audit. If adjustments were being made to ensure an accurate SEFA, they failed. Our statement that “total federal expenditures reported on the Board’s SEFA was correct” is related to the material accuracy of the SEFA as a whole. This finding identifies errors made in reporting required by the Office of Management and Budget, as communicated in the Compliance Supplement, where it states that that the SEFA should include the individual subprograms the funds were expended under, including each separate Assistance Listing number with the applicable alpha character. There are many requirements related to the presentation of the SEFA beyond total expenditures that are reviewed for accuracy, such as amounts paid to subrecipients, or COVID-19 and non-cash expenditures. The errors made by the Board were between programs with different applicable alpha characters, and those programs serve different purposes. Accurate reporting that meets all requirements is important to ensure compliance with the terms of the grant.

FINDING 2023-204 The Schedule of Expenditures of Federal Awards (SEFA) closing package understated the Education Stabilization Fund - Governor’s Emergency Education Relief (GEER II) by $1,039,753 and overstated the Education Stabilization Fund – Emergency Assistance to Non-Public Schools (EANS) program by the same amount. Related to Prior Finding: 2021-202 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Governors Emergency Education Relief Fund; Emergency Assistance for Non-Public Schools Assistance Listing Number: 84.425C; 84.425R Federal Award Number: S425C210043; S425R210024 Program Year: January 8, 2021 – September 30, 2023; February 11, 2021 – September 30, 2023 Federal Agency: Department of Education Compliance Requirement: SEFA MisstatementU.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions. It provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR § 200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR § 200.502, and • Total amount provided to subrecipients from each federal program The Office of Management and Budget (OMB) Compliance Supplement also indicates that the SEFA should include the individual subprograms the funds were expended under, including each separate Assistance Listing (AL) number with the applicable alpha character. Condition: The Board completed a SEFA closing package to report federal grant expenditures. This closing package included errors in reporting for the Education Stabilization Fund. The Governor’s Emergency Education Relief (GEER II, Assistance Listing number 84.425C) expenditures were understated by $1,039,753 and the Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (EANS, Assistance Listing number 84.425R) expenditures were overstated by $1,039,753. Cause: The State was given a specific period of time to obligate funds under the EANS program. Unobligated funds were then required to be reverted to the governor to be redistributed and used under the GEER II program. The Board had difficulty tracking available funds for each program. When preparing the SEFA, Board staff found errors in the total amounts reported for each program and made unsupported adjustments to these two programs. Effect: Total federal expenditures reported on the Board’s SEFA was correct. However, specific identification by program, as required, was understated by $1,039,753 for one program, and one program was overstated by the same amount. Recommendation: We recommend that the Board design and implement procedures to ensure federal expenditure amounts for each program are properly reported and proper adjustments are made prior to the reporting deadline. Management’s View: The Board agrees with the finding. Corrective Action: The Report states “the State was given a specific period of time to obligate funds under the EANS program. Unobligated funds were then required to be reverted to the governor to be redistributed and used under the GEER II program. The Board had difficulty tracking available funds for each program. When preparing the SEFA, Board staff found errors in the total amounts reported for each program and made unsupported adjustments to these two programs.” The Finding states that total federal expenditures reported on the Board’s SEFA was correct. However, specific identification by program, as required, was understated by $1,039,753 for one program, and overstated for another program, by the same amount. Patrick Coulson, Chief Financial Officer and Scott Christie, Financial Manager met with Amy Brown, LSO Audit Manager. Ms. Brown indicated that the EANS funds should have been moved from the State Department of Education (SDE) federal DoE G5 system to OSBE G5 system for better management of the funds. Mr. Christie asked Gideon Tolman, Chief Financial Officer for SDE whether the EANS funds in G5 would move to OSBE G5. Mr. Tolman said they would not. At this point OSBE was working with three PCAs used for the same Budget Unit and Fund for all GEER II funds: GEER II 29410, EANS 29710 and GEANS (which was created for the reverted EANS funds now GEER II funds). The GEER II PCA 29410 had a specific CFDA number based on the Grant Award Notification. EANS PCA 29710 had a specific CFDA number based on the example Grant Award Notification provided by SDE. OSBE was not aware of, nor was it provided, a unique CFDA number that should be used for the reverted EANS/GEER II funds. Mr. Christie considered the SDE EANS GEER funds the same as the OSBE GEER funds. In other words, once unobligated EANS moneys were reverted (by operation of law) to the Governor,1 all moneys in the GEER II fund were considered fungible.2 They were in the same OSBE appropriation, Budget Unit and Fund. The only distinction was that OSBE and SDE had access to separate buckets of GEER cash. When a large contract came up for payment on June 29th, Mr. Christie was also looking ahead at the implementation of the new statewide ERP Luma system. Mr. Christie wasn’t confident that Project Contracts had been set up correctly in Luma. Mr. Christie also understood that there would be considerably more work reconciling grant to cash balances in Luma compared to the legacy ERP system. For these reasons, on June 29th Mr. Christie drew down all the remaining GEER II funds to zero out that grant by the end of the fiscal year. When the coding for the contract payment came across, it was coded to PCA 29410, GEER II. OSBE could have coded the payment to either PCA 29450 or 29710, as they were now all considered GEER II funds. We do not believe that there were unsupported adjustments to these two programs. The adjustments were based on making sure the SEFA was accurate, and accuracy was confirmed in the Report: “total federal expenditures reported on the Board’s SEFA was [sic] correct.” We wanted to ensure we were not overstating the expenses for GEER II on the SEFA. We believe the adjustments can be, and have been, explained and are supported by the simple fact that one PCA was chosen instead of another for the same fungible GEER II funds. Nevertheless, we will agree with the audit finding. Corrective Action: The corrective action is to reclass any GEER II Project transactions in FY 2024 to EANS/GEER II Project. That will ensure there are no GEER II transactions in FY 2024 that would need to be adjusted. This was done on March 21, 2024. Auditor’s Concluding Remarks: We thank the Board for its cooperation and assistance throughout the audit. We continue to assert that the Board submitted the SEFA closing package with errors, and that it was not aware there were errors until the audit team identified them as part of the procedures completed for this audit. If adjustments were being made to ensure an accurate SEFA, they failed. Our statement that “total federal expenditures reported on the Board’s SEFA was correct” is related to the material accuracy of the SEFA as a whole. This finding identifies errors made in reporting required by the Office of Management and Budget, as communicated in the Compliance Supplement, where it states that that the SEFA should include the individual subprograms the funds were expended under, including each separate Assistance Listing number with the applicable alpha character. There are many requirements related to the presentation of the SEFA beyond total expenditures that are reviewed for accuracy, such as amounts paid to subrecipients, or COVID-19 and non-cash expenditures. The errors made by the Board were between programs with different applicable alpha characters, and those programs serve different purposes. Accurate reporting that meets all requirements is important to ensure compliance with the terms of the grant.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Finding 2023-206 The Department did not fully disclose required information to subrecipients, document subrecipient risk assessments, or ensure subrecipient audits were received for the Coronavirus State and Local Fiscal Recovery Fund. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 - December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. The requirements for pass-through entities are in 2 CFR 200.332, which states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and include the following information at the time of the subaward or if information changes. Required information includes: • Federal Award Identification 1. Subrecipient’s name (which must match the name associated with its unique entity identifier); 2. Subrecipient’s unique entity identifier; 3. Federal Award Identification Number (FAIN); 4. Federal award date of award to the recipient by the federal agency 5. Subaward period of performance start and end date; 6. Subaward budget period start and end date; 7. Amount of federal funds obligated by this action by the pass-through entity to the subrecipient; 8. Total amount of federal funds obligated to the subrecipient by the pass-through entity to the subrecipient; 9. Total amount of the federal award committed to the subrecipient by the pass-through entity; 10. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); 11. Name of awarding agency, pass-though entity, and contact information for awarding official of the pass-through entity; 12. Assistance Listings (AL) number and title; 13. Identification of whether the award is research and development (R&D); and 14. Indirect cost rate for the federal award • All requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the federal award. • Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the federal awarding agency, included identification of any required financial and performance reports. Pass-through entities must also: • Evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. • Consider imposing specific subaward conditions upon a subrecipient, if appropriate. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subawards, and that subaward performance goals are achieved. • Verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, and follow up on the results of those audits. Condition: The Department received funds for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF, AL number 21.027) from the U.S. Department of Treasury through the Idaho Division of Financial Management. The Department passed through $18,941,327 from the SLFRF to 74 subrecipients. We selected a sample of 8 subrecipients to test compliance with these requirements. We found the Department complied with some, but not all, of the pass-through entity requirements. The Department did not provide the following required information in all 8 of the items tested: • Federal Award Identification Number (FAIN) • Federal award date of award to the recipient by the federal agency • Subaward period of performance start and end dates • Total amount of federal award committed to the subrecipient • Identification of whether the award is for (R&D) • Indirect cost rate for the federal award The Department did not provide the AL number to 3 of the 8 subrecipients tested and provided an incorrect AL number to 4 of the 8 subrecipients tested. The Department implemented the grant in the Waste Management and Remediation Division and the Grants and Loans Bureau. Single Audit reports are required to be submitted to pass-through entities no later than 9 months after the subrecipient’s fiscal year end or within 60 days of the issuance of the report. The Department passed funds through to subrecipients beginning in fiscal year 2023; therefore, no subrecipient Single Audit reports would be due during our audit period. However, we reviewed procedures the Department implemented to ensure that these audits would be collected when due. We found that the Grants and Loans Bureau had procedures in place that would be effective in collecting and evaluating the subrecipient reports; however, the Waste Management and Remediation Division did not have effective procedures to collect the reports. Cause: The Department used a basic template in creating an award letter and grant agreement. The template did not include all the required information. The FAIN was not communicated to the Department by the Division of Financial Management. The Department was also unaware that the FAIN and AL number were different. The period of performance was not included because the Department provided the budget period for the project and was concerned that subrecipients would be confused about the spending period for their grants. The Department did not identify whether the grant was for R&D because they felt it was sufficiently communicated that the funds were for planning, construction, or waste management projects and not for R&D. The indirect rate was not included because the Department communicated that the funds were for construction costs only, which does not include indirect costs. The Department did not have a formal documented risk assessment because they believed that this was sufficiently done during the application process and during the actual grant award period. However, these procedures are informal, and no documentation is retained that specifically identifies risks of noncompliance with federal grant rules for the purpose of determining monitoring procedures. The Waste Management and Remediation Division did not have procedures to collect subrecipient Single Audit reports because they believed that the fiscal operations division would perform that function. Our discussions with the fiscal operations found that there was a position with the assigned duties to collect subrecipient Single Audits, but that position was vacant during fiscal year 2023, and the Department had difficulty filling the position. Effect: Subrecipient monitoring is a critical requirement as part of accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other guidelines provided by the grantor. Subrecipients need the required grant information to properly implement, manage, and report the federal award. Without this information, subrecipients have an increased risk of noncompliance with the federal award requirements. Assessing the risk of subrecipient noncompliance enables a pass-through entity to determine the proper level of monitoring procedures. Without completing the risk assessment process, a pass-thought entity may increase the risk that appropriate monitoring procedures will not be performed at a sufficient level to detect noncompliance or that a subrecipient will not comply with the grant terms. There were no subrecipient Single Audit reports due during our audit period; however, a well-designed procedure for collecting these reports is an important pass-through entity responsibility. Subrecipient audit reports may identify internal control issues and noncompliance with federal award requirements. Reviewing these reports and ensuring that potential issues are addressed decreases the overall risk of noncompliance with the federal award requirements. Recommendation: We recommend that the Department design and implement appropriate procedures to ensure that all required information is communicated to subrecipients at the time of the award, subrecipient risk assessments are properly completed and documented, and subrecipient audits are completed and reviewed in accordance with federal grant regulations. Management’s View: The department agrees with the lack of certain required subrecipient information datapoints for the CSLFRF projects. Corrective Action: The department had an imperfect implementation of the initial subawards for CSLFRF documentation for subrecipients. Our general practice includes providing the identified federal award identification datapoints; however, this was not the case with the initial CSLFRF subrecipients. As an example, the period of performance was truncated to ensure that we were able to meet the aggressive timeline outlined in the American Rescue Plan Act; we will include both the true period of performance as set forth in the grant and the budgetary period in which the subrecipient will need to complete their work. Carrie Champlin, Contracts Manager, and Rob Sepich, Chief Financial Officer will implement these changes by April 15, 2024. The department had processes for evaluating the risk of subrecipients, however it could be improved and made clearer for auditors and we will implement a process used by other agencies to memorialize the risk factors outside of email in a clear and concise manner. Additionally, the department is currently implementing a new software system, Amplifund, to aid in registering subrecipients, monitoring them, and closing out subawards. This system will include all of the relevant information necessary for both the subrecipient and the department in one location and will provide consistency across the department. Amplifund implementation is currently underway and will be used department- wide by August 2024. Doug McRoberts, Grants Manager, Jeri Ann Fogg, Accounting Manager, Carrie Champlin, Contracts Manager are working on the integration of Amplifund. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-207 The Division overstated federal expenditures by incorrectly including $6.6 million expended under the State Small Business Credit Initiative (SSBCI) on the Schedule of Expenditures of Federal Awards (SEFA) closing package. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: State Small Business Credit Initiative Assistance Listing Number: 21.031 Federal Award Number: Not Applicable Program Year: Not Applicable Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 2 CFR 200.510, requires the State to prepare a SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. The SSBCI statute, 12 U.S.C. § 5702(c)(5), specifically states that capital funds transferred to jurisdictions are not considered federal financial assistance for the purposes of 31 U.S.C. subtitle V. As such, capital funds are not subject to the single audit requirements of the Single Audit Act or 2 CFR 200, Subpart F. Condition: The Division reported $6.6 million in federal expenditures incurred under the SSBCI program on the SEFA closing package. These SSBCI funds includes two programs: the Capital Program and the Technical Assistance (TA) Grant Program. Under the Capital Program, participating jurisdictions implement credit and equity/venture capital programs to provide capital to small businesses. The Division received funding under the Capital Program, these funds are not subject to the Single Audit requirements of 2 CFR Subpart F. Cause: The Division was unaware that the Capital Program funds should not have been included on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Division, the statewide SEFA would have included an overstatement of $6.6 million for the SSBCI program. Recommendation: We recommend that the Division improve training and the review process for the SEFA closing package to ensure appropriate reporting of federal expenditures on the SEFA. Management’s View: The Division of Financial Management concurs with the finding. Corrective Action: The agency will implement improved training and review for the SEFA closing package prior to submission to ensure appropriate reporting of federal expenditures on the SEFA. The SSBCI funds were included in an abundance of caution to ensure reporting of all federal funds received, as it is rare that federal monies are to be excluded from the SEFA. Moving forward, preparation of the SEFA will include an analysis of all new federal awards to be included to confirm if the amounts are to be included, and a side-by-side comparison of the prospective list to the prior year report to note any differences and investigation of any that exist. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-210 Low-Income Home Energy Assistance Program (LIHEAP) performance and special reports did not include a review for accuracy and compliance prior to submission. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Federal Award Number: 2101IDLWC6; 2201IDLIEA; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024; October 1, 2021 – September 30, 2023; October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: During fiscal year 2023, the LIHEAP program was required to submit one program performance report and six program special reports to the federal government. The Department’s LIHEAP program manager compiles the program performance report and program special reports. The reports are submitted by the same program manager to the Office of Community Services. The reviews and the approvals for all seven reports tested were not documented. There was no documented review for accuracy nor approval of the reports. In addition, three of the annual special reports were not submitted timely. Cause: The Department staff indicated that there is no official approval process as reports are submitted online and the data source is either collaborated or provided by internal sources and verified. The Department did not consider that documentation to support the review and the approval of these reports was necessary to ensure accuracy and compliance with reporting requirements. Effect: Three of the annual LIHEAP special reports were not submitted timely. We did not identify any other errors in the performance or special reports. However, in the absence of a documented appropriate internal control, there is an increased risk of errors occurring and going undetected. Further, the Department could submit the performance and special reports with incomplete or inaccurate information required by the grant agreement. Recommendation: We recommend that the Department design and implement internal controls to ensure sufficient documentation is maintained to support the completion of a review for accuracy and compliance for required LIHEAP reports, prior to submission. Management’s View: The Department agrees with the finding. Corrective Action: The Program will develop a process to work with the Information Management and Analysis Team (IMAT) within the division to compile the data for the Low-Income Home Energy Assistance Program (LIHEAP) reports. Program will review the completed reports for accuracy. All reports will then be submitted to the Bureau Chief, as a second review of accuracy, prior to submission to Federal Partners. Documentation will be maintained to support the preparation, review, and approval steps. The process outlines a timeline to have reports prepared and reviewed ahead of the established deadline. Program will communicate with our Federal Partner if circumstances arise that would prevent a report from being submitted by an established deadline to receive an extension. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-211 The review and approval of the annual updates to the Low-Income Home Energy Assistance Program (LIHEAP) benefits matrix were not documented. Type of Finding: Significant Deficiency Assistance Listing Title: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Federal Award Number: 2101IDLWC6; 2201IDLIEA; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024; October 1, 2021 – September 30, 2023; October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP utilizes a software to determine eligibility and benefit amounts for applicants based on energy burden and qualifying factors. There is a benefits matrix within the software, which is updated annually. Each year, the Department’s LIHEAP program staff update the benefits matrix with any required changes. The review and approval of the changes were completed by program staff, who met in-person and completed testing scenarios to verify the accuracy of the information. After the test results were reviewed and no errors identified, the matrix information was uploaded into software production prior to the start of the heating season. The review and approval of the changes to the benefits matrix were not documented. Verbal confirmation was provided to the program manager. Cause: The Department did not consider that documentation to support the review and approval of the updates to the benefits matrix was necessary. Effect: We did not identify errors in the 60 approved and 60 denied eligibility determinations that we reviewed. However, without review (documented) there is an increased risk of errors in the matrix either because of erroneous changes or no changes occurring and then going undetected in eligibility determinations. Recommendation: We recommend that the Department design and implement procedures to ensure sufficient documentation is maintained that supports the review and approval of the updates to the benefits matrix. Management’s View: The Department agrees with the finding. Corrective Action: Testing of the updated benefits matrix will be completed by the Program annually, and the results will be documented using an established scenario testing script. Results of the testing will be documented and submitted to the Bureau Chief, as a second review of accuracy and compliance, prior to moving the updated matrix into the production environment. Documentation will be maintained to support the review and approval. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-212 The review of the Low-Income Home Energy Assistance Program (LIHEAP) earmarking compliance requirements was not documented. Type of Finding: Material Weakness Assistance Listing Title: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Federal Award Number: 2101IDLWC6; 2201IDLIEA; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024; October 1, 2021 – September 30, 2023; October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Matching; LOE; Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP requires earmarking which limits the percentage of grant funds that can be spent on administration, weatherization, and leveraging programs. The monitoring of LIHEAP earmarking requirements was completed by the program manager on a spreadsheet that tracked expenditures and appropriate limitations to ensure compliance was met. However, there was no documented review for accuracy nor approval of the tracking spreadsheet. Cause: The Department did not consider that documentation to support the review and approval of the earmarking tracking spreadsheet was necessary to ensure accuracy and compliance. Effect: We did not identify any errors in compliance with earmarking requirements during completion of audit procedures, but the lack of a documented review increases the risk of errors occurring and going undetected. Recommendation: We recommend that the Department design and implement procedures to ensure sufficient documentation is maintained that supports the review and approval of the earmarking tracking spreadsheet. Management’s View: The Department agrees with the finding. Corrective Action: The Program will document the current process regarding the preparation, review, and approval of the Low-Income Home Energy Assistance Program (LIHEAP) budget that includes maintaining the documentation of the earmarking reviews that are being completed. The program will prepare the Low-Income Home Energy Assistance Program (LIHEAP) budget. This budget will be submitted to the Bureau Chief, as a second review of accuracy and compliance, to include review of earmarking limits, prior to routing the Annual State Plan for review and submittal or the allocation of any funding. Documentation will be maintained to support the review and approval. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-213 The Department erroneously determined that two recipients of Temporary Assistance for Needy Families (TANF) funding were contractors instead of subrecipients resulting in noncompliance with the subrecipient monitoring requirements. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Federal Award Number: 2201IDTANF; 2301IDTANF Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.331 describes the Department’s, a pass-through entity, responsibility for completing subrecipient and contractor determinations. The Uniform Guidance included in 2 CFR 200.332 (a) states that pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward. Also, if any of these data elements change, include the changes in subsequent subaward modification.   (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal award date (see the definition of federal award date in 2 CFR 200.1 of this part) of award to the recipient by the federal agency; (v) Subaward period of performance start and end date; (vi) Subaward budget period start and end date; (vii) Amount of federal funds obligated by this action by the pass-through entity to the subrecipient; (viii) Total amount of federal funds obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total amount of the federal award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of federal awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity; (xii) Assistance Listings number and title; the pass-through entity must identify the dollar amount made available under each federal award and the Assistance Listings number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the federal award, including if the de minimis rate is charged per 2 CFR 200.414. If any of the required information is not available, the pass-through entity must provide the best information available to describe the federal award and subaward. The Uniform Guidance included 2 CFR 200.332(b) states that pass-through entities must evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a single audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of federal awarding agency monitoring (for example, if the subrecipient also receives federal awards directly from a federal awarding agency). Condition: The Department erroneously determined that two recipients of TANF funding were contractors instead of subrecipients. A contractor provides services or goods while a subrecipient has additional responsibilities related to the grant administration. Because of that, there are additional requirements when passing through funds to a subrecipient, rather than making a payment to a vendor. We tested one of the two subrecipients for compliance purposes. The award was not identified to the subrecipient as a subaward and did not include all the necessary information at the time of the subaward. In addition, the subrecipient's risk of noncompliance was not evaluated. Cause: During our analysis of the subrecipient monitoring compliance requirement, we learned that the Department’s program staff determined that some of the recipients of TANF funding were contractors. However, the Department’s financial staff reported the expenditures as payments to subrecipients on the SEFA. After investigation, we found that the expenditures were made to subrecipients, not contractors. Effect: The Department is exposed to increased risk of noncompliance related to subrecipients and improper payments in the TANF program. The Department provided a total amount of $1.4 million to subrecipients during fiscal year 2023. Recommendation: We recommend that the Department implement proper training of personnel involved in subrecipient and contractor determinations. In addition, we recommend that the Department design and implement effective internal control procedures to ensure all required information is provided to subrecipients at the time of subawards and that the Department complete the required evaluations of each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. Management’s View: The Department agrees with the finding. Corrective Action: The Department has revised our training of personnel involved in subrecipient and contractor determinations. These contract managers and monitors completed grant training on March 12th-13th, 2024 which included sections about subrecipient and contractor determinations, risk assessment and documentation. All newly hired employees will be trained beginning April 2024 with an on-line module. For the impacted vendor, an updated Risk Assessment was completed and submitted to LSO. Additionally, the Department has started the work to effectively change the designation of the vendor and ensure all required information is provided to this subrecipient. This process will be completed by April 30th, 2024. The Department will develop internal control procedures to ensure all required information is provided to the subrecipients at the time of the subawards. These updated internal control procedures will be completed by June 30th, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-214 The Department did not maintain sufficient documentation to support eligibility award decisions for the Community Partners Grants within the Child Care and Development Fund (CCDF) program. Type of Finding: Material Weakness Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2101IDCDC6 (ARPA); 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2020 – September 30, 2024; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility; Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Child Care and Development Fund (CCDF) program received additional funding through the Coronavirus Aid, Relief, and Economic Security (CARES) Act and American Rescue Plan Act (ARPA). During testing for eligibility within the CCDF program, we reviewed ARPA provider applications to determine if they were properly reviewed and approved by appropriate personnel. For four of the sixty providers tested (or 6.67 percent), there was no documentation to show who completed the eligibility evaluation or when the evaluation was completed. All four providers were Community Partners Grant recipients. Cause: The Department did not design and properly document a review process that would identify who participated, what was evaluated, what each applicant scored on the evaluation criteria, and the final decision made for the Community Partners Grant recipients. The Department stated that review and approval of the grants was a group effort and agreed that the process was not properly documented. Additionally, there was an indication of high turnover during grant processing, which could have contributed to missing documentation. Effect: The Department did not maintain adequate support for the Community Partners Grant application approvals, which could have resulted in grant funds being awarded to ineligible recipients. Recommendation: We recommend that the Department ensure that internal controls are consistently performed to ensure adequate evaluations of grant applications are properly documented. Management’s View: The Department agrees with the finding. It should be noted that the Community Partner Grants have ended. Corrective Action: The division will: • All employees who administer grants will be required to complete training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. • The Division will work closely with the Division of Management Services to support the development and implementation of updated record retention policies and processes which will result in relevant documents being centrally retained. Estimated completion date December 31, 2024. Between now and when that central repository is available, individual rubrics and their supporting documents related to grant awards will be retained. • All employees will complete an annual employee conflict-of-interest disclosure and recertification process. Current completion of the new employee conflict of interest from will be completed by April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-214 The Department did not maintain sufficient documentation to support eligibility award decisions for the Community Partners Grants within the Child Care and Development Fund (CCDF) program. Type of Finding: Material Weakness Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2101IDCDC6 (ARPA); 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2020 – September 30, 2024; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility; Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Child Care and Development Fund (CCDF) program received additional funding through the Coronavirus Aid, Relief, and Economic Security (CARES) Act and American Rescue Plan Act (ARPA). During testing for eligibility within the CCDF program, we reviewed ARPA provider applications to determine if they were properly reviewed and approved by appropriate personnel. For four of the sixty providers tested (or 6.67 percent), there was no documentation to show who completed the eligibility evaluation or when the evaluation was completed. All four providers were Community Partners Grant recipients. Cause: The Department did not design and properly document a review process that would identify who participated, what was evaluated, what each applicant scored on the evaluation criteria, and the final decision made for the Community Partners Grant recipients. The Department stated that review and approval of the grants was a group effort and agreed that the process was not properly documented. Additionally, there was an indication of high turnover during grant processing, which could have contributed to missing documentation. Effect: The Department did not maintain adequate support for the Community Partners Grant application approvals, which could have resulted in grant funds being awarded to ineligible recipients. Recommendation: We recommend that the Department ensure that internal controls are consistently performed to ensure adequate evaluations of grant applications are properly documented. Management’s View: The Department agrees with the finding. It should be noted that the Community Partner Grants have ended. Corrective Action: The division will: • All employees who administer grants will be required to complete training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. • The Division will work closely with the Division of Management Services to support the development and implementation of updated record retention policies and processes which will result in relevant documents being centrally retained. Estimated completion date December 31, 2024. Between now and when that central repository is available, individual rubrics and their supporting documents related to grant awards will be retained. • All employees will complete an annual employee conflict-of-interest disclosure and recertification process. Current completion of the new employee conflict of interest from will be completed by April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-214 The Department did not maintain sufficient documentation to support eligibility award decisions for the Community Partners Grants within the Child Care and Development Fund (CCDF) program. Type of Finding: Material Weakness Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2101IDCDC6 (ARPA); 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2020 – September 30, 2024; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility; Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Child Care and Development Fund (CCDF) program received additional funding through the Coronavirus Aid, Relief, and Economic Security (CARES) Act and American Rescue Plan Act (ARPA). During testing for eligibility within the CCDF program, we reviewed ARPA provider applications to determine if they were properly reviewed and approved by appropriate personnel. For four of the sixty providers tested (or 6.67 percent), there was no documentation to show who completed the eligibility evaluation or when the evaluation was completed. All four providers were Community Partners Grant recipients. Cause: The Department did not design and properly document a review process that would identify who participated, what was evaluated, what each applicant scored on the evaluation criteria, and the final decision made for the Community Partners Grant recipients. The Department stated that review and approval of the grants was a group effort and agreed that the process was not properly documented. Additionally, there was an indication of high turnover during grant processing, which could have contributed to missing documentation. Effect: The Department did not maintain adequate support for the Community Partners Grant application approvals, which could have resulted in grant funds being awarded to ineligible recipients. Recommendation: We recommend that the Department ensure that internal controls are consistently performed to ensure adequate evaluations of grant applications are properly documented. Management’s View: The Department agrees with the finding. It should be noted that the Community Partner Grants have ended. Corrective Action: The division will: • All employees who administer grants will be required to complete training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. • The Division will work closely with the Division of Management Services to support the development and implementation of updated record retention policies and processes which will result in relevant documents being centrally retained. Estimated completion date December 31, 2024. Between now and when that central repository is available, individual rubrics and their supporting documents related to grant awards will be retained. • All employees will complete an annual employee conflict-of-interest disclosure and recertification process. Current completion of the new employee conflict of interest from will be completed by April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-215 The Department’s review of child care providers health and safety inspections for the Child Care and Development Fund (CCDF) were not completed timely. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Grant Guidance included in 42 USC 98859c(c)(2)(i) - (I) Health and Safety requirements states that the plan shall include a certification that there are in effect within the State, under State or local law, requirements designed to protect the health and safety of children that are applicable to child care providers that provide services for which assistance is made available in accordance with this subchapter. The Department has contracted with the Idaho Central District Health (ICDH) to complete required health and safety inspections. The Department’s policy is to monitor the contracted inspections. The Department’s Contracts and External Resource Management (CERM) team is tasked with conducting reviews of the monitoring completed by ICDH. The CERM team review includes randomly sampling the health and safety inspections based on a calculation per Department operating procedures. Contract monitoring done by the CERM team includes verifying compliance with contract requirements, such as reviewing expenditures, approving invoices for payment based on compliance to the contract terms, reviewing, performance standards, and ensuring compliance with record keeping provisions. Condition: During our audit, we determined that all eight of the monitoring reviews conducted by the CERM team, for health and safety inspections completed by the ICDH for fiscal year 2022, were completed on January 30, 2024. The Department reviews were completed after the audit of the program commenced. Based on our analysis, it appeared that the ICDH was properly completing the health and safety inspections. However, the Department cannot ensure that childcare providers serving children who receive subsidies meet applicable health and safety standards when monitoring the contracted reviews occurs so far after the date of review. Additionally, when the Department contracted these inspections out to the ICDH, they did not include a time frame to complete the reviews of the inspections in its policies and procedures. Completing reviews more than 12-months after the inspection greatly increases the risk of noncompliance and reduces the Department’s ability to enforce compliance. Cause: According to the Department, personnel staffing issues led to the delay of the Department’s reviews over the health and safety inspections. Effect: The CERM team did not review the providers’ health and safety inspections in a timely manner. Providers receiving subsidies could have been noncompliant with all applicable health and safety requirements and children could have been unduly at risk. Recommendation: We recommend that the Department complete reviews of the health and safety inspections in a timely manner. We also recommend that the Department define due dates for completion of these reviews within the program guidelines to provide an appropriate time to remediate issues raised during the inspections and ensure compliance. Management’s View: The Department agrees with the finding. The Department review of contracted health and safety inspections was not performed timely. Completion of childcare provider health and safety inspections is very important to the Department. Childcare providers are not certified for program subsidy participation without an inspection. Corrective Action: The division will complete reviews of the health and safety inspections in a timely manner. The division will review and update the existing process document to support this corrective action plan defining timeframes for completion of these reviews so that there is appropriate time to remediate issues raised during the inspections and ensure compliance. The updated process document will be in place and appropriate staff will implement by 9/30/2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-215 The Department’s review of child care providers health and safety inspections for the Child Care and Development Fund (CCDF) were not completed timely. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Grant Guidance included in 42 USC 98859c(c)(2)(i) - (I) Health and Safety requirements states that the plan shall include a certification that there are in effect within the State, under State or local law, requirements designed to protect the health and safety of children that are applicable to child care providers that provide services for which assistance is made available in accordance with this subchapter. The Department has contracted with the Idaho Central District Health (ICDH) to complete required health and safety inspections. The Department’s policy is to monitor the contracted inspections. The Department’s Contracts and External Resource Management (CERM) team is tasked with conducting reviews of the monitoring completed by ICDH. The CERM team review includes randomly sampling the health and safety inspections based on a calculation per Department operating procedures. Contract monitoring done by the CERM team includes verifying compliance with contract requirements, such as reviewing expenditures, approving invoices for payment based on compliance to the contract terms, reviewing, performance standards, and ensuring compliance with record keeping provisions. Condition: During our audit, we determined that all eight of the monitoring reviews conducted by the CERM team, for health and safety inspections completed by the ICDH for fiscal year 2022, were completed on January 30, 2024. The Department reviews were completed after the audit of the program commenced. Based on our analysis, it appeared that the ICDH was properly completing the health and safety inspections. However, the Department cannot ensure that childcare providers serving children who receive subsidies meet applicable health and safety standards when monitoring the contracted reviews occurs so far after the date of review. Additionally, when the Department contracted these inspections out to the ICDH, they did not include a time frame to complete the reviews of the inspections in its policies and procedures. Completing reviews more than 12-months after the inspection greatly increases the risk of noncompliance and reduces the Department’s ability to enforce compliance. Cause: According to the Department, personnel staffing issues led to the delay of the Department’s reviews over the health and safety inspections. Effect: The CERM team did not review the providers’ health and safety inspections in a timely manner. Providers receiving subsidies could have been noncompliant with all applicable health and safety requirements and children could have been unduly at risk. Recommendation: We recommend that the Department complete reviews of the health and safety inspections in a timely manner. We also recommend that the Department define due dates for completion of these reviews within the program guidelines to provide an appropriate time to remediate issues raised during the inspections and ensure compliance. Management’s View: The Department agrees with the finding. The Department review of contracted health and safety inspections was not performed timely. Completion of childcare provider health and safety inspections is very important to the Department. Childcare providers are not certified for program subsidy participation without an inspection. Corrective Action: The division will complete reviews of the health and safety inspections in a timely manner. The division will review and update the existing process document to support this corrective action plan defining timeframes for completion of these reviews so that there is appropriate time to remediate issues raised during the inspections and ensure compliance. The updated process document will be in place and appropriate staff will implement by 9/30/2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-215 The Department’s review of child care providers health and safety inspections for the Child Care and Development Fund (CCDF) were not completed timely. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Grant Guidance included in 42 USC 98859c(c)(2)(i) - (I) Health and Safety requirements states that the plan shall include a certification that there are in effect within the State, under State or local law, requirements designed to protect the health and safety of children that are applicable to child care providers that provide services for which assistance is made available in accordance with this subchapter. The Department has contracted with the Idaho Central District Health (ICDH) to complete required health and safety inspections. The Department’s policy is to monitor the contracted inspections. The Department’s Contracts and External Resource Management (CERM) team is tasked with conducting reviews of the monitoring completed by ICDH. The CERM team review includes randomly sampling the health and safety inspections based on a calculation per Department operating procedures. Contract monitoring done by the CERM team includes verifying compliance with contract requirements, such as reviewing expenditures, approving invoices for payment based on compliance to the contract terms, reviewing, performance standards, and ensuring compliance with record keeping provisions. Condition: During our audit, we determined that all eight of the monitoring reviews conducted by the CERM team, for health and safety inspections completed by the ICDH for fiscal year 2022, were completed on January 30, 2024. The Department reviews were completed after the audit of the program commenced. Based on our analysis, it appeared that the ICDH was properly completing the health and safety inspections. However, the Department cannot ensure that childcare providers serving children who receive subsidies meet applicable health and safety standards when monitoring the contracted reviews occurs so far after the date of review. Additionally, when the Department contracted these inspections out to the ICDH, they did not include a time frame to complete the reviews of the inspections in its policies and procedures. Completing reviews more than 12-months after the inspection greatly increases the risk of noncompliance and reduces the Department’s ability to enforce compliance. Cause: According to the Department, personnel staffing issues led to the delay of the Department’s reviews over the health and safety inspections. Effect: The CERM team did not review the providers’ health and safety inspections in a timely manner. Providers receiving subsidies could have been noncompliant with all applicable health and safety requirements and children could have been unduly at risk. Recommendation: We recommend that the Department complete reviews of the health and safety inspections in a timely manner. We also recommend that the Department define due dates for completion of these reviews within the program guidelines to provide an appropriate time to remediate issues raised during the inspections and ensure compliance. Management’s View: The Department agrees with the finding. The Department review of contracted health and safety inspections was not performed timely. Completion of childcare provider health and safety inspections is very important to the Department. Childcare providers are not certified for program subsidy participation without an inspection. Corrective Action: The division will complete reviews of the health and safety inspections in a timely manner. The division will review and update the existing process document to support this corrective action plan defining timeframes for completion of these reviews so that there is appropriate time to remediate issues raised during the inspections and ensure compliance. The updated process document will be in place and appropriate staff will implement by 9/30/2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-216 The Department did not have appropriate documentation to support allowability of transactions for the Foster Care Title IV-E program. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Costs Principles Questioned Costs: Known $4,555; Projected $213,387 Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 U.S. Code (USC) 675(4)(A) states that the term “foster care maintenance payments” means payments to cover the cost of (and the cost of providing) food, clothing, shelter, daily supervision, school supplies, a child’s personal incidentals, liability insurance with respect to a child, reasonable travel to the child’s home for visitation, and reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement. The Uniform Guidance included in 45 CFR 1356.60(c)(3) states that allowable administrative costs do not include the costs of social services provided to the child, the child's family or foster family, which provide counseling or treatment to ameliorate or remedy personal problems, behaviors, or home conditions. The Uniform Guidance states that costs claimed as foster maintenance payments that include medical, educational (except for school supplies and the cost of reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement in foster care), or other expenses not outlined in 42 USC 675(4)(A) are unallowed. Condition: We tested 61 expenditure transactions charged to the Foster Care - Title IV-E program. The sample included 4 expenditures that were for unallowable costs charged to the program or that were missing supporting documentation making it difficult to determine if the costs were allowable. We also identified one transaction that did not have evidence of review and approval prior to payment but appears to be for an allowable expenditure. The details for the 5 of 61, or 8 percent, transactions with exceptions is as follows: 1) We determined that 2 out of 61 transactions tested (or 3.2 percent) were unallowable. The first transaction was paid for the family therapy service. The total cost was $206. This type of activity is specifically unallowable under 45 CFR 1356.60(c)(3). The second transaction was paid for an intensive reading program for a child. The total cost was $3,200. This type of activity is unallowable under 42 USC 675(4)(A), which only allows for educational activities for school supplies and the cost of reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement in foster care. 2) For 2 out of 61 transactions tested (or 3.2 percent), we were not able to determine allowability due to missing support documentation. For the first transaction, we were unable to determine the purpose for a car rental and gasoline purchase totaling $780. The supporting documentation did not include enough detail to ensure allowability. For the second transaction, we were unable to determine the purpose and allowability for a travel expenditure totaling $349. The supporting documentation for the purchase of an airline ticket did not include a travel voucher or agenda. 3) The review and approval of 1 out of 61 transactions tested (or 1.6 percent) was not documented. The transaction totaled $61. Cause: The Department could not locate additional support documentation to justify the payments. In addition, the Department did not consider that additional support should be retained to ensure compliance. The Department considered the activities for the family therapy services and the intensive reading program as allowable. Effect: Federal funds were expended for unallowable activities. The total for unallowable activities and activities lacking supporting documentation was $4,555. The total projected questioned costs for allowable activities are $213,387. Further, other expenditures in our sample did not have appropriate supporting documentation which increases the likelihood of additional unallowable activities. Recommendation: We recommend that the Department strengthen internal control procedures to ensure that expenditures are allowable and that sufficient documentation is retained to support that determination. Management’s View: The Department agrees with the finding. Corrective Action: A new feature was added to ESPI on 1/9/24 to record the reason (purpose) for certain service types, including transportation. The system is programmed to disallow Title IV-E if the reason listed does not meet IV-E eligibility criteria (see image below). An additional control will be added to the system to have the same control procedure used for a medical service type and education service type. Further development is underway for additional control procedures and should be completed by April of 2025. P-card transactions do not process through ESPI. Quarterly reports will be obtained to review any P-card transactions that utilized Title IV-E to confirm appropriate documentation is on record. This will be completed by April 30, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-217 The Department does not have documented internal controls for adjustments processed to the Foster Care -Title IV—E program. Type of Finding: Material Weakness Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Foster Care - Title IV-E program maintenance payments are processed through the Ensuring Safety & Permanency in Idaho system (ESPI). Those payments include recurring, non-recurring, and adjustment transactions. Adjustments transactions are processed by the Department’s program personnel on a monthly basis. Adjustments are a function of the pace at which the Department is able to obtain the documents and information for eligibility determinations. Court documents can take extended periods to obtain. In addition, the intermittent nature of child support payments also drives adjustments in the program. We were not able to identify documented internal controls over the adjustment transactions for 60 out of 62 adjustment transactions (or 96.7 percent) that were processed through ESPI. Cause: The review and approval over the adjustment transactions were not documented within the program software. Effect: We did not identify any substantive or compliance errors during testing over adjustment transactions. However, without documentation of a review and approval, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department design and implement internal controls to document the review and approval of the adjustment transactions processed in ESPI. Management’s View: The Department agrees with the finding. Corrective Action: The Department will continue to record adjustment activity through Help Desk tickets, SharePoint documentation, and ESPI. The Department will ensure improved visibility to the adjustment and approval process and documentation by ensuring all roles who need access (including auditors), have access to all relevant systems and storage locations such as access to SharePoint and Help Desk tickets. This step will be completed by April 30, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-218 The Department failed to provide necessary documentation to support the eligibility determination for two foster care providers within the Foster Care -Title IV—E program. Type of Finding: Noncompliance Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Questioned Costs: Known $884; Projected $126,091 Criteria: Federal law 42 U.S. Code (USC) 672(b) states that foster care maintenance payments may be made under this part only on behalf of a child described in subsection (a) of this section who is: (1) in the foster family home of an individual, whether the payments therefor are made to such individual or to a public or private child-placement or child-care agency, or (2) in a child-care institution, whether the payments therefor are made to such institution or to a public or private child-placement or child-care agency, which payments shall be limited so as to include in such payments only those items which are included in the term “foster care maintenance payments” (as defined in section 475(4)).   Federal Law 42 USC 672(c) defines a foster family home as: (A) In general. The term “foster family home” means the home of an individual or family: (i) that is licensed or approved by the State in which it is situated as a foster family home that meets the standards established for the licensing or approval, and (ii) in which a child in foster care has been placed in the care of an individual, who resides with the child and who has been licensed or approved by the State to be a foster parent (I) that the State deems capable of adhering to the reasonable and prudent parent standard, (II) that provides 24-hour substitute care for children placed away from their parents or other caretakers, and (III) that provides the care for not more than six children in foster care. The Uniform Guidance included in 42 USC 671(a)(20)(A) states that the foster family home provider must have satisfactorily met a criminal records check, including a fingerprint-based check with respect to prospective foster and adoptive parents. The Uniform Guidance included in 42 USC 671(a)(20)(B) states that a Title IV-E agency must check, or request a check of, a state-maintained child abuse and neglect registry in each state the prospective foster and adoptive parent(s) and any other adult(s) living in the home have resided in the preceding five years before the State can license or approve a prospective foster or adoptive parent. Condition: During our review of the eligibility determination for foster care providers, the Department could not locate the foster home license documentation for 2 out of 65 foster homes reviewed (or 3 percent). For those same 2 foster homes, child abuse and neglect registry checks were not provided, and for 1 of those 2 foster homes a criminal record check and a fingerprint-based check were not provided. Cause: The Department was unable to locate the proper backup eligibility documentation. In addition, the Department mentioned that this situation was caused by the migration of data from an old system, iCare, to the new system, Ensuring Safety & Permanency in Idaho (ESPI), which was fully implemented on November 26, 2020. Effect: Foster families could be receiving subsidies without proper licensing and without passing background checks, fingerprint-based checks, and child abuse and neglect checks. This also increases the risk to the safety of the children placed in these homes. The total amount associated with the exceptions noted was $884. The total projected questioned costs for eligibility items are $126,091. Recommendation: We recommend that the Department design procedures to ensure that background, fingerprint-based, and child abuse and neglect checks are completed and properly maintained for Foster Care -Title IV—E eligibility determinations. Management’s View: The Department agrees with this finding. Corrective Action: The department agrees with the finding related to the critical importance of obtaining and maintaining documentation for all necessary background checks. Although the department was ultimately able to verify background checks were completed, we agree that we were unable to readily pull the needed documentation on these in a timely manner. To correct the issue, the department will add an additional point of verification that the Enhanced Criminal History Background Check clearance letter from the Background Check Unit’s system is uploaded to eCabinet, by having supervisors view the document within eCabinet prior to approving the initial foster care license. Supervisors will also confirm that all ICPC home studies address results of background checks for all adults in the home and any additional potential caregivers. This will be completed April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-219 The level of effort spending requirements for the Adoption Assistance Title IV-E program were not met. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Adoption Assistance Assistance Listing Number: 93.659 Federal Award Number: 2201IDADPT; 2301IDADPT Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Matching; LOE; Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 USC 673(a)(8)(A) states that a state must calculate the adoption savings (if any) resulting from the application of different program eligibility rules (42 USC 673 (a)(2)(A)(ii)) to all applicable children for a fiscal year using methodology proposed by the state and approved by ACF. The Uniform Guidance included in 42 USC 673(a)(8)(D)(i) states that a state shall spend an amount equal to the amount of the savings (if any) in state expenditures under this part resulting from the application of paragraph (2)(A)(ii) to all applicable children for a fiscal year, to provide to children of families any service that may be provided under part B or this part. A state shall spend not less than 30 percent of any such savings on post-adoption services, post-guardianship services, and services to support and sustain positive permanent outcomes for children who otherwise might enter into foster care under the responsibility of the state, with at least two-thirds (2/3) of the spending by the state to comply with such 30 percent requirement being spent on post-adoption and post-guardianship services. Condition: During fiscal year 2023, the minimum spending amount to meet level of effort requirements for the Adoption Assistance Title IV-E program was $362,738. The Department only spent $276,658 of the required amount of adoption savings, calculated for federal fiscal year 2022, on post-adoption services, post-guardianship services, and services to support positive permanent outcomes for children at risk of entering foster care. The difference was $86,080. The amount spent was only 22.9 percent and the program requirement is 30 percent of adoption savings. Cause: Population growth, COVID impacts, staff turnover, and increasing residential treatment costs have reached a point that the Department’s budget was strained beyond capacity. The Department stated that the dollars to meet level of effort requirements come from its state General Fund appropriation, and the Department prioritized those limited General Fund dollars to emergent, critical, and safety related needs of kids in foster care over complying with the matching requirements for this program. Effect: Adoptive families in Idaho did not receive the full benefits of post-adoption services, post-guardianship services, and services to support positive permanent outcomes for children at risk of entering foster care that are required under this program. Recommendation: We recommend that the Department design, implement and maintain internal control procedures to ensure compliance with level of effort requirements for Adoption Assistance Title IV-E program. We further recommend that the Department improve budgeting and monitoring for General Fund spending plans and actual expenditures to ensure that they can comply with federal requirements. Management’s View: The Department agrees with the finding. Corrective Action: Beginning 07/01/2023, FACS implemented a monthly review of post-permanency services invoices and payments to support correct usage of adoption assistance funds including 30% spending of adoption savings for prevention. Progress toward fully effective integration of this process has been hindered by limited access to timely and accurate budget data from LUMA. FACS will refine the monthly review process to ensure current and accurate tracking and use of funds. This will be completed July 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-220 The Department failed to provide necessary supporting documentation for five Adoption Assistance Title IV-E eligibility determinations. Type of Finding: Material Noncompliance Assistance Listing Title: Adoption Assistance Assistance Listing Number: 93.659 Federal Award Number: 2201IDADPT; 2301IDADPT Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Questioned Costs: Known $2,249; Projected $711,238 Criteria: The Uniform Guidance included in 42 U.S. Code (USC) 671(a)(20)(A) states that the prospective adoptive parent(s) must have satisfactorily met a criminal record check, including a fingerprint-based check. The Uniform Guidance included in 42 USC 671(a)(20)(B) states that the prospective adoptive parent(s) and any other adult living in the home who has resided in the provider home in the preceding five years must satisfactorily have met a child abuse and neglect registry check. The Uniform Guidance in the 42 USC 675(3) states that the agreement for the subsidy was signed and was in effect before the final decree of adoption and contains information concerning the nature of services. Condition: The Department could not locate criminal records check, fingerprint-based check, and child abuse and neglect registry check for 3 out of 65 adoption cases reviewed (or 4.6 percent). In addition, the Department could not locate 2 of the 65 adoption agreements we tested (or 3 percent). Cause: The Department was unable to locate the proper supporting eligibility documentation. In addition, the Department mentioned that this situation was caused by the migration of data from an old system, iCare, to the new system, Ensuring Safety & Permanency in Idaho (ESPI), which was fully implemented on November 26, 2020. Effect: Adoption families could be receiving subsidies without proper adoption agreement and without passing background check, fingerprint-based check, and child abuse and neglect checks. The total amount associated with the exceptions noted was $2,249. The total projected questioned costs for eligibility items are $711,238. Recommendation: We recommend that the Department maintain supporting documentation for Adoption Assistance Title IV—E eligibility determinations. Management’s View: The Department agrees with the finding. Corrective Action: The department agrees with the finding related to the critical importance of obtaining and maintaining documentation for all necessary background checks. Although the department was ultimately able to verify background checks were completed, we agree that we were unable to readily pull the needed documentation on these in a timely manner. The department will assure supporting documentation for Adoption Assistance Title IV-E eligibility determinations are maintained within the electronic filing system by adding an additional verification to the current process. When a supervisor reviews a departmental adoption for finalization, they will verify that a copy of the Enhanced Criminal History Background clearance letter for all adults residing in the home is uploaded to the prospective adoptive parents’ profile in eCabinet (the electronic case management system), and the signed copy of the adoption assistance agreement is uploaded to the child’s profile. The application process for Adoption Assistance Title IV-E eligibility for private adoptions will be updated to include the addition of the Enhanced Criminal History Background clearance letters for all adults residing in the home to the child’s eCabinet file. When a supervisor approves an adoption assistance agreement for a private adoption, they will verify a copy of the signed adoption assistance agreement is uploaded to the adoptive child’s profile. This will be completed by August 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-221 The Department did not review subrecipient application information for the Coronavirus State and Local Fiscal Recovery Funds at a sufficient level to identify missing information. Related to Prior Finding: 2022-210 Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: 20-1982-0-1-806 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.332 describes the pass-through entities’ responsibility for administering necessary requirements on subrecipients so that the federal award is used in accordance with federal regulations. The Uniform Guidance included in 2 CFR 200.332(a)(1)(iii) states that pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal Award Identification Number (FAIN) at the time of subaward. Condition: The Department used COVID State and Local Fiscal Recovery funds to respond to the public health and negative economic impacts resulting from the COVID-19 pandemic. The Division of Public Health and the Idaho Council on Domestic Violence and Victim Assistance were responsible for distributing these funds and created a process for their prospective recipients to apply and receive funding. During testing, we noted 2 applications out of our sample of 8 (25 percent) that did not include FAINs in application documentation, as required. Cause: The Department had review procedures in place; however, the reviews of subrecipient application documentation were not completed at a level sufficient to identify missing FAINs. Effect: The Department is exposed to increased risk of improper payments and noncompliance with federal requirements when applications do not meet all requirements for receiving funding. Recommendation: We recommend that the Department design and implement effective internal control procedures to ensure subrecipient applications are completed accurately and in compliance with federal requirements. Management’s View: The Department agrees with the finding. Corrective Action: The Division of Public Health and Idaho Council on Domestic Violence and Victim Assistance (ICDVVA) will take steps to ensure new staff receive training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. All newly hired employees will be trained beginning April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-222 Supporting documentation to demonstrate the completion of subrecipient risk assessments for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program was not available for review. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Number: 1 NH75OT000105-01-00; 6 NH75OT000105-01-00 Program Year: June 1, 2021 – May 31, 2024 Federal Agency: Department of Health and Human Services   Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.332(b) states that all pass-through entities must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: The Department was unable to provide a subrecipient risk assessment for 1 out of 8 (or 12.5 percent) subrecipients we reviewed. The Department was compliant with all other aspects of the subrecipient monitoring compliance requirements for that subrecipient. Cause: During the time in which the missing documentation was supposed to be created, the Department’s program staff were in the process of being hired and trained. Responsibilities were also being transitioned to the newly onboarded staff from the other program staff that assisted in the implementation of the grant. Effect: The Department is exposed to increased risk of noncompliance related to subrecipients and improper payments in the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program. Recommendation: We recommend that the Department strengthen internal controls to ensure required risk assessments are completed and supporting documentation is retained. Management’s View: The Department agrees with the finding. Corrective Action: The division will ensure new staff receive training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. All newly hired employees will be trained beginning April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-223 Managed Care providers lacked documentation to support continued eligibility within the Medicaid Program. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR section 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. The Uniform Guidance included in 42 CFR section 455.412 states that the Medicaid State Plan gives assurance that the State Medicaid Agency has a method for verifying providers licensed by the State and that such provider licenses have not expired or have no current limitations. Condition: Managed Care Organizations (MCO) providers are monitored by the Bureau of Care Management using a provider roster. The Department receives and tracks the provider roster for all MCO annually. We noted four of the sixty-two managed care providers tested (6.5 percent) did not have documentation to support their provider eligibility; however, those providers were included in the roster as of December 2023. The Department was not able to provide documentation that these providers had the applicable licenses and certifications, entered into a provider agreement, and have made the required disclosures to the State. The four providers did not have an active contract with MCO during the period, nor did they have any claim payments associated with the provider. However, a Medicaid recipient could possibly utilize a provider from the roster, including these four providers, and claim payments could be processed by an MCO and go undetected by the Department. Cause: Two of the four providers initiated the provider enrollment process, but ultimately did not fully enroll. This situation caused the provider to appear as being contracted with MCO. The other two providers were terminated by an MCO in the spring of 2023, but the providers remained on the roster through the end of the term. The provider roster as of December 2023 was not updated to reflect these changes. Effect: We reviewed the fiscal year 2023 expenditure data and confirmed that there were no claimant payments made to these providers during fiscal year 2023. However, there is increased risk surrounding managed care eligibility due to the reliability of the provider roster. Recommendation: We recommend that the Department strengthen internal controls to ensure required documentation is maintained for Managed Care providers, including applicable licenses and certifications, provider agreements, and required disclosures to the State.   Management’s View: The Department agrees with the finding. While a provider cannot be reimbursed without an active contract or an executed single case agreement, we agree that it is best practice to have a provider directory reflective of active, enrolled and fully credentialed providers. The Division has two efforts underway to address this finding. Corrective Action: The 21st Century Cures Act requires all states to enroll both fee-for-service and managed care providers. Idaho Medicaid is currently out of compliance with this requirement for most of the providers within managed care contractor networks. The state is also working to come into compliance with a requirement in the Affordable Care Act to revalidate all enrolled providers at least every 5 years. The Division has begun the systems work necessary to come into compliance with both of these requirements and anticipates working through enrollment and revalidation activities into CY2025. Once completed, the Division will have an accurate and complete provider file that will be shared with contracted managed care plans to support their contracting efforts. Any providers who contract with the managed care plans will be required to be fully enrolled and credentialed with Idaho Medicaid before rendering services and billing. Pursuant to the Consolidated Appropriations Act of 2023, states are required by July 2025 to have a searchable and regularly updated provider directory for both managed care plans and fee-for-service programs. Idaho Medicaid is working to develop processes to validate directories and ensure that providers are providing updates to their information as necessary. Through this effort, Idaho Medicaid will further bolster internal processes and controls to ensure accurate provider network information is shared with Medicaid participants and maintained within our systems. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-223 Managed Care providers lacked documentation to support continued eligibility within the Medicaid Program. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR section 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. The Uniform Guidance included in 42 CFR section 455.412 states that the Medicaid State Plan gives assurance that the State Medicaid Agency has a method for verifying providers licensed by the State and that such provider licenses have not expired or have no current limitations. Condition: Managed Care Organizations (MCO) providers are monitored by the Bureau of Care Management using a provider roster. The Department receives and tracks the provider roster for all MCO annually. We noted four of the sixty-two managed care providers tested (6.5 percent) did not have documentation to support their provider eligibility; however, those providers were included in the roster as of December 2023. The Department was not able to provide documentation that these providers had the applicable licenses and certifications, entered into a provider agreement, and have made the required disclosures to the State. The four providers did not have an active contract with MCO during the period, nor did they have any claim payments associated with the provider. However, a Medicaid recipient could possibly utilize a provider from the roster, including these four providers, and claim payments could be processed by an MCO and go undetected by the Department. Cause: Two of the four providers initiated the provider enrollment process, but ultimately did not fully enroll. This situation caused the provider to appear as being contracted with MCO. The other two providers were terminated by an MCO in the spring of 2023, but the providers remained on the roster through the end of the term. The provider roster as of December 2023 was not updated to reflect these changes. Effect: We reviewed the fiscal year 2023 expenditure data and confirmed that there were no claimant payments made to these providers during fiscal year 2023. However, there is increased risk surrounding managed care eligibility due to the reliability of the provider roster. Recommendation: We recommend that the Department strengthen internal controls to ensure required documentation is maintained for Managed Care providers, including applicable licenses and certifications, provider agreements, and required disclosures to the State.   Management’s View: The Department agrees with the finding. While a provider cannot be reimbursed without an active contract or an executed single case agreement, we agree that it is best practice to have a provider directory reflective of active, enrolled and fully credentialed providers. The Division has two efforts underway to address this finding. Corrective Action: The 21st Century Cures Act requires all states to enroll both fee-for-service and managed care providers. Idaho Medicaid is currently out of compliance with this requirement for most of the providers within managed care contractor networks. The state is also working to come into compliance with a requirement in the Affordable Care Act to revalidate all enrolled providers at least every 5 years. The Division has begun the systems work necessary to come into compliance with both of these requirements and anticipates working through enrollment and revalidation activities into CY2025. Once completed, the Division will have an accurate and complete provider file that will be shared with contracted managed care plans to support their contracting efforts. Any providers who contract with the managed care plans will be required to be fully enrolled and credentialed with Idaho Medicaid before rendering services and billing. Pursuant to the Consolidated Appropriations Act of 2023, states are required by July 2025 to have a searchable and regularly updated provider directory for both managed care plans and fee-for-service programs. Idaho Medicaid is working to develop processes to validate directories and ensure that providers are providing updates to their information as necessary. Through this effort, Idaho Medicaid will further bolster internal processes and controls to ensure accurate provider network information is shared with Medicaid participants and maintained within our systems. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-223 Managed Care providers lacked documentation to support continued eligibility within the Medicaid Program. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR section 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. The Uniform Guidance included in 42 CFR section 455.412 states that the Medicaid State Plan gives assurance that the State Medicaid Agency has a method for verifying providers licensed by the State and that such provider licenses have not expired or have no current limitations. Condition: Managed Care Organizations (MCO) providers are monitored by the Bureau of Care Management using a provider roster. The Department receives and tracks the provider roster for all MCO annually. We noted four of the sixty-two managed care providers tested (6.5 percent) did not have documentation to support their provider eligibility; however, those providers were included in the roster as of December 2023. The Department was not able to provide documentation that these providers had the applicable licenses and certifications, entered into a provider agreement, and have made the required disclosures to the State. The four providers did not have an active contract with MCO during the period, nor did they have any claim payments associated with the provider. However, a Medicaid recipient could possibly utilize a provider from the roster, including these four providers, and claim payments could be processed by an MCO and go undetected by the Department. Cause: Two of the four providers initiated the provider enrollment process, but ultimately did not fully enroll. This situation caused the provider to appear as being contracted with MCO. The other two providers were terminated by an MCO in the spring of 2023, but the providers remained on the roster through the end of the term. The provider roster as of December 2023 was not updated to reflect these changes. Effect: We reviewed the fiscal year 2023 expenditure data and confirmed that there were no claimant payments made to these providers during fiscal year 2023. However, there is increased risk surrounding managed care eligibility due to the reliability of the provider roster. Recommendation: We recommend that the Department strengthen internal controls to ensure required documentation is maintained for Managed Care providers, including applicable licenses and certifications, provider agreements, and required disclosures to the State.   Management’s View: The Department agrees with the finding. While a provider cannot be reimbursed without an active contract or an executed single case agreement, we agree that it is best practice to have a provider directory reflective of active, enrolled and fully credentialed providers. The Division has two efforts underway to address this finding. Corrective Action: The 21st Century Cures Act requires all states to enroll both fee-for-service and managed care providers. Idaho Medicaid is currently out of compliance with this requirement for most of the providers within managed care contractor networks. The state is also working to come into compliance with a requirement in the Affordable Care Act to revalidate all enrolled providers at least every 5 years. The Division has begun the systems work necessary to come into compliance with both of these requirements and anticipates working through enrollment and revalidation activities into CY2025. Once completed, the Division will have an accurate and complete provider file that will be shared with contracted managed care plans to support their contracting efforts. Any providers who contract with the managed care plans will be required to be fully enrolled and credentialed with Idaho Medicaid before rendering services and billing. Pursuant to the Consolidated Appropriations Act of 2023, states are required by July 2025 to have a searchable and regularly updated provider directory for both managed care plans and fee-for-service programs. Idaho Medicaid is working to develop processes to validate directories and ensure that providers are providing updates to their information as necessary. Through this effort, Idaho Medicaid will further bolster internal processes and controls to ensure accurate provider network information is shared with Medicaid participants and maintained within our systems. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-223 Managed Care providers lacked documentation to support continued eligibility within the Medicaid Program. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR section 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. The Uniform Guidance included in 42 CFR section 455.412 states that the Medicaid State Plan gives assurance that the State Medicaid Agency has a method for verifying providers licensed by the State and that such provider licenses have not expired or have no current limitations. Condition: Managed Care Organizations (MCO) providers are monitored by the Bureau of Care Management using a provider roster. The Department receives and tracks the provider roster for all MCO annually. We noted four of the sixty-two managed care providers tested (6.5 percent) did not have documentation to support their provider eligibility; however, those providers were included in the roster as of December 2023. The Department was not able to provide documentation that these providers had the applicable licenses and certifications, entered into a provider agreement, and have made the required disclosures to the State. The four providers did not have an active contract with MCO during the period, nor did they have any claim payments associated with the provider. However, a Medicaid recipient could possibly utilize a provider from the roster, including these four providers, and claim payments could be processed by an MCO and go undetected by the Department. Cause: Two of the four providers initiated the provider enrollment process, but ultimately did not fully enroll. This situation caused the provider to appear as being contracted with MCO. The other two providers were terminated by an MCO in the spring of 2023, but the providers remained on the roster through the end of the term. The provider roster as of December 2023 was not updated to reflect these changes. Effect: We reviewed the fiscal year 2023 expenditure data and confirmed that there were no claimant payments made to these providers during fiscal year 2023. However, there is increased risk surrounding managed care eligibility due to the reliability of the provider roster. Recommendation: We recommend that the Department strengthen internal controls to ensure required documentation is maintained for Managed Care providers, including applicable licenses and certifications, provider agreements, and required disclosures to the State.   Management’s View: The Department agrees with the finding. While a provider cannot be reimbursed without an active contract or an executed single case agreement, we agree that it is best practice to have a provider directory reflective of active, enrolled and fully credentialed providers. The Division has two efforts underway to address this finding. Corrective Action: The 21st Century Cures Act requires all states to enroll both fee-for-service and managed care providers. Idaho Medicaid is currently out of compliance with this requirement for most of the providers within managed care contractor networks. The state is also working to come into compliance with a requirement in the Affordable Care Act to revalidate all enrolled providers at least every 5 years. The Division has begun the systems work necessary to come into compliance with both of these requirements and anticipates working through enrollment and revalidation activities into CY2025. Once completed, the Division will have an accurate and complete provider file that will be shared with contracted managed care plans to support their contracting efforts. Any providers who contract with the managed care plans will be required to be fully enrolled and credentialed with Idaho Medicaid before rendering services and billing. Pursuant to the Consolidated Appropriations Act of 2023, states are required by July 2025 to have a searchable and regularly updated provider directory for both managed care plans and fee-for-service programs. Idaho Medicaid is working to develop processes to validate directories and ensure that providers are providing updates to their information as necessary. Through this effort, Idaho Medicaid will further bolster internal processes and controls to ensure accurate provider network information is shared with Medicaid participants and maintained within our systems. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-224 The required audited financial reports were not collected as required to ensure compliance with the Managed Care Organization contracts. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR Section 438.3(m) requires the contract with Managed Care Organizations (MCO) to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all four MCO contracts that were active during fiscal year 2023. We noted that 3 out of 4 Managed Care Organization’s contracts tested did not have specific clauses clearly requiring the MCO to submit an audited financial report as required by 42 CFR Section 438.3(m). In addition, three of the four (or 75 percent) audited financial reports were not submitted until after the current single audit inquiry about the reports occurred. Cause: The contracts were not clearly written to directly require the MCO to submit an audited financial report. The Bureau of Care Management stated that the MCOs were not contractually obligated to submit the audited financial reports. However, the Department is obligated to comply with federal requirements, and we found a reference to the 42 CFR Section 438.3(m) requirement in two of the four MCO contracts, which would indicate some knowledge that the grantor required audited financial statements. However, only one of the contracts included the clear specific requirements included in the 42 CFR Section 438.3(m). The Department requested the reports from the MCOs after receiving the request for the reports from our auditors. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules and regulations. Collecting these reports, and reviewing them, provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCOs. Additionally, the Department is not in compliance with federal requirements to collect these reports. Recommendation: We recommend that the Department amend the MCO contracts to include a requirement to submit audited financial reports on an annual basis and design and implement internal controls to monitor the receipt and review of the reports. Management’s View: The Department agrees with the finding. Corrective Action: The Division will amend all current managed care contracts to include the requirement to submit an audited financial report annually. This contract language will also be incorporated into all future Medicaid managed care procurements. The Division will also review and confirm all required contract elements outlined in 42 CFR 438.3 are clearly outlined in Medicaid managed care contracts. Lastly, the Division intends to coordinate with the Department of Insurance to learn more about their review process of audited financial statements and determine if there is an opportunity to coordinate oversight efforts for Medicaid managed care contracts going forward. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-224 The required audited financial reports were not collected as required to ensure compliance with the Managed Care Organization contracts. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR Section 438.3(m) requires the contract with Managed Care Organizations (MCO) to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all four MCO contracts that were active during fiscal year 2023. We noted that 3 out of 4 Managed Care Organization’s contracts tested did not have specific clauses clearly requiring the MCO to submit an audited financial report as required by 42 CFR Section 438.3(m). In addition, three of the four (or 75 percent) audited financial reports were not submitted until after the current single audit inquiry about the reports occurred. Cause: The contracts were not clearly written to directly require the MCO to submit an audited financial report. The Bureau of Care Management stated that the MCOs were not contractually obligated to submit the audited financial reports. However, the Department is obligated to comply with federal requirements, and we found a reference to the 42 CFR Section 438.3(m) requirement in two of the four MCO contracts, which would indicate some knowledge that the grantor required audited financial statements. However, only one of the contracts included the clear specific requirements included in the 42 CFR Section 438.3(m). The Department requested the reports from the MCOs after receiving the request for the reports from our auditors. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules and regulations. Collecting these reports, and reviewing them, provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCOs. Additionally, the Department is not in compliance with federal requirements to collect these reports. Recommendation: We recommend that the Department amend the MCO contracts to include a requirement to submit audited financial reports on an annual basis and design and implement internal controls to monitor the receipt and review of the reports. Management’s View: The Department agrees with the finding. Corrective Action: The Division will amend all current managed care contracts to include the requirement to submit an audited financial report annually. This contract language will also be incorporated into all future Medicaid managed care procurements. The Division will also review and confirm all required contract elements outlined in 42 CFR 438.3 are clearly outlined in Medicaid managed care contracts. Lastly, the Division intends to coordinate with the Department of Insurance to learn more about their review process of audited financial statements and determine if there is an opportunity to coordinate oversight efforts for Medicaid managed care contracts going forward. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-224 The required audited financial reports were not collected as required to ensure compliance with the Managed Care Organization contracts. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR Section 438.3(m) requires the contract with Managed Care Organizations (MCO) to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all four MCO contracts that were active during fiscal year 2023. We noted that 3 out of 4 Managed Care Organization’s contracts tested did not have specific clauses clearly requiring the MCO to submit an audited financial report as required by 42 CFR Section 438.3(m). In addition, three of the four (or 75 percent) audited financial reports were not submitted until after the current single audit inquiry about the reports occurred. Cause: The contracts were not clearly written to directly require the MCO to submit an audited financial report. The Bureau of Care Management stated that the MCOs were not contractually obligated to submit the audited financial reports. However, the Department is obligated to comply with federal requirements, and we found a reference to the 42 CFR Section 438.3(m) requirement in two of the four MCO contracts, which would indicate some knowledge that the grantor required audited financial statements. However, only one of the contracts included the clear specific requirements included in the 42 CFR Section 438.3(m). The Department requested the reports from the MCOs after receiving the request for the reports from our auditors. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules and regulations. Collecting these reports, and reviewing them, provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCOs. Additionally, the Department is not in compliance with federal requirements to collect these reports. Recommendation: We recommend that the Department amend the MCO contracts to include a requirement to submit audited financial reports on an annual basis and design and implement internal controls to monitor the receipt and review of the reports. Management’s View: The Department agrees with the finding. Corrective Action: The Division will amend all current managed care contracts to include the requirement to submit an audited financial report annually. This contract language will also be incorporated into all future Medicaid managed care procurements. The Division will also review and confirm all required contract elements outlined in 42 CFR 438.3 are clearly outlined in Medicaid managed care contracts. Lastly, the Division intends to coordinate with the Department of Insurance to learn more about their review process of audited financial statements and determine if there is an opportunity to coordinate oversight efforts for Medicaid managed care contracts going forward. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-224 The required audited financial reports were not collected as required to ensure compliance with the Managed Care Organization contracts. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR Section 438.3(m) requires the contract with Managed Care Organizations (MCO) to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all four MCO contracts that were active during fiscal year 2023. We noted that 3 out of 4 Managed Care Organization’s contracts tested did not have specific clauses clearly requiring the MCO to submit an audited financial report as required by 42 CFR Section 438.3(m). In addition, three of the four (or 75 percent) audited financial reports were not submitted until after the current single audit inquiry about the reports occurred. Cause: The contracts were not clearly written to directly require the MCO to submit an audited financial report. The Bureau of Care Management stated that the MCOs were not contractually obligated to submit the audited financial reports. However, the Department is obligated to comply with federal requirements, and we found a reference to the 42 CFR Section 438.3(m) requirement in two of the four MCO contracts, which would indicate some knowledge that the grantor required audited financial statements. However, only one of the contracts included the clear specific requirements included in the 42 CFR Section 438.3(m). The Department requested the reports from the MCOs after receiving the request for the reports from our auditors. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules and regulations. Collecting these reports, and reviewing them, provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCOs. Additionally, the Department is not in compliance with federal requirements to collect these reports. Recommendation: We recommend that the Department amend the MCO contracts to include a requirement to submit audited financial reports on an annual basis and design and implement internal controls to monitor the receipt and review of the reports. Management’s View: The Department agrees with the finding. Corrective Action: The Division will amend all current managed care contracts to include the requirement to submit an audited financial report annually. This contract language will also be incorporated into all future Medicaid managed care procurements. The Division will also review and confirm all required contract elements outlined in 42 CFR 438.3 are clearly outlined in Medicaid managed care contracts. Lastly, the Division intends to coordinate with the Department of Insurance to learn more about their review process of audited financial statements and determine if there is an opportunity to coordinate oversight efforts for Medicaid managed care contracts going forward. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-225 Review of federal suspension and debarment status is not adequately performed or documented to demonstrate compliance with the federal requirements for the Coronavirus State and Local Fiscal Recovery Funds program. Type of Finding: Significant Deficiency Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 2 CFR Part 180.300) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Also, 2 CFR 200.303 requires that the Department establish and maintain effective internal control over the federal award that provides reasonable assurance that the Department is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: During fiscal year 2023, the Department completed covered transactions and later verified that a vendor was not suspended or debarred when quarterly reporting was submitted to the Division of Financial Management (DFM). To document this verification, the Department listed the unique entity identifier (UEI) number on an excel workbook. However, this verification was performed after payments had been made to these vendors. Cause: The Department did not consider completing this verification prior to issuing payment and properly documenting the verification, such as printing a report or some other form of documentation to confirm that a check had been performed, since they are able to review this verification at any time. The Department did not consider any vendor to be a significant risk and indicated the timing of the check issuance, which was also impacted by the implementation of Luma (new ERP system) and staffing issues, may have factored into the late verification. Effect: We did not identify suspended or debarred vendors receiving federal funds during our testing. However, the Department does not have procedures in place to identify a suspended or debarred vendor prior to issuance of payment. Performing a verification after payment creates a risk that the Department may enter into covered transactions with suspended and debarred parties. Recommendation: We recommend that the Department ensure that sufficient documentation is maintained to comply with the suspension and debarment requirements and that a verification is performed before any payment is issued. Management’s View: The Department agrees with this finding. Corrective Action: In response to the Internal Control Deficiency identified as "Finding 1" in your letter, we have already implemented the following corrective action plan. 1. Our Development Bureau has revised their "Notice of Intent to Award" letter to include the collection of the Federally issued Unique Entity ID (UEI) for all projects funded with Federal funds. 2. The UEI information will be used to check the proposed contractor's exclusion status on the System for Award Management (SAM.gov) website and a printed report, or a printed screen shot of the exclusion status will be preserved prior to issuing the contract. 3. The person responsible for ensuring that this plan is followed is our Financial Officer, Steve Martin who can be reached by telephone at 208.514.2460, or by email at steve.martin@idpr.idaho.gov. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-226 The Department did not develop and execute a Value Engineering work plan in compliance with the regulations for the federal Highway Planning and Construction grant. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Highway Planning and Construction Grant Assistance Listing Number: 20.205 Federal Award Number: Various Program Year: Various Federal Agency: Department of Transportation Compliance Requirement: Special Tests – Value Engineering Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Title 23, Part 627 contains the regulations for Value Engineering (VE). Subsection c of 23 CFR part 627.7 states, “STAs (State Transportation Agencies) shall designate a VE Program Coordinator to promote and advance VE program activities and functions. The VE Coordinator's responsibilities should include establishing and maintaining the STA's VE policies and procedures; facilitating VE training; ensuring VE analyses are conducted on applicable projects; monitoring, assessing, and reporting on the VE analyses conducted and VE program; participating in periodic VE program and project reviews; submitting the required annual VE report to the Federal Highway Administration (FHWA); and supporting the other elements of the VE program.” The Department’s Value Engineering Manual contains the policies and procedures for the VE program. Section 1.4 of the manual contains the policies for the Statewide Value Engineering Work Plan and states, “The Districts are responsible to develop and execute an annual Value Engineering Work Plan. Upon completion of the Draft State Transportation Improvement Plan (STIP), the districts will identify projects that require VE studies and select additional projects for VE studies. The districts will also select the timing and schedule to complete VE studies for their district. The Statewide VE Work Plan will be compiled annually by the Headquarters (HQ) VE Coordinator upon submittal by the districts. The HQ VE Coordinator will prepare and submit an annual Value Engineering Program Summary Report to FHWA.” Section 6 of the Department’s VE manual, titled Reporting/Tracking, states, “The VE coordinator shall be responsible for monitoring program compliance and annually reporting to FHWA. Value engineering operations will be monitored for compliance with the policies, procedures and standards identified in the preceding sections. Specific areas to be monitored include District Value Engineering work plan and schedule, District Value Engineering accomplishments (accepted cost savings, return-on-investment, functional enhancements), documentation of value engineering activities, Economic analysis methods being used in cost/benefit determinations for project decisions, compliance with the provisions of the Value Engineering procedures.” Finally, 2 CFR 200.303 requires the Department to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Department is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: While developing our understanding of the VE program, we found that the procedures described in the Department’s VE manual to monitor the Department’s VE programs were not being followed. The requirement to develop and execute a VE work plan has not been completed in the past two years, and the Department does not have a formal process for ensuring that the annual VE reporting to FHWA is completed. Cause: The Department was not aware of the CFR requirement to establish, maintain, and follow Value Engineering policies and procedures. The Department did not have a procedure to ensure the annual VE report was submitted to the FHWA and waited for the FHWA to request it. Effect: The goals of VE analysis are to ensure that projects are providing the needed functions while considering community and environmental commitments, safety, reliability, efficiency, overall life cycle, optimizing value and quality, and reducing the time to develop and deliver the project. Without an effective VE work plan in place, there is a risk that these goals will not be met. Recommendation: We recommend that the Department implement controls for monitoring and assessment of the Value Engineering Program to ensure the VE guidelines are being followed. Management’s View: The Idaho Transportation Department (ITD) concurs with the audit finding and recommendation. Corrective Action: ITD will develop a new standard operating procedure (SOP) to follow to ensure that the Districts develop an Annual Value Engineering Work Plan and that the Statewide Work Plan is compiled annually by the Headquarters Value Engineering Coordinator. This SOP will be developed in collaboration with FHWA staff to ensure 2 CFR 200.303 and 23 CFR Part 627 compliance. The SOP will include details as to who, what, where and when the specific tasks will occur so to provide clarity and control with regard to developing the work plan as well as monitoring, assessing and reporting on the Departments Value Engineering Program. The new SOP will be developed prior to FFY 2025, and statewide outreach and education will follow shortly thereafter. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-226 The Department did not develop and execute a Value Engineering work plan in compliance with the regulations for the federal Highway Planning and Construction grant. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Highway Planning and Construction Grant Assistance Listing Number: 20.205 Federal Award Number: Various Program Year: Various Federal Agency: Department of Transportation Compliance Requirement: Special Tests – Value Engineering Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Title 23, Part 627 contains the regulations for Value Engineering (VE). Subsection c of 23 CFR part 627.7 states, “STAs (State Transportation Agencies) shall designate a VE Program Coordinator to promote and advance VE program activities and functions. The VE Coordinator's responsibilities should include establishing and maintaining the STA's VE policies and procedures; facilitating VE training; ensuring VE analyses are conducted on applicable projects; monitoring, assessing, and reporting on the VE analyses conducted and VE program; participating in periodic VE program and project reviews; submitting the required annual VE report to the Federal Highway Administration (FHWA); and supporting the other elements of the VE program.” The Department’s Value Engineering Manual contains the policies and procedures for the VE program. Section 1.4 of the manual contains the policies for the Statewide Value Engineering Work Plan and states, “The Districts are responsible to develop and execute an annual Value Engineering Work Plan. Upon completion of the Draft State Transportation Improvement Plan (STIP), the districts will identify projects that require VE studies and select additional projects for VE studies. The districts will also select the timing and schedule to complete VE studies for their district. The Statewide VE Work Plan will be compiled annually by the Headquarters (HQ) VE Coordinator upon submittal by the districts. The HQ VE Coordinator will prepare and submit an annual Value Engineering Program Summary Report to FHWA.” Section 6 of the Department’s VE manual, titled Reporting/Tracking, states, “The VE coordinator shall be responsible for monitoring program compliance and annually reporting to FHWA. Value engineering operations will be monitored for compliance with the policies, procedures and standards identified in the preceding sections. Specific areas to be monitored include District Value Engineering work plan and schedule, District Value Engineering accomplishments (accepted cost savings, return-on-investment, functional enhancements), documentation of value engineering activities, Economic analysis methods being used in cost/benefit determinations for project decisions, compliance with the provisions of the Value Engineering procedures.” Finally, 2 CFR 200.303 requires the Department to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Department is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: While developing our understanding of the VE program, we found that the procedures described in the Department’s VE manual to monitor the Department’s VE programs were not being followed. The requirement to develop and execute a VE work plan has not been completed in the past two years, and the Department does not have a formal process for ensuring that the annual VE reporting to FHWA is completed. Cause: The Department was not aware of the CFR requirement to establish, maintain, and follow Value Engineering policies and procedures. The Department did not have a procedure to ensure the annual VE report was submitted to the FHWA and waited for the FHWA to request it. Effect: The goals of VE analysis are to ensure that projects are providing the needed functions while considering community and environmental commitments, safety, reliability, efficiency, overall life cycle, optimizing value and quality, and reducing the time to develop and deliver the project. Without an effective VE work plan in place, there is a risk that these goals will not be met. Recommendation: We recommend that the Department implement controls for monitoring and assessment of the Value Engineering Program to ensure the VE guidelines are being followed. Management’s View: The Idaho Transportation Department (ITD) concurs with the audit finding and recommendation. Corrective Action: ITD will develop a new standard operating procedure (SOP) to follow to ensure that the Districts develop an Annual Value Engineering Work Plan and that the Statewide Work Plan is compiled annually by the Headquarters Value Engineering Coordinator. This SOP will be developed in collaboration with FHWA staff to ensure 2 CFR 200.303 and 23 CFR Part 627 compliance. The SOP will include details as to who, what, where and when the specific tasks will occur so to provide clarity and control with regard to developing the work plan as well as monitoring, assessing and reporting on the Departments Value Engineering Program. The new SOP will be developed prior to FFY 2025, and statewide outreach and education will follow shortly thereafter. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-216 The Department did not have appropriate documentation to support allowability of transactions for the Foster Care Title IV-E program. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Costs Principles Questioned Costs: Known $4,555; Projected $213,387 Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 U.S. Code (USC) 675(4)(A) states that the term “foster care maintenance payments” means payments to cover the cost of (and the cost of providing) food, clothing, shelter, daily supervision, school supplies, a child’s personal incidentals, liability insurance with respect to a child, reasonable travel to the child’s home for visitation, and reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement. The Uniform Guidance included in 45 CFR 1356.60(c)(3) states that allowable administrative costs do not include the costs of social services provided to the child, the child's family or foster family, which provide counseling or treatment to ameliorate or remedy personal problems, behaviors, or home conditions. The Uniform Guidance states that costs claimed as foster maintenance payments that include medical, educational (except for school supplies and the cost of reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement in foster care), or other expenses not outlined in 42 USC 675(4)(A) are unallowed. Condition: We tested 61 expenditure transactions charged to the Foster Care - Title IV-E program. The sample included 4 expenditures that were for unallowable costs charged to the program or that were missing supporting documentation making it difficult to determine if the costs were allowable. We also identified one transaction that did not have evidence of review and approval prior to payment but appears to be for an allowable expenditure. The details for the 5 of 61, or 8 percent, transactions with exceptions is as follows: 1) We determined that 2 out of 61 transactions tested (or 3.2 percent) were unallowable. The first transaction was paid for the family therapy service. The total cost was $206. This type of activity is specifically unallowable under 45 CFR 1356.60(c)(3). The second transaction was paid for an intensive reading program for a child. The total cost was $3,200. This type of activity is unallowable under 42 USC 675(4)(A), which only allows for educational activities for school supplies and the cost of reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement in foster care. 2) For 2 out of 61 transactions tested (or 3.2 percent), we were not able to determine allowability due to missing support documentation. For the first transaction, we were unable to determine the purpose for a car rental and gasoline purchase totaling $780. The supporting documentation did not include enough detail to ensure allowability. For the second transaction, we were unable to determine the purpose and allowability for a travel expenditure totaling $349. The supporting documentation for the purchase of an airline ticket did not include a travel voucher or agenda. 3) The review and approval of 1 out of 61 transactions tested (or 1.6 percent) was not documented. The transaction totaled $61. Cause: The Department could not locate additional support documentation to justify the payments. In addition, the Department did not consider that additional support should be retained to ensure compliance. The Department considered the activities for the family therapy services and the intensive reading program as allowable. Effect: Federal funds were expended for unallowable activities. The total for unallowable activities and activities lacking supporting documentation was $4,555. The total projected questioned costs for allowable activities are $213,387. Further, other expenditures in our sample did not have appropriate supporting documentation which increases the likelihood of additional unallowable activities. Recommendation: We recommend that the Department strengthen internal control procedures to ensure that expenditures are allowable and that sufficient documentation is retained to support that determination. Management’s View: The Department agrees with the finding. Corrective Action: A new feature was added to ESPI on 1/9/24 to record the reason (purpose) for certain service types, including transportation. The system is programmed to disallow Title IV-E if the reason listed does not meet IV-E eligibility criteria (see image below). An additional control will be added to the system to have the same control procedure used for a medical service type and education service type. Further development is underway for additional control procedures and should be completed by April of 2025. P-card transactions do not process through ESPI. Quarterly reports will be obtained to review any P-card transactions that utilized Title IV-E to confirm appropriate documentation is on record. This will be completed by April 30, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-217 The Department does not have documented internal controls for adjustments processed to the Foster Care -Title IV—E program. Type of Finding: Material Weakness Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Foster Care - Title IV-E program maintenance payments are processed through the Ensuring Safety & Permanency in Idaho system (ESPI). Those payments include recurring, non-recurring, and adjustment transactions. Adjustments transactions are processed by the Department’s program personnel on a monthly basis. Adjustments are a function of the pace at which the Department is able to obtain the documents and information for eligibility determinations. Court documents can take extended periods to obtain. In addition, the intermittent nature of child support payments also drives adjustments in the program. We were not able to identify documented internal controls over the adjustment transactions for 60 out of 62 adjustment transactions (or 96.7 percent) that were processed through ESPI. Cause: The review and approval over the adjustment transactions were not documented within the program software. Effect: We did not identify any substantive or compliance errors during testing over adjustment transactions. However, without documentation of a review and approval, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department design and implement internal controls to document the review and approval of the adjustment transactions processed in ESPI. Management’s View: The Department agrees with the finding. Corrective Action: The Department will continue to record adjustment activity through Help Desk tickets, SharePoint documentation, and ESPI. The Department will ensure improved visibility to the adjustment and approval process and documentation by ensuring all roles who need access (including auditors), have access to all relevant systems and storage locations such as access to SharePoint and Help Desk tickets. This step will be completed by April 30, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-218 The Department failed to provide necessary documentation to support the eligibility determination for two foster care providers within the Foster Care -Title IV—E program. Type of Finding: Noncompliance Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Questioned Costs: Known $884; Projected $126,091 Criteria: Federal law 42 U.S. Code (USC) 672(b) states that foster care maintenance payments may be made under this part only on behalf of a child described in subsection (a) of this section who is: (1) in the foster family home of an individual, whether the payments therefor are made to such individual or to a public or private child-placement or child-care agency, or (2) in a child-care institution, whether the payments therefor are made to such institution or to a public or private child-placement or child-care agency, which payments shall be limited so as to include in such payments only those items which are included in the term “foster care maintenance payments” (as defined in section 475(4)).   Federal Law 42 USC 672(c) defines a foster family home as: (A) In general. The term “foster family home” means the home of an individual or family: (i) that is licensed or approved by the State in which it is situated as a foster family home that meets the standards established for the licensing or approval, and (ii) in which a child in foster care has been placed in the care of an individual, who resides with the child and who has been licensed or approved by the State to be a foster parent (I) that the State deems capable of adhering to the reasonable and prudent parent standard, (II) that provides 24-hour substitute care for children placed away from their parents or other caretakers, and (III) that provides the care for not more than six children in foster care. The Uniform Guidance included in 42 USC 671(a)(20)(A) states that the foster family home provider must have satisfactorily met a criminal records check, including a fingerprint-based check with respect to prospective foster and adoptive parents. The Uniform Guidance included in 42 USC 671(a)(20)(B) states that a Title IV-E agency must check, or request a check of, a state-maintained child abuse and neglect registry in each state the prospective foster and adoptive parent(s) and any other adult(s) living in the home have resided in the preceding five years before the State can license or approve a prospective foster or adoptive parent. Condition: During our review of the eligibility determination for foster care providers, the Department could not locate the foster home license documentation for 2 out of 65 foster homes reviewed (or 3 percent). For those same 2 foster homes, child abuse and neglect registry checks were not provided, and for 1 of those 2 foster homes a criminal record check and a fingerprint-based check were not provided. Cause: The Department was unable to locate the proper backup eligibility documentation. In addition, the Department mentioned that this situation was caused by the migration of data from an old system, iCare, to the new system, Ensuring Safety & Permanency in Idaho (ESPI), which was fully implemented on November 26, 2020. Effect: Foster families could be receiving subsidies without proper licensing and without passing background checks, fingerprint-based checks, and child abuse and neglect checks. This also increases the risk to the safety of the children placed in these homes. The total amount associated with the exceptions noted was $884. The total projected questioned costs for eligibility items are $126,091. Recommendation: We recommend that the Department design procedures to ensure that background, fingerprint-based, and child abuse and neglect checks are completed and properly maintained for Foster Care -Title IV—E eligibility determinations. Management’s View: The Department agrees with this finding. Corrective Action: The department agrees with the finding related to the critical importance of obtaining and maintaining documentation for all necessary background checks. Although the department was ultimately able to verify background checks were completed, we agree that we were unable to readily pull the needed documentation on these in a timely manner. To correct the issue, the department will add an additional point of verification that the Enhanced Criminal History Background Check clearance letter from the Background Check Unit’s system is uploaded to eCabinet, by having supervisors view the document within eCabinet prior to approving the initial foster care license. Supervisors will also confirm that all ICPC home studies address results of background checks for all adults in the home and any additional potential caregivers. This will be completed April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.