Audit 305129

2023-039 Oregon Health Authority Ensure program payroll costs are incurred only for program staff Federal Awarding Agency: U.S. Department of Agriculture Assistance Listing Number and Name: 10.557 Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Federal Award Numbers and Years: 237OROR7W1003, 2023; 237OROR7W1006, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $18,002 (known) Criteria: 2 CFR 200.413(b) Federal regulations permit costs charged directly to a Federal award, such as compensation of employees who work on that award and their related fringe benefit costs. Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) management is responsible for ensuring employees with payroll related costs charged directly to the Federal award are employees who work on that award. From a population of 550 monthly payroll costs for 57 employees, we randomly selected a sample of 25 to verify monthly time was approved by management and employees directly work on the WIC award. We found one employee who should not have recorded payroll costs to the WIC program, as the employee was on a job rotation outside the program. The employee’s time was properly approved, but the review did not identify the costs were charged to program. We reviewed all payroll related costs for the employee and identified questioned costs of $7,970 for fiscal year 2023. We expanded our review and identified two additional employees who were charging their time to the WIC program inappropriately, resulting in total actual questioned costs of $18,002. We recommend program management implement additional internal controls over payroll related costs to ensure all costs charged to the program are related to employees who work directly on the award.

2023-015 Oregon Housing and Community Services Fully implement controls to ensure subrecipients are in compliance with program requirements Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Equipment and Real Property Management; Matching, Level of Effort, Earmarking; Procurement, Suspension, and Debarment, Special Tests and Provisions Type of Finding: Material Weakness Prior Year Findings: 2022-018, 2022-019, 2022-020, 2022-021, 2022-024 Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 2 CFR 200.311; 2 CFR 200.313; 2 CFR 200.317 - .327; 24 CFR 576.100; 24 CFR 576.101(c); 24 CFR 576.102(c) The Emergency Solutions Grants (ESG/ESG-CV) program is operated by the department via pass-through funds to subrecipients. With the significant influx of pandemic relief funds, the department expanded the number of subrecipients partnered with from 17 longstanding community action agencies (CAAs) to a total of 45 CAA and non-CAA subrecipients. During fiscal year 2023, 98% of program expenditures were passed through to 40 of these subrecipients. Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance program expenditures are in compliance with the terms and conditions of the federal award. However, the significant increases to federal funding the creation and implementation of a new award system for non-CAA recipients, and the increase in the number of subrecipients, along with a period of high employee turnover led to delays in the department’s development and implementation of sufficient subrecipient monitoring processes that would meet this objective. Department management subsequently contracted with a private auditing firm to assist in the monitoring of the program activities and expenditures of funds passed through to the subrecipients to remedy the noted control weaknesses. Department staff and the private auditing firm are currently working through the monitoring backlog. However, at the time of the audit, monitoring of only 16 of the 40 subrecipients had been completed which represents 58% of the fiscal year 2023 pass-through expenditures. Additionally, the completed monitoring was only performed over fiscal year 2022 expenditures as the department works to catch up on monitoring of prior year expenditures. Incomplete monitoring could lead to program noncompliance. We recommend department management complete the review and monitoring of program funds passed through to subrecipients for compliance with all applicable program requirements.

2023-016 Oregon Housing and Community Services Verification that subrecipients have not been suspended or debarred needs to be retained Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirements: Procurement and Suspension and Debarment Type of Finding: Material Weakness Prior Year Finding: 2022-022 Questioned Costs: N/A Criteria: 2 CFR 200.317 - .327 The prior-year audit noted that procurement processes were not followed. Specifically, evidence the department verified non-community action agencies receiving Emergency Solutions Grant Program and ESG-CV money were not suspended or debarred was not retained. During the audit, we attempted to review the suspension and debarment status of those entities that had received ESG and ESG-CV funds in 2023. We found the department did not retain evidence the suspension and debarment status of subrecipients was verified. Management stated this was due to the contracts being executed prior to fiscal year 2023. Due to employee turnover, it was unclear whether the verifications had not been performed or documentation had not been retained. Current procurement staff have since developed procedures to ensure future compliance with suspension and debarment requirements. We recommend department management perform and retain evidence of checks of suspension and debarment for all new and existing contracts.

2023-045 Oregon Housing and Community Services Obtain documentation to support expenditures or pursue cost recovery Federal Awarding Agency: U.S. Department of Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance (COVID-19) Federal Award Numbers and Years: ERA 1, 2021 (COVID-19); ERA 2, 2021 (COVID-19) Compliance Requirements: Activities Allowed or Unallowed, Eligibility, Period of Performance Type of Finding: Noncompliance Prior Year Finding: N/A Questioned Costs: $96,624 (known) Criteria: 2 CFR 200.332(d); 2 CFR 200.501(g) Department management is responsible for monitoring the activities of subrecipients to ensure subawards are used for authorized purposes and are compliant with federal requirements. Additionally, department management is responsible for ensuring compliance when a contractor is responsible for program compliance. The department passed through funds to 17 community action agencies (subrecipients) and a third-party vendor (contractor) to provide program delivery. Program delivery included determining client eligibility and making payments for direct client assistance for rent, utilities, internet, and other housing related costs. During the fiscal year, the department performed program reviews for each of the subrecipients and the contractor to determine whether funds were paid to eligible clients for allowable activities. We selected eight subrecipient program reviews and the contractor review for testing. The department reviewed 175 client applications that were processed and approved for payment across the eight selected subrecipients. We reviewed the department’s program monitoring reports and identified 91 client applications with potential exceptions related to federal requirements. Our testing found 67 client applications with exceptions totaling $74,857 in questioned costs. The department reviewed a total of 60 individual client applications processed and approved for payment by the contractor. We reviewed the department’s program monitoring report and identified 16 client applications with potential exceptions related to federal requirements. Our testing found five client applications with exceptions totaling $21,767 in questioned costs. The majority of exceptions were due to a lack of sufficient documentation being maintained to ensure assistance was only provided to eligible clients for allowable costs within the applicable time period. We recommend department management coordinate with their subrecipients and contractor to obtain additional documentation to ensure compliance with federal requirements or to recover amounts paid that are not in compliance with federal requirements.

2023-044 Oregon Housing and Community Services Ensure that the nature of program applicants' financial hardship is documented Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.026 Homeowner’s Assistance Fund (COVID-19) Federal Award Numbers and Years: HAF0027, 2023 (COVID-19) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: U.S. Department of the Treasury Homeowners Assistance Fund: Guidance on Participant Compliance and Reporting Responsibilities (dated 5/9/22 and revised 1/12/24); Homeowners Assistance Fund Guidance (dated 6/12/23) Prior to disbursing Homeowners’ Assistance Fund (HAF) awards, the Department is required to obtain and document applicants’ attestations that they have endured a financial hardship due to the pandemic. Additionally, the attestations must include a description of the nature of the applicants’ financial hardship (e.g. loss/reduction of income or risk of home foreclosure). The Department requires pre-qualification checklists to be completed during the application process to ensure, in addition to several other requirements, that the applicants’ attestations of financial hardship due to the pandemic are obtained. In our testing of HAF eligibility compliance requirements, we randomly selected 40 HAF applicants that received program assistance from the department during fiscal year 2023. We found that for three sample items, while pre-qualification checklists were completed and attestations of financial hardship were obtained, program staff did not ensure a description of the nature of applicants’ financial hardship was documented. However, no income determination exceptions were identified; all applicants tested were under the program income limit. Not requiring and documenting the nature of the financial hardship could result in program benefits being awarded to ineligible applicants. We recommend management implement controls to ensure that the nature of HAF applicants’ financial hardship is documented as required by federal guidance.

2023-043 Oregon Business Development Department Management should implement accounting review of quarterly reports before submitting to DAS Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR § 200.303(a) Recipients of Coronavirus State and Local Fiscal Recovery Funds (SLFRF) are required to provide quarterly project and expenditure reports to the Department of Administrative Services (DAS) who then compile the information and submit it to the US Department of Treasury. Each report contains detailed project information, including current period obligation, cumulative obligation, current period expenditure, and cumulative expenditure. Department management is responsible for establishing and maintaining effective internal controls that provide reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. The department’s reporting process did not include a review by accounting staff to ensure reports included all activity of the reporting period and agreed to accounting records. As a result, reports were submitted to DAS with inaccurate information resulting in reporting errors. Failure to report accurate expenditures and obligations could result in a loss of SLFRF funds. We recommend the department include an accounting review of SLFRF reports prior to submitting to DAS.

2023-028 Department of Human Services Strengthen controls to ensure adequate supporting documentation and accuracy over reporting Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220054, 2022; H126A230054, 2023 Compliance Requirement: Reporting Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 29 USC 721(a)(10); 2 CFR 200.303 The department is required to submit quarterly performance and financial program reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment (IPE), services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. The Vocational Rehabilitation Financial Report (RSA-17) is a quarterly report of cumulative VR financial data on an award by award basis. Federal regulations require financial reports include all activity of the reporting period and be supported by applicable accounting records. We reviewed 15 out of 24,176 clients from the September 2022 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we identified the following: • Three clients receiving pre-employment transition services without documentation supporting the type of service provided. • The date of application reported for two clients did not agree to supporting documentation. • The date of eligibility determination for two clients did not agree to supporting documentation. Additionally, the department could not provide documentation to support the date of eligibility determination for a third client. • The department could not provide documentation for three clients to support the start date of employment in primary occupation. • The department could not provide documentation for five clients to support the hourly wage at exit. In fiscal year 2023, eight RSA-17 reports were submitted for fiscal year 2023; two were selected for review. During our testing, we identified one report did not provide the appropriate federal share of allowable expenditures, overstating the line item by $2,859,149. Without maintaining supporting documentation that substantiates the accuracy of the case information reported, the agency may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 and RSA-17 reports are used by the Federal government to evaluate and monitor the financial and programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. We recommend department management strengthen internal controls to ensure adequate supporting documentation is maintained to support information reported in the RSA-911 client case information report. We also recommend department management strengthen internal controls to ensure the reviews of the RSA-17 financial report are documented and the report contains accurate information.

2023-029 Department of Human Services Strengthen controls over program expenditures Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220054, 2022; H126A230054, 2023 Compliance Requirement(s): Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Material Weakness; Noncompliance Prior Year Finding: N/A Questioned Costs: $149 (known); $871,943 (likely) Criteria: 29 USC 723(a); 29 USC 702(b); OAM 10.15.00.po The Vocational Rehabilitation (VR) program provides services to clients to assist in preparing for, securing, retaining, or regaining employment. VR funds may be used to carry out the purpose of the program, pay personnel, and administer the VR program. All transactions paid for with VR funds must be supported by appropriate documentation. We selected a random sample of 21 out of 14,436 expenditures, representing payments made for client services and payments to administer the program, and identified the following: • Three transactions where the department was unable to provide supporting documentation, resulting in $139 of actual questioned cost. • One transaction where the department was unable to provide documentation showing the transaction was approved. • One transaction where the expenditure exceeded the actual cost of the client service, resulting in $10 of actual questioned cost. These transactions resulted in $149 of actual questioned costs and when projected to the population resulted in $871,943 of likely questioned costs. We recommend department management strengthen internal controls to ensure supporting documentation is maintained, reviews are documented, and transactions agree to supporting documentation.

2023-030 Department of Human Services Strengthen controls over payroll expenditures Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220054, 2022; H126A230054, 2023 Compliance Requirement(s): Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $3,521 (known) Criteria: 29 USC 723(a); 29 USC 702(b) The Vocational Rehabilitation (VR) program provides services to clients to assist in preparing for, securing, retaining, or regaining employment. Accordingly, funds may be used to carry out the purpose of the program, pay personnel, and administer the VR program. From a population of 2,368 monthly payroll costs, we selected a random sample of 21 to verify monthly time was approved by management and employees directly work on the VR award. Of those 21 costs, we identified one paid with VR funds but was a board member for a program other than VR. We expanded our review to include all board members paid with VR funds, and identified a total of two board members who were charging time to VR inappropriately, resulting in total actual questioned cost of $3,521. The board members’ time was coded incorrectly and a separate monthly review of employees charging time to the VR program failed to identify these board members were inappropriately paid with VR funds. We recommend department management implement and document additional internal controls to ensure only VR employees are paid with VR funding.

2023-031 Oregon Commission for the Blind Improve controls over compliance reporting Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220055, 2022; H126A230055, 2023 Compliance Requirement(s): Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State VR agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment (IPE), services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the commission to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed five clients out of 737 from the September 2022 report to ensure the information contained in selected fields agreed to supporting documentation. Testing results identified two clients where the commission could not provide documentation to support the start date of employment in the primary occupation and the hourly wage at exit as reported and contained in the case management system. Without maintaining supporting documentation of the case information reported, the commission may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. We recommend commission management strengthen internal controls to ensure the RSA-911 client case information report contains accurate information and is supported.

2023-032 Oregon Commission for the Blind Seek clarification from federal awarding agency on appropriateness of legal fees Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220055, 2022; H126A230055, 2023 Compliance Requirement(s): Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Noncompliance Prior Year Finding: N/A Questioned Costs: $10,289 (known) Criteria: 29 USC 702(b); 29 USC 723(a) The Vocational Rehabilitation (VR) program provides services to clients to assist in preparing for, securing, retaining, or regaining employment. VR funds may be used to carry out the purpose of the program, pay personnel, and administer the VR program. During our review, we noted VR funds were being used to pay for legal fees. The use of federal funds to pay for legal fees is allowable in specific situations. Due to attorney client privilege, we were unable to obtain sufficient, appropriate audit evidence to determine if the use of VR funds to pay for these legal fees is appropriate. As a result, we are questioning $10,289 in expenditures related to the payment of legal fees. We recommend commission management request clarification from the federal awarding agency regarding the appropriateness of using VR funds for legal fees.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-042 Oregon Department of Education Retain support for pre-approval of equipment purchases Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D 84.425U & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C210048, 2021 (COVID-19); S425D210049, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Equipment Type of Finding: Significant Deficiency: Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.439; 2 CFR 200.303 Capital expenditures for general and special purpose equipment purchases are subject to prior approval by the state agency. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Education Stabilization Funds can be used to purchase equipment that meets the overall purpose of the Education Stabilization Fund, which is to prevent, prepare for, and respond to the COVID-19 pandemic. Department procedure is for subrecipients to submit a capital request forms to the department for approval. Education will email an approval to the subrecipient. We tested 61 equipment purchases made during fiscal year 2023 and found that for one an approval could not be located. As no approval could be found, we were unable to determine if prior approval was made for the equipment. According to department management, documentation could not be located. If documentation is not retained, there is a risk that funds expended are not in compliance with federal requirements. We recommend the department retain documentation regarding every equipment approval.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-042 Oregon Department of Education Retain support for pre-approval of equipment purchases Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D 84.425U & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C210048, 2021 (COVID-19); S425D210049, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Equipment Type of Finding: Significant Deficiency: Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.439; 2 CFR 200.303 Capital expenditures for general and special purpose equipment purchases are subject to prior approval by the state agency. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Education Stabilization Funds can be used to purchase equipment that meets the overall purpose of the Education Stabilization Fund, which is to prevent, prepare for, and respond to the COVID-19 pandemic. Department procedure is for subrecipients to submit a capital request forms to the department for approval. Education will email an approval to the subrecipient. We tested 61 equipment purchases made during fiscal year 2023 and found that for one an approval could not be located. As no approval could be found, we were unable to determine if prior approval was made for the equipment. According to department management, documentation could not be located. If documentation is not retained, there is a risk that funds expended are not in compliance with federal requirements. We recommend the department retain documentation regarding every equipment approval.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-040 Oregon Department of Education State did not meet maintenance of effort requirement Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425U Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425U210049, 2021 (COVID-19) Compliance Requirement: Matching, Level of Effort, Earmarking Type of Finding: Material Weakness; Noncompliance Prior Year Finding: 2022-065 Questioned Costs: N/A Criteria: Section 2004(a)(1) of the American Rescue Plan (ARP) ACT; 2 CFR 200.303 The ARP ACT require the State to maintain support for both elementary and secondary education and for higher education in fiscal year 2023 at least at the proportional level of the state’s support for elementary and secondary education and for higher education relative to the state’s overall spending, averaged over fiscal years 2017, 2018 and 2019. The Department of Education (department) did not meet the maintenance of effort provisions for fiscal year 2023 for elementary and secondary education. Although the state’s overall funding increased for education, its proportional level relative to Oregon’s overall spending declined. The department is reliant on the legislative budget process. On July 31, 2023, the federal agency approved the State’s request for a waiver for maintenance of effort for fiscal year 2022 but did not approve waiver request for fiscal year 2023. The department submitted a new waiver request to the U.S. Department of Education dated March 14, 2024. According to department management, budget changes and obtaining a clearer understanding of the State’s Other Fund amount delayed the calculation for maintenance of effort. The total federal expenditures for the Education Stabilization Fund program for the fiscal year ended June 30, 2023 were $407 million. If the waiver is not approved, the department may be asked to return some of the funds. We recommend department management continue to actively track whether it will meet the maintenance of effort requirement and communicate with the federal awarding agency.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-042 Oregon Department of Education Retain support for pre-approval of equipment purchases Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D 84.425U & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C210048, 2021 (COVID-19); S425D210049, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Equipment Type of Finding: Significant Deficiency: Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.439; 2 CFR 200.303 Capital expenditures for general and special purpose equipment purchases are subject to prior approval by the state agency. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Education Stabilization Funds can be used to purchase equipment that meets the overall purpose of the Education Stabilization Fund, which is to prevent, prepare for, and respond to the COVID-19 pandemic. Department procedure is for subrecipients to submit a capital request forms to the department for approval. Education will email an approval to the subrecipient. We tested 61 equipment purchases made during fiscal year 2023 and found that for one an approval could not be located. As no approval could be found, we were unable to determine if prior approval was made for the equipment. According to department management, documentation could not be located. If documentation is not retained, there is a risk that funds expended are not in compliance with federal requirements. We recommend the department retain documentation regarding every equipment approval.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-042 Oregon Department of Education Retain support for pre-approval of equipment purchases Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D 84.425U & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C210048, 2021 (COVID-19); S425D210049, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Equipment Type of Finding: Significant Deficiency: Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.439; 2 CFR 200.303 Capital expenditures for general and special purpose equipment purchases are subject to prior approval by the state agency. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Education Stabilization Funds can be used to purchase equipment that meets the overall purpose of the Education Stabilization Fund, which is to prevent, prepare for, and respond to the COVID-19 pandemic. Department procedure is for subrecipients to submit a capital request forms to the department for approval. Education will email an approval to the subrecipient. We tested 61 equipment purchases made during fiscal year 2023 and found that for one an approval could not be located. As no approval could be found, we were unable to determine if prior approval was made for the equipment. According to department management, documentation could not be located. If documentation is not retained, there is a risk that funds expended are not in compliance with federal requirements. We recommend the department retain documentation regarding every equipment approval.

2023-025 Department of Human Services Obtain accurate information from the ONE application Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF) Federal Award Numbers and Years: 2022G996115, 2022; 2023G996115, 2023 Compliance Requirements: Matching, Level of Effort, Earmarking; Reporting; Special Tests and Provisions Type of Finding: Material Weakness, Material Noncompliance Prior Year Finding: 2022 035, 2022 036, 2022 038, 2021 009, 2021 010 Questioned Costs: N/A Criteria: 45 CFR 265.3(b), 45 CFR 265.9; 45 CFR 261.1 Federal regulations require the department to collect monthly and report quarterly certain financial and non-financial data elements for services paid with Temporary Assistance for Needy Families (TANF) federal funding in the ACF-199 TANF data report. Federal regulations also require the department to report data quarterly for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the ACF-209 SSP-MOE data report. Both data reports should be supported by applicable performance records. During fiscal year 2021, the department transitioned key aspects of the TANF program to Oregon Eligibility (ONE) for case management, while TANF child welfare payments continued to be recorded in OR-Kids, the child welfare system. The department contracts with a service provider to extract data from ONE and OR-Kids to populate the data reports. Program staff currently work with the service provider to obtain comprehensive data reports prior to submission to review them for errors and when found, each issue is logged as a defect for the service provider to correct. The department and the U.S. Administration for Children and Families identified data reports submitted for state fiscal year 2023 were incorrect and the department was unable to provide corrected data during our audit. As the performance data reports are known to be incomplete and inaccurate, we are unable to test the reports for compliance with multiple program requirements. Specifically, we were unable to perform testing for • Earmarking requirements to ensure less than 20% of clients have been enrolled in the program for over 60 months; • Reporting requirements relating to the ACF 199R and ACF 209R reports on program performance; • Special tests and provisions relating to client penalties for refusal to work; • Special tests and provisions relating to lack of child care for single custodial parents of children under the age of six, and; • Special tests and provisions relating to client penalties for failure to comply with work verification plans. To date, the implementation of ONE has not resolved findings related to performance data reporting, which have been ongoing since fiscal year 2010. Though the department has yet to receive a Service Organization Control (SOC) report from the service organization administering ONE and compiling data reports, the department expects the report to be completed within the next year. Without an annual SOC report, the department does not have assurance controls are functioning as intended at the service organization for the TANF program. We recommend department management continue to review ACF-199 and ACF-209 reports prior to submission and monitor known compilation defects to ensure performance data reports submitted are complete and accurate. We also recommend department management obtain an annual SOC report over the service organization’s internal controls for the ONE application. Additionally, we recommend department management consider contractual and/or legal remedies if the contractor is unable to provide accurate and reliable information from the ONE system within a reasonable time frame necessary for the business needs of the department.

2023-026 Department of Human Services Improve controls relating to client not cooperating with child support requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF) Federal Award Numbers and Years: 2022G996115, 2022; 2023G996115, 2023 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2022-037 Questioned Costs: $790 (known) Criteria: 45 CFR 264.30-31 Federal regulations require the department to refer all appropriate individuals in the family of a child to the child support enforcement agency. If the department determines referred individuals are not cooperating, without good cause, in establishing, modifying, or enforcing a support order with respect to the child, then the department must reduce or deny assistance in the Temporary Assistance for Needy Families (TANF) program. Due to control weaknesses in obtaining reliable information from the ONE application discussed in the finding titled “Obtain accurate information from the ONE application,” we based our testing upon a population provided by the Oregon Department of Justice’s Department of Child Support (DCS). We tested a random sample of 40 of 3,947 clients identified by DCS as non-cooperative with child support enforcement to determine if the department took appropriate action to get the client into compliance or decrease benefits as required by federal regulations. We found for three of the 40 clients, the department did not take timely action to move the client into compliance, did not identify good cause for the client to be exempted, and did not appropriately reduce benefits as required. For each of the three sample items, department staff did not follow established polices and requirements to reduce or suspend client benefits for non-cooperation. For the three items identified, we calculated the known questioned costs of $790 based upon the payments issued from the time DCS notified the department of the non-cooperation (with a one month grace period to allow the department reasonable time to take action) until the benefits were cancelled. We assumed good cause would not have been granted as we could not otherwise find evidence of good cause in the department documentation. Because the information came from DCS, rather than the ONE application, we do not have sufficient information available to reasonably project the questioned costs to the population. We recommend management ensure department employees are adequately trained on applicable procedures and requirements relating to child support cooperation with DCS.

2023-027 Department of Human Services Improve controls to ensure eligibility criteria are met Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF) Federal Award Numbers and Years: 2022G996115, 2022; 2023G996115, 2023 Compliance Requirements: Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2022-039, 2022-040, 2021-011 Questioned Costs: $3,491 (known), $1,281,622 (likely) Criteria: 45 CFR 264.10; 45 CFR 261.11 Federal regulations require each state to participate in the Income Eligibility and Verification System (IEVS), which for Oregon, includes using income and benefit screens accessible through Oregon Employment Department, Internal Revenue Service, and Social Security Administration, when making Temporary Assistance for Needy Families (TANF) eligibility determinations. The department’s current procedure instructs caseworkers to narrate “IEVS checked” in the case management system, Oregon Eligibility (ONE), after reviewing all appropriate IEVS screens at the time of eligibility determination. We tested 60 of 179,990 client benefit months during the year to determine if the clients met the applicable eligibility requirements and the department had performed appropriate data checks in accordance with federal requirements. We identified the following: • For four clients, the department did not document completion of eligibility checks in the Income Eligibility and Verification System (IEVS) prior to issuing the payment. Although control deviations were identified, we did not identify questioned costs for these sample items. • For one client, the department did not complete the required JOBS program enrollment application when the client entered the program. We question costs totaling $3,491 as the amount of benefit payments issued from the initial TANF enrollment date through the date the JOBS screening was completed. The projected questioned costs total $1,281,622. The items above were the result of caseworker errors in completing required enrollment procedures. We recommend department management ensure caseworkers are adequately trained on TANF enrollment procedures to ensure all applicable requirements are completed.

2023-017 Oregon Housing and Community Services Ensure review of federal cash draws are adequately documented to support the draws are for the immediate cash needs of the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Cash Management Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2022-034 Questioned Costs: $14,831.23 (known); $27,652.04 (likely) Criteria: 31 CFR § 205.33(a); 2 CFR § 200.303 Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Cash draws on federal awards should be limited to the minimum amount needed for the immediate cash needs of operating the program. We reviewed 60 randomly selected subrecipient requests for funds, five randomly selected cash draws for the reimbursement of central administrative costs, and one judgmentally selected cash draw for disbursements to subrecipients. We noted the following based on our review: • Five of the subrecipient requests for funds totaling $44,166.54 were for advance payments that did not have sufficient documentation supporting the immediate cash needs of the requests. Without adequate verification of cash needs, the department is at risk of sending funds to subrecipients that are not for the immediate cash needs of the program. • Two of the cash draws for central administrative costs and the one cash draw for disbursements to subrecipients did not have evidence of separate review and approval prior to the drawdown of funds. One of these draws resulted in inadvertently drawing $14,831.23 in funds from the incorrect award. We recommend department management ensure controls are implemented and documented to verify cash draws are for the immediate cash needs of the program and are made on the correct awards.

2023-018 Oregon Housing and Community Services Ensure grant management report control is performed and documented Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2022ORLIEI, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Earmarking; Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR § 200.303; 45 CFR § 96.14(a)(2) The department is subject to various Earmarking and Period of Performance requirements as a condition of their awards under the Low-Income Home Energy Assistance Program (LIHEAP). Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Additionally, management is responsible for evaluating and monitoring the department’s compliance with the terms and conditions of federal awards and taking prompt action when instances of noncompliance are identified. The department’s monthly preparation of the Grant Management Report serves as the control that helps provide assurance over compliance with the Earmarking and Period of Performance requirements. However, according to department management, staffing challenges led to the Grant Management Reports not being consistently prepared throughout state fiscal year 2023. No instances of noncompliance were noted during our testing of the Earmarking requirement. However, we identified one award where the Period of Performance deadline for the obligation of 90% of the award was not met. Without a consistently performed control, the department is subject to increased risk of noncompliance. We recommend department management ensure controls are performed and documented as intended by their established process.

2023-019 Oregon Housing and Community Services Ensure documentation is retained to support amounts reported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. The department is required to submit the Quarterly Performance and Management (Quarterly) Report that contains various data and information including the obligation of funding. During our testing of the Quarterly reports submitted during the state fiscal year 2023 audit period, we identified discrepancies in the obligation totals reported by the department compared to auditor recalculations for two of the four quarters. However, the department was not able to locate documentation supporting the obligation totals included in the reports. We recommend department management ensure adequate controls are in place over reporting and documentation is retained to support the amounts reported.

2023-017 Oregon Housing and Community Services Ensure review of federal cash draws are adequately documented to support the draws are for the immediate cash needs of the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Cash Management Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2022-034 Questioned Costs: $14,831.23 (known); $27,652.04 (likely) Criteria: 31 CFR § 205.33(a); 2 CFR § 200.303 Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Cash draws on federal awards should be limited to the minimum amount needed for the immediate cash needs of operating the program. We reviewed 60 randomly selected subrecipient requests for funds, five randomly selected cash draws for the reimbursement of central administrative costs, and one judgmentally selected cash draw for disbursements to subrecipients. We noted the following based on our review: • Five of the subrecipient requests for funds totaling $44,166.54 were for advance payments that did not have sufficient documentation supporting the immediate cash needs of the requests. Without adequate verification of cash needs, the department is at risk of sending funds to subrecipients that are not for the immediate cash needs of the program. • Two of the cash draws for central administrative costs and the one cash draw for disbursements to subrecipients did not have evidence of separate review and approval prior to the drawdown of funds. One of these draws resulted in inadvertently drawing $14,831.23 in funds from the incorrect award. We recommend department management ensure controls are implemented and documented to verify cash draws are for the immediate cash needs of the program and are made on the correct awards.

2023-018 Oregon Housing and Community Services Ensure grant management report control is performed and documented Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2022ORLIEI, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Earmarking; Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR § 200.303; 45 CFR § 96.14(a)(2) The department is subject to various Earmarking and Period of Performance requirements as a condition of their awards under the Low-Income Home Energy Assistance Program (LIHEAP). Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Additionally, management is responsible for evaluating and monitoring the department’s compliance with the terms and conditions of federal awards and taking prompt action when instances of noncompliance are identified. The department’s monthly preparation of the Grant Management Report serves as the control that helps provide assurance over compliance with the Earmarking and Period of Performance requirements. However, according to department management, staffing challenges led to the Grant Management Reports not being consistently prepared throughout state fiscal year 2023. No instances of noncompliance were noted during our testing of the Earmarking requirement. However, we identified one award where the Period of Performance deadline for the obligation of 90% of the award was not met. Without a consistently performed control, the department is subject to increased risk of noncompliance. We recommend department management ensure controls are performed and documented as intended by their established process.

2023-019 Oregon Housing and Community Services Ensure documentation is retained to support amounts reported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. The department is required to submit the Quarterly Performance and Management (Quarterly) Report that contains various data and information including the obligation of funding. During our testing of the Quarterly reports submitted during the state fiscal year 2023 audit period, we identified discrepancies in the obligation totals reported by the department compared to auditor recalculations for two of the four quarters. However, the department was not able to locate documentation supporting the obligation totals included in the reports. We recommend department management ensure adequate controls are in place over reporting and documentation is retained to support the amounts reported.

2023-020 Oregon Health Authority Implement controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023; 1B09SM085378, 2021 (COVID-19); 1B09SM085906, 2021 (COVID-19); 1B09SM083994, 2021 (COVID-19) 93.959: 1B08TI083472, 2021; 1B08TI084667, 2022; 1B08TI085829, 2023; B08TI083963, 2021 (COVID-19); B08TI084603, 2021 (COVID-19); B08TI083513, 2021 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2022-043 Questioned Costs: N/A Criteria: 45 CFR 75.351(a); 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require pass-through entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of eight of 58 Mental Health Block Grant (MHBG) and 16 of 126 Substance Abuse Block Grant (SABG) recipient contracts with expenditures recorded during state fiscal year 2023. Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • Two recipients of MHBG funds were classified as subrecipients by the department, but it was unclear if each met the definition of a subrecipient. • One recipient of MHBG funds and three recipients of SABG funds were classified as a contractor and appeared to meet the definition of a contractor; however, payments made to these recipients were recorded as passthrough expenditures. • One recipient of MHBG funds was not included in the department’s Federal Funding Accountability and Transparency Act (FFATA) reporting. The oversight is due to the recipient being categorized as a subrecipient in the contract but as a contractor in the department’s database used to track subrecipients requiring FFATA reporting. In addition, we followed up on similar errors noted during the prior fiscal year. Two recipients of MHBG funds and one recipient of SABG funds were inappropriately categorized as subrecipients in the prior fiscal year and reported passthrough expenditures in state fiscal year 2023. During the prior audit, the department agreed one of the entities in question should be a contractor and the related expenditures should be reported as direct rather than passthrough. We also noted both direct and passthrough expenditures were reported for two counties receiving MHBG funds; however, the contracts did not clearly indicate what expenditures would be considered direct expenditures, and which would be considered passthrough to the counties. The above issues did not result in questioned costs. However, a total of $724,634 in MHBG funds and $235,000 in SABG funds were reported as passthrough expenditures and should have been reported as direct expenditures. Finally, we inquired of the department’s risk assessment and monitoring activities for subrecipients. Based on our inquiries, the department does not have a formal implemented process for performing risk assessments to determine appropriate monitoring activities. Moreover, the department has not implemented a formal process to ensure subrecipients comply with federal regulations, terms, and conditions of the subaward, and subaward performance goals are achieved. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals may not be met. We recommend department management ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to risk assessment results.

2023-020 Oregon Health Authority Implement controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023; 1B09SM085378, 2021 (COVID-19); 1B09SM085906, 2021 (COVID-19); 1B09SM083994, 2021 (COVID-19) 93.959: 1B08TI083472, 2021; 1B08TI084667, 2022; 1B08TI085829, 2023; B08TI083963, 2021 (COVID-19); B08TI084603, 2021 (COVID-19); B08TI083513, 2021 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2022-043 Questioned Costs: N/A Criteria: 45 CFR 75.351(a); 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require pass-through entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of eight of 58 Mental Health Block Grant (MHBG) and 16 of 126 Substance Abuse Block Grant (SABG) recipient contracts with expenditures recorded during state fiscal year 2023. Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • Two recipients of MHBG funds were classified as subrecipients by the department, but it was unclear if each met the definition of a subrecipient. • One recipient of MHBG funds and three recipients of SABG funds were classified as a contractor and appeared to meet the definition of a contractor; however, payments made to these recipients were recorded as passthrough expenditures. • One recipient of MHBG funds was not included in the department’s Federal Funding Accountability and Transparency Act (FFATA) reporting. The oversight is due to the recipient being categorized as a subrecipient in the contract but as a contractor in the department’s database used to track subrecipients requiring FFATA reporting. In addition, we followed up on similar errors noted during the prior fiscal year. Two recipients of MHBG funds and one recipient of SABG funds were inappropriately categorized as subrecipients in the prior fiscal year and reported passthrough expenditures in state fiscal year 2023. During the prior audit, the department agreed one of the entities in question should be a contractor and the related expenditures should be reported as direct rather than passthrough. We also noted both direct and passthrough expenditures were reported for two counties receiving MHBG funds; however, the contracts did not clearly indicate what expenditures would be considered direct expenditures, and which would be considered passthrough to the counties. The above issues did not result in questioned costs. However, a total of $724,634 in MHBG funds and $235,000 in SABG funds were reported as passthrough expenditures and should have been reported as direct expenditures. Finally, we inquired of the department’s risk assessment and monitoring activities for subrecipients. Based on our inquiries, the department does not have a formal implemented process for performing risk assessments to determine appropriate monitoring activities. Moreover, the department has not implemented a formal process to ensure subrecipients comply with federal regulations, terms, and conditions of the subaward, and subaward performance goals are achieved. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals may not be met. We recommend department management ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to risk assessment results.

2023-021 Oregon Health Authority Implement controls to ensure earmarked expenditures are tracked and compliance achieved Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023 Compliance Requirement: Matching, Level of Effort, Earmarking Type of Finding: Significant Deficiency Prior Year Finding: 2022-044 Questioned Costs: N/A Criteria: 42 USC 300x-9(c)(1); 42 USC 300x-9(d)(1); 2 CFR 200.303 The Mental Health Block Grant (MHBG) is subject to various Earmarking requirements. These requirements ensure the department meets minimum expenditure thresholds. Federal regulations require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department is required to expend 10% of the MHBG federal award for early serious mental illness, including psychotic disorders. It is also required to expend 5% of the federal award for serious mental illnesses and children with serious mental and emotional disturbances. These set asides are calculated and budgeted when the federal awards are granted. Based on testing performed, we concluded the department complied with all applicable Earmarking requirements during state fiscal year 2023. However, during the audit period, the department did not have controls in place to track applicable expenditures to ensure compliance was achieved. Upon inquiry, staff reported the department has now set up structure within the state accounting system, and going forward will track the expenditures. The lack of controls in place to track earmarked expenditures increases the department’s risk of noncompliance with federal program requirements. This was also reported in fiscal year 2022. We recommend department management implement controls to ensure applicable expenditures are adequately tracked and reviewed for compliance with federal Earmarking requirements.

2023-020 Oregon Health Authority Implement controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023; 1B09SM085378, 2021 (COVID-19); 1B09SM085906, 2021 (COVID-19); 1B09SM083994, 2021 (COVID-19) 93.959: 1B08TI083472, 2021; 1B08TI084667, 2022; 1B08TI085829, 2023; B08TI083963, 2021 (COVID-19); B08TI084603, 2021 (COVID-19); B08TI083513, 2021 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2022-043 Questioned Costs: N/A Criteria: 45 CFR 75.351(a); 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require pass-through entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of eight of 58 Mental Health Block Grant (MHBG) and 16 of 126 Substance Abuse Block Grant (SABG) recipient contracts with expenditures recorded during state fiscal year 2023. Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • Two recipients of MHBG funds were classified as subrecipients by the department, but it was unclear if each met the definition of a subrecipient. • One recipient of MHBG funds and three recipients of SABG funds were classified as a contractor and appeared to meet the definition of a contractor; however, payments made to these recipients were recorded as passthrough expenditures. • One recipient of MHBG funds was not included in the department’s Federal Funding Accountability and Transparency Act (FFATA) reporting. The oversight is due to the recipient being categorized as a subrecipient in the contract but as a contractor in the department’s database used to track subrecipients requiring FFATA reporting. In addition, we followed up on similar errors noted during the prior fiscal year. Two recipients of MHBG funds and one recipient of SABG funds were inappropriately categorized as subrecipients in the prior fiscal year and reported passthrough expenditures in state fiscal year 2023. During the prior audit, the department agreed one of the entities in question should be a contractor and the related expenditures should be reported as direct rather than passthrough. We also noted both direct and passthrough expenditures were reported for two counties receiving MHBG funds; however, the contracts did not clearly indicate what expenditures would be considered direct expenditures, and which would be considered passthrough to the counties. The above issues did not result in questioned costs. However, a total of $724,634 in MHBG funds and $235,000 in SABG funds were reported as passthrough expenditures and should have been reported as direct expenditures. Finally, we inquired of the department’s risk assessment and monitoring activities for subrecipients. Based on our inquiries, the department does not have a formal implemented process for performing risk assessments to determine appropriate monitoring activities. Moreover, the department has not implemented a formal process to ensure subrecipients comply with federal regulations, terms, and conditions of the subaward, and subaward performance goals are achieved. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals may not be met. We recommend department management ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to risk assessment results.

2023-020 Oregon Health Authority Implement controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023; 1B09SM085378, 2021 (COVID-19); 1B09SM085906, 2021 (COVID-19); 1B09SM083994, 2021 (COVID-19) 93.959: 1B08TI083472, 2021; 1B08TI084667, 2022; 1B08TI085829, 2023; B08TI083963, 2021 (COVID-19); B08TI084603, 2021 (COVID-19); B08TI083513, 2021 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2022-043 Questioned Costs: N/A Criteria: 45 CFR 75.351(a); 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require pass-through entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of eight of 58 Mental Health Block Grant (MHBG) and 16 of 126 Substance Abuse Block Grant (SABG) recipient contracts with expenditures recorded during state fiscal year 2023. Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • Two recipients of MHBG funds were classified as subrecipients by the department, but it was unclear if each met the definition of a subrecipient. • One recipient of MHBG funds and three recipients of SABG funds were classified as a contractor and appeared to meet the definition of a contractor; however, payments made to these recipients were recorded as passthrough expenditures. • One recipient of MHBG funds was not included in the department’s Federal Funding Accountability and Transparency Act (FFATA) reporting. The oversight is due to the recipient being categorized as a subrecipient in the contract but as a contractor in the department’s database used to track subrecipients requiring FFATA reporting. In addition, we followed up on similar errors noted during the prior fiscal year. Two recipients of MHBG funds and one recipient of SABG funds were inappropriately categorized as subrecipients in the prior fiscal year and reported passthrough expenditures in state fiscal year 2023. During the prior audit, the department agreed one of the entities in question should be a contractor and the related expenditures should be reported as direct rather than passthrough. We also noted both direct and passthrough expenditures were reported for two counties receiving MHBG funds; however, the contracts did not clearly indicate what expenditures would be considered direct expenditures, and which would be considered passthrough to the counties. The above issues did not result in questioned costs. However, a total of $724,634 in MHBG funds and $235,000 in SABG funds were reported as passthrough expenditures and should have been reported as direct expenditures. Finally, we inquired of the department’s risk assessment and monitoring activities for subrecipients. Based on our inquiries, the department does not have a formal implemented process for performing risk assessments to determine appropriate monitoring activities. Moreover, the department has not implemented a formal process to ensure subrecipients comply with federal regulations, terms, and conditions of the subaward, and subaward performance goals are achieved. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals may not be met. We recommend department management ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to risk assessment results.

2023-035 Department of Early Learning and Care Use restricted indirect cost rate when required Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCCC5, 2021 (COVID-19);2101ORCCDD, 2021; 2101ORCDC6, 2021 (COVID-19); 90YE020004, 2021; 2101ORCSC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2301ORCCDD, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $400,369 (known) Criteria: 45 CFR 98.57; 34 CFR 75.563 During fiscal year 2023, the Child Care and Development (CCDF) program was with the Early Learning Division within the Oregon Department of Education (ODE). Effective July 1, 2023, the Department of Early Learning and Care (department) was created and administers the CCDF program. ODE’s indirect rate agreement approved by the U.S. Department of Education was effective during fiscal year 2023. This rate agreement includes two different rates to be used, an unrestricted rate if there is not a supplement restriction and a lower restricted rate if there is. In our review of the indirect rates used by ODE, we identified that ODE only entered the unrestricted rate into their system, while the terms and conditions for the CARES, CRRSA, ARP and Discretionary CCDF awards identified a supplement not supplant restriction. This resulted in ODE requesting reimbursement for the indirect expenditures at a higher rate. As a result of this, ODE incorrectly claimed an additional $400,369 in indirect cost reimbursement. We recommend department management ensure the appropriate indirect cost rate is used in fiscal year 2024. We also recommend the department work with ODE to determine if there are any additional questioned costs from prior fiscal years and work with the federal awarding agency to reimburse the federal agency for any unallowable costs.

2023-036 Department of Early Learning and Care Improve controls over family copay and child care hour calculations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2101ORCCDD, 2021; 2101ORCCC5, 2021 (COVID-19); 2101ORCCDM, 2021; 2101ORCDC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-025 Questioned Costs: $6,310 (known); $18,291 (likely) Criteria: 45 CFR 98.45(b)(5); 42 USC 9858 The Child Care and Development Fund program offers federal funding to states to increase the availability, affordability, and quality of child care services. As required by federal regulations, the department has developed a sliding fee scale, based on family size and income that provides for cost sharing by families that receive child care services (monthly copay). The monthly copay is included on the provider’s monthly bill form provided by the department. If a family has more than one child care provider, one is designated the primary provider based on amount of care provided and receives the copay from the family. The authorized monthly child care hours are calculated based on parent work schedules, commute time, and other factors. The department relies on the ONE eligibility system to verify eligibility, calculate child care hours and monthly copay based on information entered into the system. Payments to providers are based on the returned and completed billing forms. The department allows providers to submit for reimbursement any time during the month. We tested a random sample of 50 families for client eligibility and verification of one monthly benefit payment to the child care provider. As part of the provider payment, we verified the accuracy of the monthly copay and the authorized child care hours. If errors in copay or provider payments were identified, we reviewed additional months to capture all known questioned costs. We identified errors in 13 of 50 sample items resulting in the following errors: • For one case we identified $5,700 in known questioned costs. The client changed child care providers in August 2022. The new provider’s billing form had prorated authorized hours and was correct. The prior provider submitted and was paid for full authorized hours for all children early in August prior to client’s notification. The client changed child care providers again in January 2023 but did not notify the department until late March 2023. The new provider’s billing forms were appropriate. However, the prior provider billed for full time child care in January, February and March. The department should have identified these overpayments when setting up the new child care provider. • Six cases where copay was calculated incorrectly. Four cases were due to human error when entering income in the ONE system. In two cases, the ONE system correctly calculated the copay but the final amount was increased or reduced for reasons unknown. These errors resulted in known questioned costs of $575. • One case where the copay was calculated correctly. However, the client had multiple child care providers and the $5 copay was not attached to the billing form for the providers reimbursed for October 2022 through April 2023 resulting in known questioned costs of $35. • Seven cases in which the authorized child care hours were calculated incorrectly. Errors did not cause any incorrect provider payments. In two cases, it appears the ONE system calculated correctly but the arithmetic is incorrect in final authorized hours. The department could not explain how the final hours were determined. In two cases, when the client end/start of jobs occurred in the same month, the ONE system incorrectly includes hours from the old job in the calculation resulting in authorized hours being too high. The other three cases were caused by human entry errors. • One case where the department was unable to locate either a signed paper application signature or a phone signature. Human entry errors and system errors can lead to errors in determining eligibility and the accuracy of the monthly copay and the authorized child care hours. These errors may lead to improper payments to child care provider by the program. We recommend department management ensure a client’s monthly copay and child care hours are correctly calculated and identify any potential system issues. In addition, when a change in provider occurs, the department should verify the accuracy of payments to the prior provider. We also recommend department management reimburse the federal agency for unallowable costs.

2023-037 Department of Early Learning and Care Improve controls over payroll Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDD, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-029 Questioned Costs: $297 (known); $18,975 (likely) Criteria: 45 CFR 75.403(a); 45 CFR 75.430(a) Federal regulations state that allowable costs are costs necessary and reasonable for the performance of federal awards. Payroll costs directly related to a federal award are allowable costs, provided they are reasonable for the services rendered and are supported. The department has implemented the following procedures to ensure allowable payroll costs are charged to the program. Managers approve monthly timesheets submitted by employees in the state’s payroll system. The department sets cost centers in the payroll system based on position. The State switched to a new payroll system, effective December 2022. With this change, managers no longer review cost center codes when reviewing an employee’s timesheet. Additionally, if a manager has not reviewed a timesheet by a specified date, the payroll system will automatically approve the timesheet, shown with the words “mass approval.” We tested a random sample of 25 employees and judgmentally selected 2 employees to ensure payroll for a month was appropriately charged to the program. We verified whether payroll timesheets were reviewed by a manager and signed position descriptions were retained per state guidelines, and identified the following exceptions: • Position descriptions could not be located for two employees. Both of these employees were terminated and the position descriptions were not retained after they left employment. • Four timesheets, under the new payroll system, were not fully approved by a manager and contained instances of “mass approval” with no other verification that the manager reviewed and approved the employees time for the month. • For two employees, the new payroll system incorrectly charged minimal time to the federal program resulting in questioned costs of $297. The employees’ regular pay was not charged to the program. This occurred as the cost code was not set up and the system defaulted to a previously used cost code. We recommend department management improve its review of timesheets and ensure position descriptions are retained. We also recommend department management develop a report to identify when payroll system incorrectly charges time to a federal program. Finally, we recommend department management reimburse the federal agency for any unallowable costs.

2023-038 Department of Early Learning and Care Retain support and improve controls over reporting Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2001ORCCDF, 2020; 2101ORCCC5, 2021 (COVID-19); 2101ORCDC6, 2021 (COVID-19); 2101ORCCDD, 2021; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDF, 2021; 2101ORCCDM, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) The department is required to submit quarterly ACF 696 reports for each open grant. To ensure the accuracy and completeness of these two reports, the department’s control process requires a review of reports prior to submission. We reviewed three of 12 ACF 696 reports submitted during fiscal year 2023. For all three reports, the department was initially unable to provide the support for the Department of Revenue (DOR) Working Family/Child Care Tax Credits used to help meet the matching and maintenance of effort requirements. The department could not locate the support used to prepare the reports for the DOR tax credits and needed to have DOR provide documentation. Additionally, one of the reports had matching fields that were left blank when the report was submitted even though expenditures were incurred and should have been reported. The department does not have detailed procedures around the use of the tax credits in preparation of the reports and sources of information used in the preparation. Additionally, the review process did not identify the blank fields or missing documentation. These reports provide the federal awarding agency with key information related to the program and errors in reports could alter the amount of funding received by the department in future years. We recommend department management further develop its procedures for claiming the tax credit in the ACF-696 reports. We also recommend the department ensure documentation is maintained with the reports in future years.

2023-035 Department of Early Learning and Care Use restricted indirect cost rate when required Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCCC5, 2021 (COVID-19);2101ORCCDD, 2021; 2101ORCDC6, 2021 (COVID-19); 90YE020004, 2021; 2101ORCSC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2301ORCCDD, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $400,369 (known) Criteria: 45 CFR 98.57; 34 CFR 75.563 During fiscal year 2023, the Child Care and Development (CCDF) program was with the Early Learning Division within the Oregon Department of Education (ODE). Effective July 1, 2023, the Department of Early Learning and Care (department) was created and administers the CCDF program. ODE’s indirect rate agreement approved by the U.S. Department of Education was effective during fiscal year 2023. This rate agreement includes two different rates to be used, an unrestricted rate if there is not a supplement restriction and a lower restricted rate if there is. In our review of the indirect rates used by ODE, we identified that ODE only entered the unrestricted rate into their system, while the terms and conditions for the CARES, CRRSA, ARP and Discretionary CCDF awards identified a supplement not supplant restriction. This resulted in ODE requesting reimbursement for the indirect expenditures at a higher rate. As a result of this, ODE incorrectly claimed an additional $400,369 in indirect cost reimbursement. We recommend department management ensure the appropriate indirect cost rate is used in fiscal year 2024. We also recommend the department work with ODE to determine if there are any additional questioned costs from prior fiscal years and work with the federal awarding agency to reimburse the federal agency for any unallowable costs.

2023-036 Department of Early Learning and Care Improve controls over family copay and child care hour calculations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2101ORCCDD, 2021; 2101ORCCC5, 2021 (COVID-19); 2101ORCCDM, 2021; 2101ORCDC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-025 Questioned Costs: $6,310 (known); $18,291 (likely) Criteria: 45 CFR 98.45(b)(5); 42 USC 9858 The Child Care and Development Fund program offers federal funding to states to increase the availability, affordability, and quality of child care services. As required by federal regulations, the department has developed a sliding fee scale, based on family size and income that provides for cost sharing by families that receive child care services (monthly copay). The monthly copay is included on the provider’s monthly bill form provided by the department. If a family has more than one child care provider, one is designated the primary provider based on amount of care provided and receives the copay from the family. The authorized monthly child care hours are calculated based on parent work schedules, commute time, and other factors. The department relies on the ONE eligibility system to verify eligibility, calculate child care hours and monthly copay based on information entered into the system. Payments to providers are based on the returned and completed billing forms. The department allows providers to submit for reimbursement any time during the month. We tested a random sample of 50 families for client eligibility and verification of one monthly benefit payment to the child care provider. As part of the provider payment, we verified the accuracy of the monthly copay and the authorized child care hours. If errors in copay or provider payments were identified, we reviewed additional months to capture all known questioned costs. We identified errors in 13 of 50 sample items resulting in the following errors: • For one case we identified $5,700 in known questioned costs. The client changed child care providers in August 2022. The new provider’s billing form had prorated authorized hours and was correct. The prior provider submitted and was paid for full authorized hours for all children early in August prior to client’s notification. The client changed child care providers again in January 2023 but did not notify the department until late March 2023. The new provider’s billing forms were appropriate. However, the prior provider billed for full time child care in January, February and March. The department should have identified these overpayments when setting up the new child care provider. • Six cases where copay was calculated incorrectly. Four cases were due to human error when entering income in the ONE system. In two cases, the ONE system correctly calculated the copay but the final amount was increased or reduced for reasons unknown. These errors resulted in known questioned costs of $575. • One case where the copay was calculated correctly. However, the client had multiple child care providers and the $5 copay was not attached to the billing form for the providers reimbursed for October 2022 through April 2023 resulting in known questioned costs of $35. • Seven cases in which the authorized child care hours were calculated incorrectly. Errors did not cause any incorrect provider payments. In two cases, it appears the ONE system calculated correctly but the arithmetic is incorrect in final authorized hours. The department could not explain how the final hours were determined. In two cases, when the client end/start of jobs occurred in the same month, the ONE system incorrectly includes hours from the old job in the calculation resulting in authorized hours being too high. The other three cases were caused by human entry errors. • One case where the department was unable to locate either a signed paper application signature or a phone signature. Human entry errors and system errors can lead to errors in determining eligibility and the accuracy of the monthly copay and the authorized child care hours. These errors may lead to improper payments to child care provider by the program. We recommend department management ensure a client’s monthly copay and child care hours are correctly calculated and identify any potential system issues. In addition, when a change in provider occurs, the department should verify the accuracy of payments to the prior provider. We also recommend department management reimburse the federal agency for unallowable costs.

2023-037 Department of Early Learning and Care Improve controls over payroll Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDD, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-029 Questioned Costs: $297 (known); $18,975 (likely) Criteria: 45 CFR 75.403(a); 45 CFR 75.430(a) Federal regulations state that allowable costs are costs necessary and reasonable for the performance of federal awards. Payroll costs directly related to a federal award are allowable costs, provided they are reasonable for the services rendered and are supported. The department has implemented the following procedures to ensure allowable payroll costs are charged to the program. Managers approve monthly timesheets submitted by employees in the state’s payroll system. The department sets cost centers in the payroll system based on position. The State switched to a new payroll system, effective December 2022. With this change, managers no longer review cost center codes when reviewing an employee’s timesheet. Additionally, if a manager has not reviewed a timesheet by a specified date, the payroll system will automatically approve the timesheet, shown with the words “mass approval.” We tested a random sample of 25 employees and judgmentally selected 2 employees to ensure payroll for a month was appropriately charged to the program. We verified whether payroll timesheets were reviewed by a manager and signed position descriptions were retained per state guidelines, and identified the following exceptions: • Position descriptions could not be located for two employees. Both of these employees were terminated and the position descriptions were not retained after they left employment. • Four timesheets, under the new payroll system, were not fully approved by a manager and contained instances of “mass approval” with no other verification that the manager reviewed and approved the employees time for the month. • For two employees, the new payroll system incorrectly charged minimal time to the federal program resulting in questioned costs of $297. The employees’ regular pay was not charged to the program. This occurred as the cost code was not set up and the system defaulted to a previously used cost code. We recommend department management improve its review of timesheets and ensure position descriptions are retained. We also recommend department management develop a report to identify when payroll system incorrectly charges time to a federal program. Finally, we recommend department management reimburse the federal agency for any unallowable costs.

2023-038 Department of Early Learning and Care Retain support and improve controls over reporting Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2001ORCCDF, 2020; 2101ORCCC5, 2021 (COVID-19); 2101ORCDC6, 2021 (COVID-19); 2101ORCCDD, 2021; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDF, 2021; 2101ORCCDM, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) The department is required to submit quarterly ACF 696 reports for each open grant. To ensure the accuracy and completeness of these two reports, the department’s control process requires a review of reports prior to submission. We reviewed three of 12 ACF 696 reports submitted during fiscal year 2023. For all three reports, the department was initially unable to provide the support for the Department of Revenue (DOR) Working Family/Child Care Tax Credits used to help meet the matching and maintenance of effort requirements. The department could not locate the support used to prepare the reports for the DOR tax credits and needed to have DOR provide documentation. Additionally, one of the reports had matching fields that were left blank when the report was submitted even though expenditures were incurred and should have been reported. The department does not have detailed procedures around the use of the tax credits in preparation of the reports and sources of information used in the preparation. Additionally, the review process did not identify the blank fields or missing documentation. These reports provide the federal awarding agency with key information related to the program and errors in reports could alter the amount of funding received by the department in future years. We recommend department management further develop its procedures for claiming the tax credit in the ACF-696 reports. We also recommend the department ensure documentation is maintained with the reports in future years.

2023-035 Department of Early Learning and Care Use restricted indirect cost rate when required Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCCC5, 2021 (COVID-19);2101ORCCDD, 2021; 2101ORCDC6, 2021 (COVID-19); 90YE020004, 2021; 2101ORCSC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2301ORCCDD, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $400,369 (known) Criteria: 45 CFR 98.57; 34 CFR 75.563 During fiscal year 2023, the Child Care and Development (CCDF) program was with the Early Learning Division within the Oregon Department of Education (ODE). Effective July 1, 2023, the Department of Early Learning and Care (department) was created and administers the CCDF program. ODE’s indirect rate agreement approved by the U.S. Department of Education was effective during fiscal year 2023. This rate agreement includes two different rates to be used, an unrestricted rate if there is not a supplement restriction and a lower restricted rate if there is. In our review of the indirect rates used by ODE, we identified that ODE only entered the unrestricted rate into their system, while the terms and conditions for the CARES, CRRSA, ARP and Discretionary CCDF awards identified a supplement not supplant restriction. This resulted in ODE requesting reimbursement for the indirect expenditures at a higher rate. As a result of this, ODE incorrectly claimed an additional $400,369 in indirect cost reimbursement. We recommend department management ensure the appropriate indirect cost rate is used in fiscal year 2024. We also recommend the department work with ODE to determine if there are any additional questioned costs from prior fiscal years and work with the federal awarding agency to reimburse the federal agency for any unallowable costs.

2023-036 Department of Early Learning and Care Improve controls over family copay and child care hour calculations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2101ORCCDD, 2021; 2101ORCCC5, 2021 (COVID-19); 2101ORCCDM, 2021; 2101ORCDC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-025 Questioned Costs: $6,310 (known); $18,291 (likely) Criteria: 45 CFR 98.45(b)(5); 42 USC 9858 The Child Care and Development Fund program offers federal funding to states to increase the availability, affordability, and quality of child care services. As required by federal regulations, the department has developed a sliding fee scale, based on family size and income that provides for cost sharing by families that receive child care services (monthly copay). The monthly copay is included on the provider’s monthly bill form provided by the department. If a family has more than one child care provider, one is designated the primary provider based on amount of care provided and receives the copay from the family. The authorized monthly child care hours are calculated based on parent work schedules, commute time, and other factors. The department relies on the ONE eligibility system to verify eligibility, calculate child care hours and monthly copay based on information entered into the system. Payments to providers are based on the returned and completed billing forms. The department allows providers to submit for reimbursement any time during the month. We tested a random sample of 50 families for client eligibility and verification of one monthly benefit payment to the child care provider. As part of the provider payment, we verified the accuracy of the monthly copay and the authorized child care hours. If errors in copay or provider payments were identified, we reviewed additional months to capture all known questioned costs. We identified errors in 13 of 50 sample items resulting in the following errors: • For one case we identified $5,700 in known questioned costs. The client changed child care providers in August 2022. The new provider’s billing form had prorated authorized hours and was correct. The prior provider submitted and was paid for full authorized hours for all children early in August prior to client’s notification. The client changed child care providers again in January 2023 but did not notify the department until late March 2023. The new provider’s billing forms were appropriate. However, the prior provider billed for full time child care in January, February and March. The department should have identified these overpayments when setting up the new child care provider. • Six cases where copay was calculated incorrectly. Four cases were due to human error when entering income in the ONE system. In two cases, the ONE system correctly calculated the copay but the final amount was increased or reduced for reasons unknown. These errors resulted in known questioned costs of $575. • One case where the copay was calculated correctly. However, the client had multiple child care providers and the $5 copay was not attached to the billing form for the providers reimbursed for October 2022 through April 2023 resulting in known questioned costs of $35. • Seven cases in which the authorized child care hours were calculated incorrectly. Errors did not cause any incorrect provider payments. In two cases, it appears the ONE system calculated correctly but the arithmetic is incorrect in final authorized hours. The department could not explain how the final hours were determined. In two cases, when the client end/start of jobs occurred in the same month, the ONE system incorrectly includes hours from the old job in the calculation resulting in authorized hours being too high. The other three cases were caused by human entry errors. • One case where the department was unable to locate either a signed paper application signature or a phone signature. Human entry errors and system errors can lead to errors in determining eligibility and the accuracy of the monthly copay and the authorized child care hours. These errors may lead to improper payments to child care provider by the program. We recommend department management ensure a client’s monthly copay and child care hours are correctly calculated and identify any potential system issues. In addition, when a change in provider occurs, the department should verify the accuracy of payments to the prior provider. We also recommend department management reimburse the federal agency for unallowable costs.

2023-037 Department of Early Learning and Care Improve controls over payroll Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDD, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-029 Questioned Costs: $297 (known); $18,975 (likely) Criteria: 45 CFR 75.403(a); 45 CFR 75.430(a) Federal regulations state that allowable costs are costs necessary and reasonable for the performance of federal awards. Payroll costs directly related to a federal award are allowable costs, provided they are reasonable for the services rendered and are supported. The department has implemented the following procedures to ensure allowable payroll costs are charged to the program. Managers approve monthly timesheets submitted by employees in the state’s payroll system. The department sets cost centers in the payroll system based on position. The State switched to a new payroll system, effective December 2022. With this change, managers no longer review cost center codes when reviewing an employee’s timesheet. Additionally, if a manager has not reviewed a timesheet by a specified date, the payroll system will automatically approve the timesheet, shown with the words “mass approval.” We tested a random sample of 25 employees and judgmentally selected 2 employees to ensure payroll for a month was appropriately charged to the program. We verified whether payroll timesheets were reviewed by a manager and signed position descriptions were retained per state guidelines, and identified the following exceptions: • Position descriptions could not be located for two employees. Both of these employees were terminated and the position descriptions were not retained after they left employment. • Four timesheets, under the new payroll system, were not fully approved by a manager and contained instances of “mass approval” with no other verification that the manager reviewed and approved the employees time for the month. • For two employees, the new payroll system incorrectly charged minimal time to the federal program resulting in questioned costs of $297. The employees’ regular pay was not charged to the program. This occurred as the cost code was not set up and the system defaulted to a previously used cost code. We recommend department management improve its review of timesheets and ensure position descriptions are retained. We also recommend department management develop a report to identify when payroll system incorrectly charges time to a federal program. Finally, we recommend department management reimburse the federal agency for any unallowable costs.

2023-038 Department of Early Learning and Care Retain support and improve controls over reporting Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2001ORCCDF, 2020; 2101ORCCC5, 2021 (COVID-19); 2101ORCDC6, 2021 (COVID-19); 2101ORCCDD, 2021; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDF, 2021; 2101ORCCDM, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) The department is required to submit quarterly ACF 696 reports for each open grant. To ensure the accuracy and completeness of these two reports, the department’s control process requires a review of reports prior to submission. We reviewed three of 12 ACF 696 reports submitted during fiscal year 2023. For all three reports, the department was initially unable to provide the support for the Department of Revenue (DOR) Working Family/Child Care Tax Credits used to help meet the matching and maintenance of effort requirements. The department could not locate the support used to prepare the reports for the DOR tax credits and needed to have DOR provide documentation. Additionally, one of the reports had matching fields that were left blank when the report was submitted even though expenditures were incurred and should have been reported. The department does not have detailed procedures around the use of the tax credits in preparation of the reports and sources of information used in the preparation. Additionally, the review process did not identify the blank fields or missing documentation. These reports provide the federal awarding agency with key information related to the program and errors in reports could alter the amount of funding received by the department in future years. We recommend department management further develop its procedures for claiming the tax credit in the ACF-696 reports. We also recommend the department ensure documentation is maintained with the reports in future years.

2023-022 Oregon Department of Human Services/Oregon Health Authority Ensure compliance with federal Medicaid hospital audit requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Special Tests and Provisions – Inpatient Hospital and Long-Term Care Facility Audits Type of Finding: Significant Deficiency; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 42 CFR 447.253(g); 2 CFR 303(a) Federal regulations require management to establish and maintain effective internal control to ensure compliance with federal program requirements. As part of its system of internal control, federal regulations require the Oregon Health Authority (authority) to conduct periodic audits of the financial and statistical records of participating hospitals. Inpatient hospitals are required to report actual costs to the authority who conducts audits of the reported costs. However, during state fiscal year 2023, the authority did not conduct any audits of the 61 hospitals that received Medicaid federal funds. The department had unexpected turnover during the audit period. New staff were hired to fill the vacancy; however, per management training and updating agency tools caused a delay in the completion of audits. As of March 2024, staff started sending out initial report for fiscal years 2021 and 2022 but no cost settlements have been completed. Additionally, the authority still has two outstanding settlements going back to fiscal year 2016. By failing to complete required audits, the authority does not have assurance that participating hospitals use program funds properly, which could lead to inappropriate payments to the hospitals. During the prior audit of state fiscal year 2021, the auditors reported a finding (2021-017) related to missing documentation supporting completed cost settlements. During state fiscal year 2023, the authority reported that corrective action had been taken to address the issue. However, we were unable to verify the status as no cost settlements were completed. We recommend management ensure compliance with federal program requirements by prioritizing the completion and documentation of hospital audits.

2023-023 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Special Tests and Provisions – Provider Eligibility Type of Finding: Material Weakness; Noncompliance Prior Year Finding: 2022-057 Questioned Costs: $3,629(known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.412; 42 CFR 455.414; 42 CFR 455.436 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, the federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type including but not limited to database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organizations (CCO) providers and selected a random sample of 62 non-CCO providers. The 15 CCO providers and 34 non-CCO providers were enrolled by the authority, and 28 non-CCO providers enrolled by the department. For two CCO providers we noted the following issues: • Ownership and Control disclosure for one authority CCO was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority has since obtained the missing support. • Managing Employee disclosures for one authority CCO was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. For seven non-CCO providers we noted the following issues: • Ownership and Control and Managing Employee disclosures for one authority provider was incomplete. Based on our review of available support we were able to determine these to be eligible providers. • I-9 forms for two authority providers and one department provider were not complete. Based on our review of available support we were able to determine these to be eligible providers. • I-9 form and Ownership and Control disclosure was incomplete for one department provider. Based on our review of other available support we were able to determine this to be an eligible provider during the fiscal year. • I-9 form for one department provider could not be located. The department has since obtained a completed I-9 form. • I-9 form, agreement, and disclosures for one department provider could not be located. Auditor was unable to determine eligibility for this provider resulting in federal questioned costs for the fiscal year totaling $1,786. Additionally, in prior year finding number 2022-057 we noted one department provider with an incomplete I-9 form. The department did not obtain an updated I-9 form during fiscal year 2023 resulting in federal questions costs for the fiscal year 2023 totaling $1,843. The above issues occurred due to human error and inadequate record maintenance which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers including ineligible providers identified in prior year findings.

2023-024 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $3,849 (known) Criteria: 2 CFR 200.1(1); 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations only allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors, which the department did not identify during their review process, that resulted in improper payment of Medicaid expenditures: • For one payment, management was unable to provide documentation to support charges related to the Medicaid program, resulting in known federally funded questioned costs of $2,153. • For one payment the expenditure was not related to Medicaid services, resulting in known federally funded questioned costs of $1,697. The above issues occurred due to human error and inadequate record maintenance which could lead to unallowed activities/costs being charged to the Medicaid program. We recommend department management strengthen controls over review to ensure transactions are adequately supported and reviewed. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2023-022 Oregon Department of Human Services/Oregon Health Authority Ensure compliance with federal Medicaid hospital audit requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Special Tests and Provisions – Inpatient Hospital and Long-Term Care Facility Audits Type of Finding: Significant Deficiency; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 42 CFR 447.253(g); 2 CFR 303(a) Federal regulations require management to establish and maintain effective internal control to ensure compliance with federal program requirements. As part of its system of internal control, federal regulations require the Oregon Health Authority (authority) to conduct periodic audits of the financial and statistical records of participating hospitals. Inpatient hospitals are required to report actual costs to the authority who conducts audits of the reported costs. However, during state fiscal year 2023, the authority did not conduct any audits of the 61 hospitals that received Medicaid federal funds. The department had unexpected turnover during the audit period. New staff were hired to fill the vacancy; however, per management training and updating agency tools caused a delay in the completion of audits. As of March 2024, staff started sending out initial report for fiscal years 2021 and 2022 but no cost settlements have been completed. Additionally, the authority still has two outstanding settlements going back to fiscal year 2016. By failing to complete required audits, the authority does not have assurance that participating hospitals use program funds properly, which could lead to inappropriate payments to the hospitals. During the prior audit of state fiscal year 2021, the auditors reported a finding (2021-017) related to missing documentation supporting completed cost settlements. During state fiscal year 2023, the authority reported that corrective action had been taken to address the issue. However, we were unable to verify the status as no cost settlements were completed. We recommend management ensure compliance with federal program requirements by prioritizing the completion and documentation of hospital audits.

2023-023 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Special Tests and Provisions – Provider Eligibility Type of Finding: Material Weakness; Noncompliance Prior Year Finding: 2022-057 Questioned Costs: $3,629(known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.412; 42 CFR 455.414; 42 CFR 455.436 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, the federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type including but not limited to database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organizations (CCO) providers and selected a random sample of 62 non-CCO providers. The 15 CCO providers and 34 non-CCO providers were enrolled by the authority, and 28 non-CCO providers enrolled by the department. For two CCO providers we noted the following issues: • Ownership and Control disclosure for one authority CCO was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority has since obtained the missing support. • Managing Employee disclosures for one authority CCO was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. For seven non-CCO providers we noted the following issues: • Ownership and Control and Managing Employee disclosures for one authority provider was incomplete. Based on our review of available support we were able to determine these to be eligible providers. • I-9 forms for two authority providers and one department provider were not complete. Based on our review of available support we were able to determine these to be eligible providers. • I-9 form and Ownership and Control disclosure was incomplete for one department provider. Based on our review of other available support we were able to determine this to be an eligible provider during the fiscal year. • I-9 form for one department provider could not be located. The department has since obtained a completed I-9 form. • I-9 form, agreement, and disclosures for one department provider could not be located. Auditor was unable to determine eligibility for this provider resulting in federal questioned costs for the fiscal year totaling $1,786. Additionally, in prior year finding number 2022-057 we noted one department provider with an incomplete I-9 form. The department did not obtain an updated I-9 form during fiscal year 2023 resulting in federal questions costs for the fiscal year 2023 totaling $1,843. The above issues occurred due to human error and inadequate record maintenance which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers including ineligible providers identified in prior year findings.

2023-024 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $3,849 (known) Criteria: 2 CFR 200.1(1); 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations only allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors, which the department did not identify during their review process, that resulted in improper payment of Medicaid expenditures: • For one payment, management was unable to provide documentation to support charges related to the Medicaid program, resulting in known federally funded questioned costs of $2,153. • For one payment the expenditure was not related to Medicaid services, resulting in known federally funded questioned costs of $1,697. The above issues occurred due to human error and inadequate record maintenance which could lead to unallowed activities/costs being charged to the Medicaid program. We recommend department management strengthen controls over review to ensure transactions are adequately supported and reviewed. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2023-033 Oregon Department of Emergency Management Implement controls over FFATA reporting Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021; FEMA-4499-DR-OR, 2020 (COVID-19) Compliance Requirement: Reporting Type of Finding: Material Weakness; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a), (c)-(d); 2 CFR 170, Appendix A I(a) The Federal Funding Accountability and Transparency Act (FFATA) requires the department to submit information for any subaward action that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Department management stated there were no established internal controls over FFATA reporting that would ensure accurate, complete, and timely submission or tracking of subrecipient data. As a result, we were unable to perform tests of controls. We judgmentally selected five of the 678 subawards identified by ODEM as meeting the threshold for FFATA reporting in fiscal year 2023 for compliance review. The department indicated that none of the five selections had been reported as required; however, auditors independently verified on USAspending.gov that one of the subawards had been submitted. Department management stated that noncompliance with FFATA reporting requirements during the fiscal year was due to multiple factors, including a departmental restructuring, lack of established controls and procedures for identifying, reporting, and tracking the status of projects meeting the reporting threshold; turnover of key personnel; and inadequate training of the compliance requirements for staff. There is a risk the federal awarding agency could withhold grant funding if the department is not compliant with reporting requirements. We recommend department management implement controls to ensure all subawards are appropriately tracked and reported. The department should also work with the federal awarding agency to determine what actions it should take for older reports not submitted.

2023-034 Oregon Department of Emergency Management Fully implement subrecipient risk assessments Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared) 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021 FEMA-4499-DR-OR, 2020 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-033 Questioned Costs: N/A Criteria: Criteria: 2 CFR 200.332(b) Federal regulations stipulate that pass-through entities evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring. Monitoring activities should be completed based on the results of the subrecipient’s determined risk. In fiscal year 2020, we noted the department did not have systematic policies and procedures in place to adequately evaluate subrecipients’ risk for noncompliance with federal subrecipient monitoring requirements. In response, the department developed a subrecipient risk assessment policy and procedures, which included risk assessment questionnaires, a scoring matrix, and a tracking mechanism to track distribution and receipt of the questionnaires as well as the subrecipients’ overall risk level. We selected a random sample of 36 subrecipients who had received a payment during the fiscal year and reviewed the department’s February 2024 tracking spreadsheet. Four of the subrecipients had not returned the questionnaire or been evaluated for risk of noncompliance using other available information. One of the four was not listed as a subrecipient on the tracking spreadsheet. Management indicated that due to agency restructuring and the significant turnover of key management and staff during that period, full implementation of the subrecipient risk assessment procedures was still in process. Risk assessments help guide the agency in determining the appropriate level of monitoring for each subrecipient and the nature and extent of procedures to be applied. Without this guidance, the department may not provide an adequate level of monitoring. We recommend department management fully develop and implement its policies and procedures to ensure risk assessments are performed and documented for each subrecipient.

2023-033 Oregon Department of Emergency Management Implement controls over FFATA reporting Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021; FEMA-4499-DR-OR, 2020 (COVID-19) Compliance Requirement: Reporting Type of Finding: Material Weakness; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a), (c)-(d); 2 CFR 170, Appendix A I(a) The Federal Funding Accountability and Transparency Act (FFATA) requires the department to submit information for any subaward action that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Department management stated there were no established internal controls over FFATA reporting that would ensure accurate, complete, and timely submission or tracking of subrecipient data. As a result, we were unable to perform tests of controls. We judgmentally selected five of the 678 subawards identified by ODEM as meeting the threshold for FFATA reporting in fiscal year 2023 for compliance review. The department indicated that none of the five selections had been reported as required; however, auditors independently verified on USAspending.gov that one of the subawards had been submitted. Department management stated that noncompliance with FFATA reporting requirements during the fiscal year was due to multiple factors, including a departmental restructuring, lack of established controls and procedures for identifying, reporting, and tracking the status of projects meeting the reporting threshold; turnover of key personnel; and inadequate training of the compliance requirements for staff. There is a risk the federal awarding agency could withhold grant funding if the department is not compliant with reporting requirements. We recommend department management implement controls to ensure all subawards are appropriately tracked and reported. The department should also work with the federal awarding agency to determine what actions it should take for older reports not submitted.

2023-034 Oregon Department of Emergency Management Fully implement subrecipient risk assessments Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared) 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021 FEMA-4499-DR-OR, 2020 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-033 Questioned Costs: N/A Criteria: Criteria: 2 CFR 200.332(b) Federal regulations stipulate that pass-through entities evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring. Monitoring activities should be completed based on the results of the subrecipient’s determined risk. In fiscal year 2020, we noted the department did not have systematic policies and procedures in place to adequately evaluate subrecipients’ risk for noncompliance with federal subrecipient monitoring requirements. In response, the department developed a subrecipient risk assessment policy and procedures, which included risk assessment questionnaires, a scoring matrix, and a tracking mechanism to track distribution and receipt of the questionnaires as well as the subrecipients’ overall risk level. We selected a random sample of 36 subrecipients who had received a payment during the fiscal year and reviewed the department’s February 2024 tracking spreadsheet. Four of the subrecipients had not returned the questionnaire or been evaluated for risk of noncompliance using other available information. One of the four was not listed as a subrecipient on the tracking spreadsheet. Management indicated that due to agency restructuring and the significant turnover of key management and staff during that period, full implementation of the subrecipient risk assessment procedures was still in process. Risk assessments help guide the agency in determining the appropriate level of monitoring for each subrecipient and the nature and extent of procedures to be applied. Without this guidance, the department may not provide an adequate level of monitoring. We recommend department management fully develop and implement its policies and procedures to ensure risk assessments are performed and documented for each subrecipient.

2023-039 Oregon Health Authority Ensure program payroll costs are incurred only for program staff Federal Awarding Agency: U.S. Department of Agriculture Assistance Listing Number and Name: 10.557 Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Federal Award Numbers and Years: 237OROR7W1003, 2023; 237OROR7W1006, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $18,002 (known) Criteria: 2 CFR 200.413(b) Federal regulations permit costs charged directly to a Federal award, such as compensation of employees who work on that award and their related fringe benefit costs. Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) management is responsible for ensuring employees with payroll related costs charged directly to the Federal award are employees who work on that award. From a population of 550 monthly payroll costs for 57 employees, we randomly selected a sample of 25 to verify monthly time was approved by management and employees directly work on the WIC award. We found one employee who should not have recorded payroll costs to the WIC program, as the employee was on a job rotation outside the program. The employee’s time was properly approved, but the review did not identify the costs were charged to program. We reviewed all payroll related costs for the employee and identified questioned costs of $7,970 for fiscal year 2023. We expanded our review and identified two additional employees who were charging their time to the WIC program inappropriately, resulting in total actual questioned costs of $18,002. We recommend program management implement additional internal controls over payroll related costs to ensure all costs charged to the program are related to employees who work directly on the award.

2023-015 Oregon Housing and Community Services Fully implement controls to ensure subrecipients are in compliance with program requirements Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Equipment and Real Property Management; Matching, Level of Effort, Earmarking; Procurement, Suspension, and Debarment, Special Tests and Provisions Type of Finding: Material Weakness Prior Year Findings: 2022-018, 2022-019, 2022-020, 2022-021, 2022-024 Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 2 CFR 200.311; 2 CFR 200.313; 2 CFR 200.317 - .327; 24 CFR 576.100; 24 CFR 576.101(c); 24 CFR 576.102(c) The Emergency Solutions Grants (ESG/ESG-CV) program is operated by the department via pass-through funds to subrecipients. With the significant influx of pandemic relief funds, the department expanded the number of subrecipients partnered with from 17 longstanding community action agencies (CAAs) to a total of 45 CAA and non-CAA subrecipients. During fiscal year 2023, 98% of program expenditures were passed through to 40 of these subrecipients. Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance program expenditures are in compliance with the terms and conditions of the federal award. However, the significant increases to federal funding the creation and implementation of a new award system for non-CAA recipients, and the increase in the number of subrecipients, along with a period of high employee turnover led to delays in the department’s development and implementation of sufficient subrecipient monitoring processes that would meet this objective. Department management subsequently contracted with a private auditing firm to assist in the monitoring of the program activities and expenditures of funds passed through to the subrecipients to remedy the noted control weaknesses. Department staff and the private auditing firm are currently working through the monitoring backlog. However, at the time of the audit, monitoring of only 16 of the 40 subrecipients had been completed which represents 58% of the fiscal year 2023 pass-through expenditures. Additionally, the completed monitoring was only performed over fiscal year 2022 expenditures as the department works to catch up on monitoring of prior year expenditures. Incomplete monitoring could lead to program noncompliance. We recommend department management complete the review and monitoring of program funds passed through to subrecipients for compliance with all applicable program requirements.

2023-016 Oregon Housing and Community Services Verification that subrecipients have not been suspended or debarred needs to be retained Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirements: Procurement and Suspension and Debarment Type of Finding: Material Weakness Prior Year Finding: 2022-022 Questioned Costs: N/A Criteria: 2 CFR 200.317 - .327 The prior-year audit noted that procurement processes were not followed. Specifically, evidence the department verified non-community action agencies receiving Emergency Solutions Grant Program and ESG-CV money were not suspended or debarred was not retained. During the audit, we attempted to review the suspension and debarment status of those entities that had received ESG and ESG-CV funds in 2023. We found the department did not retain evidence the suspension and debarment status of subrecipients was verified. Management stated this was due to the contracts being executed prior to fiscal year 2023. Due to employee turnover, it was unclear whether the verifications had not been performed or documentation had not been retained. Current procurement staff have since developed procedures to ensure future compliance with suspension and debarment requirements. We recommend department management perform and retain evidence of checks of suspension and debarment for all new and existing contracts.

2023-045 Oregon Housing and Community Services Obtain documentation to support expenditures or pursue cost recovery Federal Awarding Agency: U.S. Department of Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance (COVID-19) Federal Award Numbers and Years: ERA 1, 2021 (COVID-19); ERA 2, 2021 (COVID-19) Compliance Requirements: Activities Allowed or Unallowed, Eligibility, Period of Performance Type of Finding: Noncompliance Prior Year Finding: N/A Questioned Costs: $96,624 (known) Criteria: 2 CFR 200.332(d); 2 CFR 200.501(g) Department management is responsible for monitoring the activities of subrecipients to ensure subawards are used for authorized purposes and are compliant with federal requirements. Additionally, department management is responsible for ensuring compliance when a contractor is responsible for program compliance. The department passed through funds to 17 community action agencies (subrecipients) and a third-party vendor (contractor) to provide program delivery. Program delivery included determining client eligibility and making payments for direct client assistance for rent, utilities, internet, and other housing related costs. During the fiscal year, the department performed program reviews for each of the subrecipients and the contractor to determine whether funds were paid to eligible clients for allowable activities. We selected eight subrecipient program reviews and the contractor review for testing. The department reviewed 175 client applications that were processed and approved for payment across the eight selected subrecipients. We reviewed the department’s program monitoring reports and identified 91 client applications with potential exceptions related to federal requirements. Our testing found 67 client applications with exceptions totaling $74,857 in questioned costs. The department reviewed a total of 60 individual client applications processed and approved for payment by the contractor. We reviewed the department’s program monitoring report and identified 16 client applications with potential exceptions related to federal requirements. Our testing found five client applications with exceptions totaling $21,767 in questioned costs. The majority of exceptions were due to a lack of sufficient documentation being maintained to ensure assistance was only provided to eligible clients for allowable costs within the applicable time period. We recommend department management coordinate with their subrecipients and contractor to obtain additional documentation to ensure compliance with federal requirements or to recover amounts paid that are not in compliance with federal requirements.

2023-044 Oregon Housing and Community Services Ensure that the nature of program applicants' financial hardship is documented Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.026 Homeowner’s Assistance Fund (COVID-19) Federal Award Numbers and Years: HAF0027, 2023 (COVID-19) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: U.S. Department of the Treasury Homeowners Assistance Fund: Guidance on Participant Compliance and Reporting Responsibilities (dated 5/9/22 and revised 1/12/24); Homeowners Assistance Fund Guidance (dated 6/12/23) Prior to disbursing Homeowners’ Assistance Fund (HAF) awards, the Department is required to obtain and document applicants’ attestations that they have endured a financial hardship due to the pandemic. Additionally, the attestations must include a description of the nature of the applicants’ financial hardship (e.g. loss/reduction of income or risk of home foreclosure). The Department requires pre-qualification checklists to be completed during the application process to ensure, in addition to several other requirements, that the applicants’ attestations of financial hardship due to the pandemic are obtained. In our testing of HAF eligibility compliance requirements, we randomly selected 40 HAF applicants that received program assistance from the department during fiscal year 2023. We found that for three sample items, while pre-qualification checklists were completed and attestations of financial hardship were obtained, program staff did not ensure a description of the nature of applicants’ financial hardship was documented. However, no income determination exceptions were identified; all applicants tested were under the program income limit. Not requiring and documenting the nature of the financial hardship could result in program benefits being awarded to ineligible applicants. We recommend management implement controls to ensure that the nature of HAF applicants’ financial hardship is documented as required by federal guidance.

2023-043 Oregon Business Development Department Management should implement accounting review of quarterly reports before submitting to DAS Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR § 200.303(a) Recipients of Coronavirus State and Local Fiscal Recovery Funds (SLFRF) are required to provide quarterly project and expenditure reports to the Department of Administrative Services (DAS) who then compile the information and submit it to the US Department of Treasury. Each report contains detailed project information, including current period obligation, cumulative obligation, current period expenditure, and cumulative expenditure. Department management is responsible for establishing and maintaining effective internal controls that provide reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. The department’s reporting process did not include a review by accounting staff to ensure reports included all activity of the reporting period and agreed to accounting records. As a result, reports were submitted to DAS with inaccurate information resulting in reporting errors. Failure to report accurate expenditures and obligations could result in a loss of SLFRF funds. We recommend the department include an accounting review of SLFRF reports prior to submitting to DAS.

2023-028 Department of Human Services Strengthen controls to ensure adequate supporting documentation and accuracy over reporting Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220054, 2022; H126A230054, 2023 Compliance Requirement: Reporting Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 29 USC 721(a)(10); 2 CFR 200.303 The department is required to submit quarterly performance and financial program reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment (IPE), services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. The Vocational Rehabilitation Financial Report (RSA-17) is a quarterly report of cumulative VR financial data on an award by award basis. Federal regulations require financial reports include all activity of the reporting period and be supported by applicable accounting records. We reviewed 15 out of 24,176 clients from the September 2022 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we identified the following: • Three clients receiving pre-employment transition services without documentation supporting the type of service provided. • The date of application reported for two clients did not agree to supporting documentation. • The date of eligibility determination for two clients did not agree to supporting documentation. Additionally, the department could not provide documentation to support the date of eligibility determination for a third client. • The department could not provide documentation for three clients to support the start date of employment in primary occupation. • The department could not provide documentation for five clients to support the hourly wage at exit. In fiscal year 2023, eight RSA-17 reports were submitted for fiscal year 2023; two were selected for review. During our testing, we identified one report did not provide the appropriate federal share of allowable expenditures, overstating the line item by $2,859,149. Without maintaining supporting documentation that substantiates the accuracy of the case information reported, the agency may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 and RSA-17 reports are used by the Federal government to evaluate and monitor the financial and programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. We recommend department management strengthen internal controls to ensure adequate supporting documentation is maintained to support information reported in the RSA-911 client case information report. We also recommend department management strengthen internal controls to ensure the reviews of the RSA-17 financial report are documented and the report contains accurate information.

2023-029 Department of Human Services Strengthen controls over program expenditures Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220054, 2022; H126A230054, 2023 Compliance Requirement(s): Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Material Weakness; Noncompliance Prior Year Finding: N/A Questioned Costs: $149 (known); $871,943 (likely) Criteria: 29 USC 723(a); 29 USC 702(b); OAM 10.15.00.po The Vocational Rehabilitation (VR) program provides services to clients to assist in preparing for, securing, retaining, or regaining employment. VR funds may be used to carry out the purpose of the program, pay personnel, and administer the VR program. All transactions paid for with VR funds must be supported by appropriate documentation. We selected a random sample of 21 out of 14,436 expenditures, representing payments made for client services and payments to administer the program, and identified the following: • Three transactions where the department was unable to provide supporting documentation, resulting in $139 of actual questioned cost. • One transaction where the department was unable to provide documentation showing the transaction was approved. • One transaction where the expenditure exceeded the actual cost of the client service, resulting in $10 of actual questioned cost. These transactions resulted in $149 of actual questioned costs and when projected to the population resulted in $871,943 of likely questioned costs. We recommend department management strengthen internal controls to ensure supporting documentation is maintained, reviews are documented, and transactions agree to supporting documentation.

2023-030 Department of Human Services Strengthen controls over payroll expenditures Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220054, 2022; H126A230054, 2023 Compliance Requirement(s): Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $3,521 (known) Criteria: 29 USC 723(a); 29 USC 702(b) The Vocational Rehabilitation (VR) program provides services to clients to assist in preparing for, securing, retaining, or regaining employment. Accordingly, funds may be used to carry out the purpose of the program, pay personnel, and administer the VR program. From a population of 2,368 monthly payroll costs, we selected a random sample of 21 to verify monthly time was approved by management and employees directly work on the VR award. Of those 21 costs, we identified one paid with VR funds but was a board member for a program other than VR. We expanded our review to include all board members paid with VR funds, and identified a total of two board members who were charging time to VR inappropriately, resulting in total actual questioned cost of $3,521. The board members’ time was coded incorrectly and a separate monthly review of employees charging time to the VR program failed to identify these board members were inappropriately paid with VR funds. We recommend department management implement and document additional internal controls to ensure only VR employees are paid with VR funding.

2023-031 Oregon Commission for the Blind Improve controls over compliance reporting Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220055, 2022; H126A230055, 2023 Compliance Requirement(s): Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State VR agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment (IPE), services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the commission to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed five clients out of 737 from the September 2022 report to ensure the information contained in selected fields agreed to supporting documentation. Testing results identified two clients where the commission could not provide documentation to support the start date of employment in the primary occupation and the hourly wage at exit as reported and contained in the case management system. Without maintaining supporting documentation of the case information reported, the commission may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. We recommend commission management strengthen internal controls to ensure the RSA-911 client case information report contains accurate information and is supported.

2023-032 Oregon Commission for the Blind Seek clarification from federal awarding agency on appropriateness of legal fees Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220055, 2022; H126A230055, 2023 Compliance Requirement(s): Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Noncompliance Prior Year Finding: N/A Questioned Costs: $10,289 (known) Criteria: 29 USC 702(b); 29 USC 723(a) The Vocational Rehabilitation (VR) program provides services to clients to assist in preparing for, securing, retaining, or regaining employment. VR funds may be used to carry out the purpose of the program, pay personnel, and administer the VR program. During our review, we noted VR funds were being used to pay for legal fees. The use of federal funds to pay for legal fees is allowable in specific situations. Due to attorney client privilege, we were unable to obtain sufficient, appropriate audit evidence to determine if the use of VR funds to pay for these legal fees is appropriate. As a result, we are questioning $10,289 in expenditures related to the payment of legal fees. We recommend commission management request clarification from the federal awarding agency regarding the appropriateness of using VR funds for legal fees.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-042 Oregon Department of Education Retain support for pre-approval of equipment purchases Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D 84.425U & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C210048, 2021 (COVID-19); S425D210049, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Equipment Type of Finding: Significant Deficiency: Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.439; 2 CFR 200.303 Capital expenditures for general and special purpose equipment purchases are subject to prior approval by the state agency. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Education Stabilization Funds can be used to purchase equipment that meets the overall purpose of the Education Stabilization Fund, which is to prevent, prepare for, and respond to the COVID-19 pandemic. Department procedure is for subrecipients to submit a capital request forms to the department for approval. Education will email an approval to the subrecipient. We tested 61 equipment purchases made during fiscal year 2023 and found that for one an approval could not be located. As no approval could be found, we were unable to determine if prior approval was made for the equipment. According to department management, documentation could not be located. If documentation is not retained, there is a risk that funds expended are not in compliance with federal requirements. We recommend the department retain documentation regarding every equipment approval.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-042 Oregon Department of Education Retain support for pre-approval of equipment purchases Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D 84.425U & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C210048, 2021 (COVID-19); S425D210049, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Equipment Type of Finding: Significant Deficiency: Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.439; 2 CFR 200.303 Capital expenditures for general and special purpose equipment purchases are subject to prior approval by the state agency. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Education Stabilization Funds can be used to purchase equipment that meets the overall purpose of the Education Stabilization Fund, which is to prevent, prepare for, and respond to the COVID-19 pandemic. Department procedure is for subrecipients to submit a capital request forms to the department for approval. Education will email an approval to the subrecipient. We tested 61 equipment purchases made during fiscal year 2023 and found that for one an approval could not be located. As no approval could be found, we were unable to determine if prior approval was made for the equipment. According to department management, documentation could not be located. If documentation is not retained, there is a risk that funds expended are not in compliance with federal requirements. We recommend the department retain documentation regarding every equipment approval.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-040 Oregon Department of Education State did not meet maintenance of effort requirement Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425U Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425U210049, 2021 (COVID-19) Compliance Requirement: Matching, Level of Effort, Earmarking Type of Finding: Material Weakness; Noncompliance Prior Year Finding: 2022-065 Questioned Costs: N/A Criteria: Section 2004(a)(1) of the American Rescue Plan (ARP) ACT; 2 CFR 200.303 The ARP ACT require the State to maintain support for both elementary and secondary education and for higher education in fiscal year 2023 at least at the proportional level of the state’s support for elementary and secondary education and for higher education relative to the state’s overall spending, averaged over fiscal years 2017, 2018 and 2019. The Department of Education (department) did not meet the maintenance of effort provisions for fiscal year 2023 for elementary and secondary education. Although the state’s overall funding increased for education, its proportional level relative to Oregon’s overall spending declined. The department is reliant on the legislative budget process. On July 31, 2023, the federal agency approved the State’s request for a waiver for maintenance of effort for fiscal year 2022 but did not approve waiver request for fiscal year 2023. The department submitted a new waiver request to the U.S. Department of Education dated March 14, 2024. According to department management, budget changes and obtaining a clearer understanding of the State’s Other Fund amount delayed the calculation for maintenance of effort. The total federal expenditures for the Education Stabilization Fund program for the fiscal year ended June 30, 2023 were $407 million. If the waiver is not approved, the department may be asked to return some of the funds. We recommend department management continue to actively track whether it will meet the maintenance of effort requirement and communicate with the federal awarding agency.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-042 Oregon Department of Education Retain support for pre-approval of equipment purchases Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D 84.425U & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C210048, 2021 (COVID-19); S425D210049, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Equipment Type of Finding: Significant Deficiency: Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.439; 2 CFR 200.303 Capital expenditures for general and special purpose equipment purchases are subject to prior approval by the state agency. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Education Stabilization Funds can be used to purchase equipment that meets the overall purpose of the Education Stabilization Fund, which is to prevent, prepare for, and respond to the COVID-19 pandemic. Department procedure is for subrecipients to submit a capital request forms to the department for approval. Education will email an approval to the subrecipient. We tested 61 equipment purchases made during fiscal year 2023 and found that for one an approval could not be located. As no approval could be found, we were unable to determine if prior approval was made for the equipment. According to department management, documentation could not be located. If documentation is not retained, there is a risk that funds expended are not in compliance with federal requirements. We recommend the department retain documentation regarding every equipment approval.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-042 Oregon Department of Education Retain support for pre-approval of equipment purchases Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D 84.425U & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C210048, 2021 (COVID-19); S425D210049, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Equipment Type of Finding: Significant Deficiency: Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.439; 2 CFR 200.303 Capital expenditures for general and special purpose equipment purchases are subject to prior approval by the state agency. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Education Stabilization Funds can be used to purchase equipment that meets the overall purpose of the Education Stabilization Fund, which is to prevent, prepare for, and respond to the COVID-19 pandemic. Department procedure is for subrecipients to submit a capital request forms to the department for approval. Education will email an approval to the subrecipient. We tested 61 equipment purchases made during fiscal year 2023 and found that for one an approval could not be located. As no approval could be found, we were unable to determine if prior approval was made for the equipment. According to department management, documentation could not be located. If documentation is not retained, there is a risk that funds expended are not in compliance with federal requirements. We recommend the department retain documentation regarding every equipment approval.

2023-025 Department of Human Services Obtain accurate information from the ONE application Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF) Federal Award Numbers and Years: 2022G996115, 2022; 2023G996115, 2023 Compliance Requirements: Matching, Level of Effort, Earmarking; Reporting; Special Tests and Provisions Type of Finding: Material Weakness, Material Noncompliance Prior Year Finding: 2022 035, 2022 036, 2022 038, 2021 009, 2021 010 Questioned Costs: N/A Criteria: 45 CFR 265.3(b), 45 CFR 265.9; 45 CFR 261.1 Federal regulations require the department to collect monthly and report quarterly certain financial and non-financial data elements for services paid with Temporary Assistance for Needy Families (TANF) federal funding in the ACF-199 TANF data report. Federal regulations also require the department to report data quarterly for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the ACF-209 SSP-MOE data report. Both data reports should be supported by applicable performance records. During fiscal year 2021, the department transitioned key aspects of the TANF program to Oregon Eligibility (ONE) for case management, while TANF child welfare payments continued to be recorded in OR-Kids, the child welfare system. The department contracts with a service provider to extract data from ONE and OR-Kids to populate the data reports. Program staff currently work with the service provider to obtain comprehensive data reports prior to submission to review them for errors and when found, each issue is logged as a defect for the service provider to correct. The department and the U.S. Administration for Children and Families identified data reports submitted for state fiscal year 2023 were incorrect and the department was unable to provide corrected data during our audit. As the performance data reports are known to be incomplete and inaccurate, we are unable to test the reports for compliance with multiple program requirements. Specifically, we were unable to perform testing for • Earmarking requirements to ensure less than 20% of clients have been enrolled in the program for over 60 months; • Reporting requirements relating to the ACF 199R and ACF 209R reports on program performance; • Special tests and provisions relating to client penalties for refusal to work; • Special tests and provisions relating to lack of child care for single custodial parents of children under the age of six, and; • Special tests and provisions relating to client penalties for failure to comply with work verification plans. To date, the implementation of ONE has not resolved findings related to performance data reporting, which have been ongoing since fiscal year 2010. Though the department has yet to receive a Service Organization Control (SOC) report from the service organization administering ONE and compiling data reports, the department expects the report to be completed within the next year. Without an annual SOC report, the department does not have assurance controls are functioning as intended at the service organization for the TANF program. We recommend department management continue to review ACF-199 and ACF-209 reports prior to submission and monitor known compilation defects to ensure performance data reports submitted are complete and accurate. We also recommend department management obtain an annual SOC report over the service organization’s internal controls for the ONE application. Additionally, we recommend department management consider contractual and/or legal remedies if the contractor is unable to provide accurate and reliable information from the ONE system within a reasonable time frame necessary for the business needs of the department.

2023-026 Department of Human Services Improve controls relating to client not cooperating with child support requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF) Federal Award Numbers and Years: 2022G996115, 2022; 2023G996115, 2023 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2022-037 Questioned Costs: $790 (known) Criteria: 45 CFR 264.30-31 Federal regulations require the department to refer all appropriate individuals in the family of a child to the child support enforcement agency. If the department determines referred individuals are not cooperating, without good cause, in establishing, modifying, or enforcing a support order with respect to the child, then the department must reduce or deny assistance in the Temporary Assistance for Needy Families (TANF) program. Due to control weaknesses in obtaining reliable information from the ONE application discussed in the finding titled “Obtain accurate information from the ONE application,” we based our testing upon a population provided by the Oregon Department of Justice’s Department of Child Support (DCS). We tested a random sample of 40 of 3,947 clients identified by DCS as non-cooperative with child support enforcement to determine if the department took appropriate action to get the client into compliance or decrease benefits as required by federal regulations. We found for three of the 40 clients, the department did not take timely action to move the client into compliance, did not identify good cause for the client to be exempted, and did not appropriately reduce benefits as required. For each of the three sample items, department staff did not follow established polices and requirements to reduce or suspend client benefits for non-cooperation. For the three items identified, we calculated the known questioned costs of $790 based upon the payments issued from the time DCS notified the department of the non-cooperation (with a one month grace period to allow the department reasonable time to take action) until the benefits were cancelled. We assumed good cause would not have been granted as we could not otherwise find evidence of good cause in the department documentation. Because the information came from DCS, rather than the ONE application, we do not have sufficient information available to reasonably project the questioned costs to the population. We recommend management ensure department employees are adequately trained on applicable procedures and requirements relating to child support cooperation with DCS.

2023-027 Department of Human Services Improve controls to ensure eligibility criteria are met Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF) Federal Award Numbers and Years: 2022G996115, 2022; 2023G996115, 2023 Compliance Requirements: Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2022-039, 2022-040, 2021-011 Questioned Costs: $3,491 (known), $1,281,622 (likely) Criteria: 45 CFR 264.10; 45 CFR 261.11 Federal regulations require each state to participate in the Income Eligibility and Verification System (IEVS), which for Oregon, includes using income and benefit screens accessible through Oregon Employment Department, Internal Revenue Service, and Social Security Administration, when making Temporary Assistance for Needy Families (TANF) eligibility determinations. The department’s current procedure instructs caseworkers to narrate “IEVS checked” in the case management system, Oregon Eligibility (ONE), after reviewing all appropriate IEVS screens at the time of eligibility determination. We tested 60 of 179,990 client benefit months during the year to determine if the clients met the applicable eligibility requirements and the department had performed appropriate data checks in accordance with federal requirements. We identified the following: • For four clients, the department did not document completion of eligibility checks in the Income Eligibility and Verification System (IEVS) prior to issuing the payment. Although control deviations were identified, we did not identify questioned costs for these sample items. • For one client, the department did not complete the required JOBS program enrollment application when the client entered the program. We question costs totaling $3,491 as the amount of benefit payments issued from the initial TANF enrollment date through the date the JOBS screening was completed. The projected questioned costs total $1,281,622. The items above were the result of caseworker errors in completing required enrollment procedures. We recommend department management ensure caseworkers are adequately trained on TANF enrollment procedures to ensure all applicable requirements are completed.

2023-017 Oregon Housing and Community Services Ensure review of federal cash draws are adequately documented to support the draws are for the immediate cash needs of the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Cash Management Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2022-034 Questioned Costs: $14,831.23 (known); $27,652.04 (likely) Criteria: 31 CFR § 205.33(a); 2 CFR § 200.303 Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Cash draws on federal awards should be limited to the minimum amount needed for the immediate cash needs of operating the program. We reviewed 60 randomly selected subrecipient requests for funds, five randomly selected cash draws for the reimbursement of central administrative costs, and one judgmentally selected cash draw for disbursements to subrecipients. We noted the following based on our review: • Five of the subrecipient requests for funds totaling $44,166.54 were for advance payments that did not have sufficient documentation supporting the immediate cash needs of the requests. Without adequate verification of cash needs, the department is at risk of sending funds to subrecipients that are not for the immediate cash needs of the program. • Two of the cash draws for central administrative costs and the one cash draw for disbursements to subrecipients did not have evidence of separate review and approval prior to the drawdown of funds. One of these draws resulted in inadvertently drawing $14,831.23 in funds from the incorrect award. We recommend department management ensure controls are implemented and documented to verify cash draws are for the immediate cash needs of the program and are made on the correct awards.

2023-018 Oregon Housing and Community Services Ensure grant management report control is performed and documented Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2022ORLIEI, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Earmarking; Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR § 200.303; 45 CFR § 96.14(a)(2) The department is subject to various Earmarking and Period of Performance requirements as a condition of their awards under the Low-Income Home Energy Assistance Program (LIHEAP). Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Additionally, management is responsible for evaluating and monitoring the department’s compliance with the terms and conditions of federal awards and taking prompt action when instances of noncompliance are identified. The department’s monthly preparation of the Grant Management Report serves as the control that helps provide assurance over compliance with the Earmarking and Period of Performance requirements. However, according to department management, staffing challenges led to the Grant Management Reports not being consistently prepared throughout state fiscal year 2023. No instances of noncompliance were noted during our testing of the Earmarking requirement. However, we identified one award where the Period of Performance deadline for the obligation of 90% of the award was not met. Without a consistently performed control, the department is subject to increased risk of noncompliance. We recommend department management ensure controls are performed and documented as intended by their established process.

2023-019 Oregon Housing and Community Services Ensure documentation is retained to support amounts reported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. The department is required to submit the Quarterly Performance and Management (Quarterly) Report that contains various data and information including the obligation of funding. During our testing of the Quarterly reports submitted during the state fiscal year 2023 audit period, we identified discrepancies in the obligation totals reported by the department compared to auditor recalculations for two of the four quarters. However, the department was not able to locate documentation supporting the obligation totals included in the reports. We recommend department management ensure adequate controls are in place over reporting and documentation is retained to support the amounts reported.

2023-017 Oregon Housing and Community Services Ensure review of federal cash draws are adequately documented to support the draws are for the immediate cash needs of the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Cash Management Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2022-034 Questioned Costs: $14,831.23 (known); $27,652.04 (likely) Criteria: 31 CFR § 205.33(a); 2 CFR § 200.303 Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Cash draws on federal awards should be limited to the minimum amount needed for the immediate cash needs of operating the program. We reviewed 60 randomly selected subrecipient requests for funds, five randomly selected cash draws for the reimbursement of central administrative costs, and one judgmentally selected cash draw for disbursements to subrecipients. We noted the following based on our review: • Five of the subrecipient requests for funds totaling $44,166.54 were for advance payments that did not have sufficient documentation supporting the immediate cash needs of the requests. Without adequate verification of cash needs, the department is at risk of sending funds to subrecipients that are not for the immediate cash needs of the program. • Two of the cash draws for central administrative costs and the one cash draw for disbursements to subrecipients did not have evidence of separate review and approval prior to the drawdown of funds. One of these draws resulted in inadvertently drawing $14,831.23 in funds from the incorrect award. We recommend department management ensure controls are implemented and documented to verify cash draws are for the immediate cash needs of the program and are made on the correct awards.

2023-018 Oregon Housing and Community Services Ensure grant management report control is performed and documented Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2022ORLIEI, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Earmarking; Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR § 200.303; 45 CFR § 96.14(a)(2) The department is subject to various Earmarking and Period of Performance requirements as a condition of their awards under the Low-Income Home Energy Assistance Program (LIHEAP). Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Additionally, management is responsible for evaluating and monitoring the department’s compliance with the terms and conditions of federal awards and taking prompt action when instances of noncompliance are identified. The department’s monthly preparation of the Grant Management Report serves as the control that helps provide assurance over compliance with the Earmarking and Period of Performance requirements. However, according to department management, staffing challenges led to the Grant Management Reports not being consistently prepared throughout state fiscal year 2023. No instances of noncompliance were noted during our testing of the Earmarking requirement. However, we identified one award where the Period of Performance deadline for the obligation of 90% of the award was not met. Without a consistently performed control, the department is subject to increased risk of noncompliance. We recommend department management ensure controls are performed and documented as intended by their established process.

2023-019 Oregon Housing and Community Services Ensure documentation is retained to support amounts reported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. The department is required to submit the Quarterly Performance and Management (Quarterly) Report that contains various data and information including the obligation of funding. During our testing of the Quarterly reports submitted during the state fiscal year 2023 audit period, we identified discrepancies in the obligation totals reported by the department compared to auditor recalculations for two of the four quarters. However, the department was not able to locate documentation supporting the obligation totals included in the reports. We recommend department management ensure adequate controls are in place over reporting and documentation is retained to support the amounts reported.

2023-020 Oregon Health Authority Implement controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023; 1B09SM085378, 2021 (COVID-19); 1B09SM085906, 2021 (COVID-19); 1B09SM083994, 2021 (COVID-19) 93.959: 1B08TI083472, 2021; 1B08TI084667, 2022; 1B08TI085829, 2023; B08TI083963, 2021 (COVID-19); B08TI084603, 2021 (COVID-19); B08TI083513, 2021 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2022-043 Questioned Costs: N/A Criteria: 45 CFR 75.351(a); 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require pass-through entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of eight of 58 Mental Health Block Grant (MHBG) and 16 of 126 Substance Abuse Block Grant (SABG) recipient contracts with expenditures recorded during state fiscal year 2023. Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • Two recipients of MHBG funds were classified as subrecipients by the department, but it was unclear if each met the definition of a subrecipient. • One recipient of MHBG funds and three recipients of SABG funds were classified as a contractor and appeared to meet the definition of a contractor; however, payments made to these recipients were recorded as passthrough expenditures. • One recipient of MHBG funds was not included in the department’s Federal Funding Accountability and Transparency Act (FFATA) reporting. The oversight is due to the recipient being categorized as a subrecipient in the contract but as a contractor in the department’s database used to track subrecipients requiring FFATA reporting. In addition, we followed up on similar errors noted during the prior fiscal year. Two recipients of MHBG funds and one recipient of SABG funds were inappropriately categorized as subrecipients in the prior fiscal year and reported passthrough expenditures in state fiscal year 2023. During the prior audit, the department agreed one of the entities in question should be a contractor and the related expenditures should be reported as direct rather than passthrough. We also noted both direct and passthrough expenditures were reported for two counties receiving MHBG funds; however, the contracts did not clearly indicate what expenditures would be considered direct expenditures, and which would be considered passthrough to the counties. The above issues did not result in questioned costs. However, a total of $724,634 in MHBG funds and $235,000 in SABG funds were reported as passthrough expenditures and should have been reported as direct expenditures. Finally, we inquired of the department’s risk assessment and monitoring activities for subrecipients. Based on our inquiries, the department does not have a formal implemented process for performing risk assessments to determine appropriate monitoring activities. Moreover, the department has not implemented a formal process to ensure subrecipients comply with federal regulations, terms, and conditions of the subaward, and subaward performance goals are achieved. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals may not be met. We recommend department management ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to risk assessment results.

2023-020 Oregon Health Authority Implement controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023; 1B09SM085378, 2021 (COVID-19); 1B09SM085906, 2021 (COVID-19); 1B09SM083994, 2021 (COVID-19) 93.959: 1B08TI083472, 2021; 1B08TI084667, 2022; 1B08TI085829, 2023; B08TI083963, 2021 (COVID-19); B08TI084603, 2021 (COVID-19); B08TI083513, 2021 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2022-043 Questioned Costs: N/A Criteria: 45 CFR 75.351(a); 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require pass-through entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of eight of 58 Mental Health Block Grant (MHBG) and 16 of 126 Substance Abuse Block Grant (SABG) recipient contracts with expenditures recorded during state fiscal year 2023. Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • Two recipients of MHBG funds were classified as subrecipients by the department, but it was unclear if each met the definition of a subrecipient. • One recipient of MHBG funds and three recipients of SABG funds were classified as a contractor and appeared to meet the definition of a contractor; however, payments made to these recipients were recorded as passthrough expenditures. • One recipient of MHBG funds was not included in the department’s Federal Funding Accountability and Transparency Act (FFATA) reporting. The oversight is due to the recipient being categorized as a subrecipient in the contract but as a contractor in the department’s database used to track subrecipients requiring FFATA reporting. In addition, we followed up on similar errors noted during the prior fiscal year. Two recipients of MHBG funds and one recipient of SABG funds were inappropriately categorized as subrecipients in the prior fiscal year and reported passthrough expenditures in state fiscal year 2023. During the prior audit, the department agreed one of the entities in question should be a contractor and the related expenditures should be reported as direct rather than passthrough. We also noted both direct and passthrough expenditures were reported for two counties receiving MHBG funds; however, the contracts did not clearly indicate what expenditures would be considered direct expenditures, and which would be considered passthrough to the counties. The above issues did not result in questioned costs. However, a total of $724,634 in MHBG funds and $235,000 in SABG funds were reported as passthrough expenditures and should have been reported as direct expenditures. Finally, we inquired of the department’s risk assessment and monitoring activities for subrecipients. Based on our inquiries, the department does not have a formal implemented process for performing risk assessments to determine appropriate monitoring activities. Moreover, the department has not implemented a formal process to ensure subrecipients comply with federal regulations, terms, and conditions of the subaward, and subaward performance goals are achieved. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals may not be met. We recommend department management ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to risk assessment results.

2023-021 Oregon Health Authority Implement controls to ensure earmarked expenditures are tracked and compliance achieved Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023 Compliance Requirement: Matching, Level of Effort, Earmarking Type of Finding: Significant Deficiency Prior Year Finding: 2022-044 Questioned Costs: N/A Criteria: 42 USC 300x-9(c)(1); 42 USC 300x-9(d)(1); 2 CFR 200.303 The Mental Health Block Grant (MHBG) is subject to various Earmarking requirements. These requirements ensure the department meets minimum expenditure thresholds. Federal regulations require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department is required to expend 10% of the MHBG federal award for early serious mental illness, including psychotic disorders. It is also required to expend 5% of the federal award for serious mental illnesses and children with serious mental and emotional disturbances. These set asides are calculated and budgeted when the federal awards are granted. Based on testing performed, we concluded the department complied with all applicable Earmarking requirements during state fiscal year 2023. However, during the audit period, the department did not have controls in place to track applicable expenditures to ensure compliance was achieved. Upon inquiry, staff reported the department has now set up structure within the state accounting system, and going forward will track the expenditures. The lack of controls in place to track earmarked expenditures increases the department’s risk of noncompliance with federal program requirements. This was also reported in fiscal year 2022. We recommend department management implement controls to ensure applicable expenditures are adequately tracked and reviewed for compliance with federal Earmarking requirements.

2023-020 Oregon Health Authority Implement controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023; 1B09SM085378, 2021 (COVID-19); 1B09SM085906, 2021 (COVID-19); 1B09SM083994, 2021 (COVID-19) 93.959: 1B08TI083472, 2021; 1B08TI084667, 2022; 1B08TI085829, 2023; B08TI083963, 2021 (COVID-19); B08TI084603, 2021 (COVID-19); B08TI083513, 2021 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2022-043 Questioned Costs: N/A Criteria: 45 CFR 75.351(a); 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require pass-through entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of eight of 58 Mental Health Block Grant (MHBG) and 16 of 126 Substance Abuse Block Grant (SABG) recipient contracts with expenditures recorded during state fiscal year 2023. Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • Two recipients of MHBG funds were classified as subrecipients by the department, but it was unclear if each met the definition of a subrecipient. • One recipient of MHBG funds and three recipients of SABG funds were classified as a contractor and appeared to meet the definition of a contractor; however, payments made to these recipients were recorded as passthrough expenditures. • One recipient of MHBG funds was not included in the department’s Federal Funding Accountability and Transparency Act (FFATA) reporting. The oversight is due to the recipient being categorized as a subrecipient in the contract but as a contractor in the department’s database used to track subrecipients requiring FFATA reporting. In addition, we followed up on similar errors noted during the prior fiscal year. Two recipients of MHBG funds and one recipient of SABG funds were inappropriately categorized as subrecipients in the prior fiscal year and reported passthrough expenditures in state fiscal year 2023. During the prior audit, the department agreed one of the entities in question should be a contractor and the related expenditures should be reported as direct rather than passthrough. We also noted both direct and passthrough expenditures were reported for two counties receiving MHBG funds; however, the contracts did not clearly indicate what expenditures would be considered direct expenditures, and which would be considered passthrough to the counties. The above issues did not result in questioned costs. However, a total of $724,634 in MHBG funds and $235,000 in SABG funds were reported as passthrough expenditures and should have been reported as direct expenditures. Finally, we inquired of the department’s risk assessment and monitoring activities for subrecipients. Based on our inquiries, the department does not have a formal implemented process for performing risk assessments to determine appropriate monitoring activities. Moreover, the department has not implemented a formal process to ensure subrecipients comply with federal regulations, terms, and conditions of the subaward, and subaward performance goals are achieved. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals may not be met. We recommend department management ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to risk assessment results.

2023-020 Oregon Health Authority Implement controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023; 1B09SM085378, 2021 (COVID-19); 1B09SM085906, 2021 (COVID-19); 1B09SM083994, 2021 (COVID-19) 93.959: 1B08TI083472, 2021; 1B08TI084667, 2022; 1B08TI085829, 2023; B08TI083963, 2021 (COVID-19); B08TI084603, 2021 (COVID-19); B08TI083513, 2021 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2022-043 Questioned Costs: N/A Criteria: 45 CFR 75.351(a); 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require pass-through entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of eight of 58 Mental Health Block Grant (MHBG) and 16 of 126 Substance Abuse Block Grant (SABG) recipient contracts with expenditures recorded during state fiscal year 2023. Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • Two recipients of MHBG funds were classified as subrecipients by the department, but it was unclear if each met the definition of a subrecipient. • One recipient of MHBG funds and three recipients of SABG funds were classified as a contractor and appeared to meet the definition of a contractor; however, payments made to these recipients were recorded as passthrough expenditures. • One recipient of MHBG funds was not included in the department’s Federal Funding Accountability and Transparency Act (FFATA) reporting. The oversight is due to the recipient being categorized as a subrecipient in the contract but as a contractor in the department’s database used to track subrecipients requiring FFATA reporting. In addition, we followed up on similar errors noted during the prior fiscal year. Two recipients of MHBG funds and one recipient of SABG funds were inappropriately categorized as subrecipients in the prior fiscal year and reported passthrough expenditures in state fiscal year 2023. During the prior audit, the department agreed one of the entities in question should be a contractor and the related expenditures should be reported as direct rather than passthrough. We also noted both direct and passthrough expenditures were reported for two counties receiving MHBG funds; however, the contracts did not clearly indicate what expenditures would be considered direct expenditures, and which would be considered passthrough to the counties. The above issues did not result in questioned costs. However, a total of $724,634 in MHBG funds and $235,000 in SABG funds were reported as passthrough expenditures and should have been reported as direct expenditures. Finally, we inquired of the department’s risk assessment and monitoring activities for subrecipients. Based on our inquiries, the department does not have a formal implemented process for performing risk assessments to determine appropriate monitoring activities. Moreover, the department has not implemented a formal process to ensure subrecipients comply with federal regulations, terms, and conditions of the subaward, and subaward performance goals are achieved. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals may not be met. We recommend department management ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to risk assessment results.

2023-035 Department of Early Learning and Care Use restricted indirect cost rate when required Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCCC5, 2021 (COVID-19);2101ORCCDD, 2021; 2101ORCDC6, 2021 (COVID-19); 90YE020004, 2021; 2101ORCSC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2301ORCCDD, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $400,369 (known) Criteria: 45 CFR 98.57; 34 CFR 75.563 During fiscal year 2023, the Child Care and Development (CCDF) program was with the Early Learning Division within the Oregon Department of Education (ODE). Effective July 1, 2023, the Department of Early Learning and Care (department) was created and administers the CCDF program. ODE’s indirect rate agreement approved by the U.S. Department of Education was effective during fiscal year 2023. This rate agreement includes two different rates to be used, an unrestricted rate if there is not a supplement restriction and a lower restricted rate if there is. In our review of the indirect rates used by ODE, we identified that ODE only entered the unrestricted rate into their system, while the terms and conditions for the CARES, CRRSA, ARP and Discretionary CCDF awards identified a supplement not supplant restriction. This resulted in ODE requesting reimbursement for the indirect expenditures at a higher rate. As a result of this, ODE incorrectly claimed an additional $400,369 in indirect cost reimbursement. We recommend department management ensure the appropriate indirect cost rate is used in fiscal year 2024. We also recommend the department work with ODE to determine if there are any additional questioned costs from prior fiscal years and work with the federal awarding agency to reimburse the federal agency for any unallowable costs.

2023-036 Department of Early Learning and Care Improve controls over family copay and child care hour calculations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2101ORCCDD, 2021; 2101ORCCC5, 2021 (COVID-19); 2101ORCCDM, 2021; 2101ORCDC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-025 Questioned Costs: $6,310 (known); $18,291 (likely) Criteria: 45 CFR 98.45(b)(5); 42 USC 9858 The Child Care and Development Fund program offers federal funding to states to increase the availability, affordability, and quality of child care services. As required by federal regulations, the department has developed a sliding fee scale, based on family size and income that provides for cost sharing by families that receive child care services (monthly copay). The monthly copay is included on the provider’s monthly bill form provided by the department. If a family has more than one child care provider, one is designated the primary provider based on amount of care provided and receives the copay from the family. The authorized monthly child care hours are calculated based on parent work schedules, commute time, and other factors. The department relies on the ONE eligibility system to verify eligibility, calculate child care hours and monthly copay based on information entered into the system. Payments to providers are based on the returned and completed billing forms. The department allows providers to submit for reimbursement any time during the month. We tested a random sample of 50 families for client eligibility and verification of one monthly benefit payment to the child care provider. As part of the provider payment, we verified the accuracy of the monthly copay and the authorized child care hours. If errors in copay or provider payments were identified, we reviewed additional months to capture all known questioned costs. We identified errors in 13 of 50 sample items resulting in the following errors: • For one case we identified $5,700 in known questioned costs. The client changed child care providers in August 2022. The new provider’s billing form had prorated authorized hours and was correct. The prior provider submitted and was paid for full authorized hours for all children early in August prior to client’s notification. The client changed child care providers again in January 2023 but did not notify the department until late March 2023. The new provider’s billing forms were appropriate. However, the prior provider billed for full time child care in January, February and March. The department should have identified these overpayments when setting up the new child care provider. • Six cases where copay was calculated incorrectly. Four cases were due to human error when entering income in the ONE system. In two cases, the ONE system correctly calculated the copay but the final amount was increased or reduced for reasons unknown. These errors resulted in known questioned costs of $575. • One case where the copay was calculated correctly. However, the client had multiple child care providers and the $5 copay was not attached to the billing form for the providers reimbursed for October 2022 through April 2023 resulting in known questioned costs of $35. • Seven cases in which the authorized child care hours were calculated incorrectly. Errors did not cause any incorrect provider payments. In two cases, it appears the ONE system calculated correctly but the arithmetic is incorrect in final authorized hours. The department could not explain how the final hours were determined. In two cases, when the client end/start of jobs occurred in the same month, the ONE system incorrectly includes hours from the old job in the calculation resulting in authorized hours being too high. The other three cases were caused by human entry errors. • One case where the department was unable to locate either a signed paper application signature or a phone signature. Human entry errors and system errors can lead to errors in determining eligibility and the accuracy of the monthly copay and the authorized child care hours. These errors may lead to improper payments to child care provider by the program. We recommend department management ensure a client’s monthly copay and child care hours are correctly calculated and identify any potential system issues. In addition, when a change in provider occurs, the department should verify the accuracy of payments to the prior provider. We also recommend department management reimburse the federal agency for unallowable costs.

2023-037 Department of Early Learning and Care Improve controls over payroll Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDD, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-029 Questioned Costs: $297 (known); $18,975 (likely) Criteria: 45 CFR 75.403(a); 45 CFR 75.430(a) Federal regulations state that allowable costs are costs necessary and reasonable for the performance of federal awards. Payroll costs directly related to a federal award are allowable costs, provided they are reasonable for the services rendered and are supported. The department has implemented the following procedures to ensure allowable payroll costs are charged to the program. Managers approve monthly timesheets submitted by employees in the state’s payroll system. The department sets cost centers in the payroll system based on position. The State switched to a new payroll system, effective December 2022. With this change, managers no longer review cost center codes when reviewing an employee’s timesheet. Additionally, if a manager has not reviewed a timesheet by a specified date, the payroll system will automatically approve the timesheet, shown with the words “mass approval.” We tested a random sample of 25 employees and judgmentally selected 2 employees to ensure payroll for a month was appropriately charged to the program. We verified whether payroll timesheets were reviewed by a manager and signed position descriptions were retained per state guidelines, and identified the following exceptions: • Position descriptions could not be located for two employees. Both of these employees were terminated and the position descriptions were not retained after they left employment. • Four timesheets, under the new payroll system, were not fully approved by a manager and contained instances of “mass approval” with no other verification that the manager reviewed and approved the employees time for the month. • For two employees, the new payroll system incorrectly charged minimal time to the federal program resulting in questioned costs of $297. The employees’ regular pay was not charged to the program. This occurred as the cost code was not set up and the system defaulted to a previously used cost code. We recommend department management improve its review of timesheets and ensure position descriptions are retained. We also recommend department management develop a report to identify when payroll system incorrectly charges time to a federal program. Finally, we recommend department management reimburse the federal agency for any unallowable costs.

2023-038 Department of Early Learning and Care Retain support and improve controls over reporting Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2001ORCCDF, 2020; 2101ORCCC5, 2021 (COVID-19); 2101ORCDC6, 2021 (COVID-19); 2101ORCCDD, 2021; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDF, 2021; 2101ORCCDM, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) The department is required to submit quarterly ACF 696 reports for each open grant. To ensure the accuracy and completeness of these two reports, the department’s control process requires a review of reports prior to submission. We reviewed three of 12 ACF 696 reports submitted during fiscal year 2023. For all three reports, the department was initially unable to provide the support for the Department of Revenue (DOR) Working Family/Child Care Tax Credits used to help meet the matching and maintenance of effort requirements. The department could not locate the support used to prepare the reports for the DOR tax credits and needed to have DOR provide documentation. Additionally, one of the reports had matching fields that were left blank when the report was submitted even though expenditures were incurred and should have been reported. The department does not have detailed procedures around the use of the tax credits in preparation of the reports and sources of information used in the preparation. Additionally, the review process did not identify the blank fields or missing documentation. These reports provide the federal awarding agency with key information related to the program and errors in reports could alter the amount of funding received by the department in future years. We recommend department management further develop its procedures for claiming the tax credit in the ACF-696 reports. We also recommend the department ensure documentation is maintained with the reports in future years.

2023-035 Department of Early Learning and Care Use restricted indirect cost rate when required Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCCC5, 2021 (COVID-19);2101ORCCDD, 2021; 2101ORCDC6, 2021 (COVID-19); 90YE020004, 2021; 2101ORCSC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2301ORCCDD, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $400,369 (known) Criteria: 45 CFR 98.57; 34 CFR 75.563 During fiscal year 2023, the Child Care and Development (CCDF) program was with the Early Learning Division within the Oregon Department of Education (ODE). Effective July 1, 2023, the Department of Early Learning and Care (department) was created and administers the CCDF program. ODE’s indirect rate agreement approved by the U.S. Department of Education was effective during fiscal year 2023. This rate agreement includes two different rates to be used, an unrestricted rate if there is not a supplement restriction and a lower restricted rate if there is. In our review of the indirect rates used by ODE, we identified that ODE only entered the unrestricted rate into their system, while the terms and conditions for the CARES, CRRSA, ARP and Discretionary CCDF awards identified a supplement not supplant restriction. This resulted in ODE requesting reimbursement for the indirect expenditures at a higher rate. As a result of this, ODE incorrectly claimed an additional $400,369 in indirect cost reimbursement. We recommend department management ensure the appropriate indirect cost rate is used in fiscal year 2024. We also recommend the department work with ODE to determine if there are any additional questioned costs from prior fiscal years and work with the federal awarding agency to reimburse the federal agency for any unallowable costs.

2023-036 Department of Early Learning and Care Improve controls over family copay and child care hour calculations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2101ORCCDD, 2021; 2101ORCCC5, 2021 (COVID-19); 2101ORCCDM, 2021; 2101ORCDC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-025 Questioned Costs: $6,310 (known); $18,291 (likely) Criteria: 45 CFR 98.45(b)(5); 42 USC 9858 The Child Care and Development Fund program offers federal funding to states to increase the availability, affordability, and quality of child care services. As required by federal regulations, the department has developed a sliding fee scale, based on family size and income that provides for cost sharing by families that receive child care services (monthly copay). The monthly copay is included on the provider’s monthly bill form provided by the department. If a family has more than one child care provider, one is designated the primary provider based on amount of care provided and receives the copay from the family. The authorized monthly child care hours are calculated based on parent work schedules, commute time, and other factors. The department relies on the ONE eligibility system to verify eligibility, calculate child care hours and monthly copay based on information entered into the system. Payments to providers are based on the returned and completed billing forms. The department allows providers to submit for reimbursement any time during the month. We tested a random sample of 50 families for client eligibility and verification of one monthly benefit payment to the child care provider. As part of the provider payment, we verified the accuracy of the monthly copay and the authorized child care hours. If errors in copay or provider payments were identified, we reviewed additional months to capture all known questioned costs. We identified errors in 13 of 50 sample items resulting in the following errors: • For one case we identified $5,700 in known questioned costs. The client changed child care providers in August 2022. The new provider’s billing form had prorated authorized hours and was correct. The prior provider submitted and was paid for full authorized hours for all children early in August prior to client’s notification. The client changed child care providers again in January 2023 but did not notify the department until late March 2023. The new provider’s billing forms were appropriate. However, the prior provider billed for full time child care in January, February and March. The department should have identified these overpayments when setting up the new child care provider. • Six cases where copay was calculated incorrectly. Four cases were due to human error when entering income in the ONE system. In two cases, the ONE system correctly calculated the copay but the final amount was increased or reduced for reasons unknown. These errors resulted in known questioned costs of $575. • One case where the copay was calculated correctly. However, the client had multiple child care providers and the $5 copay was not attached to the billing form for the providers reimbursed for October 2022 through April 2023 resulting in known questioned costs of $35. • Seven cases in which the authorized child care hours were calculated incorrectly. Errors did not cause any incorrect provider payments. In two cases, it appears the ONE system calculated correctly but the arithmetic is incorrect in final authorized hours. The department could not explain how the final hours were determined. In two cases, when the client end/start of jobs occurred in the same month, the ONE system incorrectly includes hours from the old job in the calculation resulting in authorized hours being too high. The other three cases were caused by human entry errors. • One case where the department was unable to locate either a signed paper application signature or a phone signature. Human entry errors and system errors can lead to errors in determining eligibility and the accuracy of the monthly copay and the authorized child care hours. These errors may lead to improper payments to child care provider by the program. We recommend department management ensure a client’s monthly copay and child care hours are correctly calculated and identify any potential system issues. In addition, when a change in provider occurs, the department should verify the accuracy of payments to the prior provider. We also recommend department management reimburse the federal agency for unallowable costs.

2023-037 Department of Early Learning and Care Improve controls over payroll Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDD, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-029 Questioned Costs: $297 (known); $18,975 (likely) Criteria: 45 CFR 75.403(a); 45 CFR 75.430(a) Federal regulations state that allowable costs are costs necessary and reasonable for the performance of federal awards. Payroll costs directly related to a federal award are allowable costs, provided they are reasonable for the services rendered and are supported. The department has implemented the following procedures to ensure allowable payroll costs are charged to the program. Managers approve monthly timesheets submitted by employees in the state’s payroll system. The department sets cost centers in the payroll system based on position. The State switched to a new payroll system, effective December 2022. With this change, managers no longer review cost center codes when reviewing an employee’s timesheet. Additionally, if a manager has not reviewed a timesheet by a specified date, the payroll system will automatically approve the timesheet, shown with the words “mass approval.” We tested a random sample of 25 employees and judgmentally selected 2 employees to ensure payroll for a month was appropriately charged to the program. We verified whether payroll timesheets were reviewed by a manager and signed position descriptions were retained per state guidelines, and identified the following exceptions: • Position descriptions could not be located for two employees. Both of these employees were terminated and the position descriptions were not retained after they left employment. • Four timesheets, under the new payroll system, were not fully approved by a manager and contained instances of “mass approval” with no other verification that the manager reviewed and approved the employees time for the month. • For two employees, the new payroll system incorrectly charged minimal time to the federal program resulting in questioned costs of $297. The employees’ regular pay was not charged to the program. This occurred as the cost code was not set up and the system defaulted to a previously used cost code. We recommend department management improve its review of timesheets and ensure position descriptions are retained. We also recommend department management develop a report to identify when payroll system incorrectly charges time to a federal program. Finally, we recommend department management reimburse the federal agency for any unallowable costs.

2023-038 Department of Early Learning and Care Retain support and improve controls over reporting Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2001ORCCDF, 2020; 2101ORCCC5, 2021 (COVID-19); 2101ORCDC6, 2021 (COVID-19); 2101ORCCDD, 2021; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDF, 2021; 2101ORCCDM, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) The department is required to submit quarterly ACF 696 reports for each open grant. To ensure the accuracy and completeness of these two reports, the department’s control process requires a review of reports prior to submission. We reviewed three of 12 ACF 696 reports submitted during fiscal year 2023. For all three reports, the department was initially unable to provide the support for the Department of Revenue (DOR) Working Family/Child Care Tax Credits used to help meet the matching and maintenance of effort requirements. The department could not locate the support used to prepare the reports for the DOR tax credits and needed to have DOR provide documentation. Additionally, one of the reports had matching fields that were left blank when the report was submitted even though expenditures were incurred and should have been reported. The department does not have detailed procedures around the use of the tax credits in preparation of the reports and sources of information used in the preparation. Additionally, the review process did not identify the blank fields or missing documentation. These reports provide the federal awarding agency with key information related to the program and errors in reports could alter the amount of funding received by the department in future years. We recommend department management further develop its procedures for claiming the tax credit in the ACF-696 reports. We also recommend the department ensure documentation is maintained with the reports in future years.

2023-035 Department of Early Learning and Care Use restricted indirect cost rate when required Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCCC5, 2021 (COVID-19);2101ORCCDD, 2021; 2101ORCDC6, 2021 (COVID-19); 90YE020004, 2021; 2101ORCSC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2301ORCCDD, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $400,369 (known) Criteria: 45 CFR 98.57; 34 CFR 75.563 During fiscal year 2023, the Child Care and Development (CCDF) program was with the Early Learning Division within the Oregon Department of Education (ODE). Effective July 1, 2023, the Department of Early Learning and Care (department) was created and administers the CCDF program. ODE’s indirect rate agreement approved by the U.S. Department of Education was effective during fiscal year 2023. This rate agreement includes two different rates to be used, an unrestricted rate if there is not a supplement restriction and a lower restricted rate if there is. In our review of the indirect rates used by ODE, we identified that ODE only entered the unrestricted rate into their system, while the terms and conditions for the CARES, CRRSA, ARP and Discretionary CCDF awards identified a supplement not supplant restriction. This resulted in ODE requesting reimbursement for the indirect expenditures at a higher rate. As a result of this, ODE incorrectly claimed an additional $400,369 in indirect cost reimbursement. We recommend department management ensure the appropriate indirect cost rate is used in fiscal year 2024. We also recommend the department work with ODE to determine if there are any additional questioned costs from prior fiscal years and work with the federal awarding agency to reimburse the federal agency for any unallowable costs.

2023-036 Department of Early Learning and Care Improve controls over family copay and child care hour calculations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2101ORCCDD, 2021; 2101ORCCC5, 2021 (COVID-19); 2101ORCCDM, 2021; 2101ORCDC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-025 Questioned Costs: $6,310 (known); $18,291 (likely) Criteria: 45 CFR 98.45(b)(5); 42 USC 9858 The Child Care and Development Fund program offers federal funding to states to increase the availability, affordability, and quality of child care services. As required by federal regulations, the department has developed a sliding fee scale, based on family size and income that provides for cost sharing by families that receive child care services (monthly copay). The monthly copay is included on the provider’s monthly bill form provided by the department. If a family has more than one child care provider, one is designated the primary provider based on amount of care provided and receives the copay from the family. The authorized monthly child care hours are calculated based on parent work schedules, commute time, and other factors. The department relies on the ONE eligibility system to verify eligibility, calculate child care hours and monthly copay based on information entered into the system. Payments to providers are based on the returned and completed billing forms. The department allows providers to submit for reimbursement any time during the month. We tested a random sample of 50 families for client eligibility and verification of one monthly benefit payment to the child care provider. As part of the provider payment, we verified the accuracy of the monthly copay and the authorized child care hours. If errors in copay or provider payments were identified, we reviewed additional months to capture all known questioned costs. We identified errors in 13 of 50 sample items resulting in the following errors: • For one case we identified $5,700 in known questioned costs. The client changed child care providers in August 2022. The new provider’s billing form had prorated authorized hours and was correct. The prior provider submitted and was paid for full authorized hours for all children early in August prior to client’s notification. The client changed child care providers again in January 2023 but did not notify the department until late March 2023. The new provider’s billing forms were appropriate. However, the prior provider billed for full time child care in January, February and March. The department should have identified these overpayments when setting up the new child care provider. • Six cases where copay was calculated incorrectly. Four cases were due to human error when entering income in the ONE system. In two cases, the ONE system correctly calculated the copay but the final amount was increased or reduced for reasons unknown. These errors resulted in known questioned costs of $575. • One case where the copay was calculated correctly. However, the client had multiple child care providers and the $5 copay was not attached to the billing form for the providers reimbursed for October 2022 through April 2023 resulting in known questioned costs of $35. • Seven cases in which the authorized child care hours were calculated incorrectly. Errors did not cause any incorrect provider payments. In two cases, it appears the ONE system calculated correctly but the arithmetic is incorrect in final authorized hours. The department could not explain how the final hours were determined. In two cases, when the client end/start of jobs occurred in the same month, the ONE system incorrectly includes hours from the old job in the calculation resulting in authorized hours being too high. The other three cases were caused by human entry errors. • One case where the department was unable to locate either a signed paper application signature or a phone signature. Human entry errors and system errors can lead to errors in determining eligibility and the accuracy of the monthly copay and the authorized child care hours. These errors may lead to improper payments to child care provider by the program. We recommend department management ensure a client’s monthly copay and child care hours are correctly calculated and identify any potential system issues. In addition, when a change in provider occurs, the department should verify the accuracy of payments to the prior provider. We also recommend department management reimburse the federal agency for unallowable costs.

2023-037 Department of Early Learning and Care Improve controls over payroll Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDD, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-029 Questioned Costs: $297 (known); $18,975 (likely) Criteria: 45 CFR 75.403(a); 45 CFR 75.430(a) Federal regulations state that allowable costs are costs necessary and reasonable for the performance of federal awards. Payroll costs directly related to a federal award are allowable costs, provided they are reasonable for the services rendered and are supported. The department has implemented the following procedures to ensure allowable payroll costs are charged to the program. Managers approve monthly timesheets submitted by employees in the state’s payroll system. The department sets cost centers in the payroll system based on position. The State switched to a new payroll system, effective December 2022. With this change, managers no longer review cost center codes when reviewing an employee’s timesheet. Additionally, if a manager has not reviewed a timesheet by a specified date, the payroll system will automatically approve the timesheet, shown with the words “mass approval.” We tested a random sample of 25 employees and judgmentally selected 2 employees to ensure payroll for a month was appropriately charged to the program. We verified whether payroll timesheets were reviewed by a manager and signed position descriptions were retained per state guidelines, and identified the following exceptions: • Position descriptions could not be located for two employees. Both of these employees were terminated and the position descriptions were not retained after they left employment. • Four timesheets, under the new payroll system, were not fully approved by a manager and contained instances of “mass approval” with no other verification that the manager reviewed and approved the employees time for the month. • For two employees, the new payroll system incorrectly charged minimal time to the federal program resulting in questioned costs of $297. The employees’ regular pay was not charged to the program. This occurred as the cost code was not set up and the system defaulted to a previously used cost code. We recommend department management improve its review of timesheets and ensure position descriptions are retained. We also recommend department management develop a report to identify when payroll system incorrectly charges time to a federal program. Finally, we recommend department management reimburse the federal agency for any unallowable costs.

2023-038 Department of Early Learning and Care Retain support and improve controls over reporting Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2001ORCCDF, 2020; 2101ORCCC5, 2021 (COVID-19); 2101ORCDC6, 2021 (COVID-19); 2101ORCCDD, 2021; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDF, 2021; 2101ORCCDM, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) The department is required to submit quarterly ACF 696 reports for each open grant. To ensure the accuracy and completeness of these two reports, the department’s control process requires a review of reports prior to submission. We reviewed three of 12 ACF 696 reports submitted during fiscal year 2023. For all three reports, the department was initially unable to provide the support for the Department of Revenue (DOR) Working Family/Child Care Tax Credits used to help meet the matching and maintenance of effort requirements. The department could not locate the support used to prepare the reports for the DOR tax credits and needed to have DOR provide documentation. Additionally, one of the reports had matching fields that were left blank when the report was submitted even though expenditures were incurred and should have been reported. The department does not have detailed procedures around the use of the tax credits in preparation of the reports and sources of information used in the preparation. Additionally, the review process did not identify the blank fields or missing documentation. These reports provide the federal awarding agency with key information related to the program and errors in reports could alter the amount of funding received by the department in future years. We recommend department management further develop its procedures for claiming the tax credit in the ACF-696 reports. We also recommend the department ensure documentation is maintained with the reports in future years.

2023-022 Oregon Department of Human Services/Oregon Health Authority Ensure compliance with federal Medicaid hospital audit requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Special Tests and Provisions – Inpatient Hospital and Long-Term Care Facility Audits Type of Finding: Significant Deficiency; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 42 CFR 447.253(g); 2 CFR 303(a) Federal regulations require management to establish and maintain effective internal control to ensure compliance with federal program requirements. As part of its system of internal control, federal regulations require the Oregon Health Authority (authority) to conduct periodic audits of the financial and statistical records of participating hospitals. Inpatient hospitals are required to report actual costs to the authority who conducts audits of the reported costs. However, during state fiscal year 2023, the authority did not conduct any audits of the 61 hospitals that received Medicaid federal funds. The department had unexpected turnover during the audit period. New staff were hired to fill the vacancy; however, per management training and updating agency tools caused a delay in the completion of audits. As of March 2024, staff started sending out initial report for fiscal years 2021 and 2022 but no cost settlements have been completed. Additionally, the authority still has two outstanding settlements going back to fiscal year 2016. By failing to complete required audits, the authority does not have assurance that participating hospitals use program funds properly, which could lead to inappropriate payments to the hospitals. During the prior audit of state fiscal year 2021, the auditors reported a finding (2021-017) related to missing documentation supporting completed cost settlements. During state fiscal year 2023, the authority reported that corrective action had been taken to address the issue. However, we were unable to verify the status as no cost settlements were completed. We recommend management ensure compliance with federal program requirements by prioritizing the completion and documentation of hospital audits.

2023-023 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Special Tests and Provisions – Provider Eligibility Type of Finding: Material Weakness; Noncompliance Prior Year Finding: 2022-057 Questioned Costs: $3,629(known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.412; 42 CFR 455.414; 42 CFR 455.436 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, the federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type including but not limited to database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organizations (CCO) providers and selected a random sample of 62 non-CCO providers. The 15 CCO providers and 34 non-CCO providers were enrolled by the authority, and 28 non-CCO providers enrolled by the department. For two CCO providers we noted the following issues: • Ownership and Control disclosure for one authority CCO was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority has since obtained the missing support. • Managing Employee disclosures for one authority CCO was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. For seven non-CCO providers we noted the following issues: • Ownership and Control and Managing Employee disclosures for one authority provider was incomplete. Based on our review of available support we were able to determine these to be eligible providers. • I-9 forms for two authority providers and one department provider were not complete. Based on our review of available support we were able to determine these to be eligible providers. • I-9 form and Ownership and Control disclosure was incomplete for one department provider. Based on our review of other available support we were able to determine this to be an eligible provider during the fiscal year. • I-9 form for one department provider could not be located. The department has since obtained a completed I-9 form. • I-9 form, agreement, and disclosures for one department provider could not be located. Auditor was unable to determine eligibility for this provider resulting in federal questioned costs for the fiscal year totaling $1,786. Additionally, in prior year finding number 2022-057 we noted one department provider with an incomplete I-9 form. The department did not obtain an updated I-9 form during fiscal year 2023 resulting in federal questions costs for the fiscal year 2023 totaling $1,843. The above issues occurred due to human error and inadequate record maintenance which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers including ineligible providers identified in prior year findings.

2023-024 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $3,849 (known) Criteria: 2 CFR 200.1(1); 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations only allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors, which the department did not identify during their review process, that resulted in improper payment of Medicaid expenditures: • For one payment, management was unable to provide documentation to support charges related to the Medicaid program, resulting in known federally funded questioned costs of $2,153. • For one payment the expenditure was not related to Medicaid services, resulting in known federally funded questioned costs of $1,697. The above issues occurred due to human error and inadequate record maintenance which could lead to unallowed activities/costs being charged to the Medicaid program. We recommend department management strengthen controls over review to ensure transactions are adequately supported and reviewed. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2023-022 Oregon Department of Human Services/Oregon Health Authority Ensure compliance with federal Medicaid hospital audit requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Special Tests and Provisions – Inpatient Hospital and Long-Term Care Facility Audits Type of Finding: Significant Deficiency; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 42 CFR 447.253(g); 2 CFR 303(a) Federal regulations require management to establish and maintain effective internal control to ensure compliance with federal program requirements. As part of its system of internal control, federal regulations require the Oregon Health Authority (authority) to conduct periodic audits of the financial and statistical records of participating hospitals. Inpatient hospitals are required to report actual costs to the authority who conducts audits of the reported costs. However, during state fiscal year 2023, the authority did not conduct any audits of the 61 hospitals that received Medicaid federal funds. The department had unexpected turnover during the audit period. New staff were hired to fill the vacancy; however, per management training and updating agency tools caused a delay in the completion of audits. As of March 2024, staff started sending out initial report for fiscal years 2021 and 2022 but no cost settlements have been completed. Additionally, the authority still has two outstanding settlements going back to fiscal year 2016. By failing to complete required audits, the authority does not have assurance that participating hospitals use program funds properly, which could lead to inappropriate payments to the hospitals. During the prior audit of state fiscal year 2021, the auditors reported a finding (2021-017) related to missing documentation supporting completed cost settlements. During state fiscal year 2023, the authority reported that corrective action had been taken to address the issue. However, we were unable to verify the status as no cost settlements were completed. We recommend management ensure compliance with federal program requirements by prioritizing the completion and documentation of hospital audits.

2023-023 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Special Tests and Provisions – Provider Eligibility Type of Finding: Material Weakness; Noncompliance Prior Year Finding: 2022-057 Questioned Costs: $3,629(known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.412; 42 CFR 455.414; 42 CFR 455.436 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, the federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type including but not limited to database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organizations (CCO) providers and selected a random sample of 62 non-CCO providers. The 15 CCO providers and 34 non-CCO providers were enrolled by the authority, and 28 non-CCO providers enrolled by the department. For two CCO providers we noted the following issues: • Ownership and Control disclosure for one authority CCO was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority has since obtained the missing support. • Managing Employee disclosures for one authority CCO was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. For seven non-CCO providers we noted the following issues: • Ownership and Control and Managing Employee disclosures for one authority provider was incomplete. Based on our review of available support we were able to determine these to be eligible providers. • I-9 forms for two authority providers and one department provider were not complete. Based on our review of available support we were able to determine these to be eligible providers. • I-9 form and Ownership and Control disclosure was incomplete for one department provider. Based on our review of other available support we were able to determine this to be an eligible provider during the fiscal year. • I-9 form for one department provider could not be located. The department has since obtained a completed I-9 form. • I-9 form, agreement, and disclosures for one department provider could not be located. Auditor was unable to determine eligibility for this provider resulting in federal questioned costs for the fiscal year totaling $1,786. Additionally, in prior year finding number 2022-057 we noted one department provider with an incomplete I-9 form. The department did not obtain an updated I-9 form during fiscal year 2023 resulting in federal questions costs for the fiscal year 2023 totaling $1,843. The above issues occurred due to human error and inadequate record maintenance which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers including ineligible providers identified in prior year findings.

2023-024 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $3,849 (known) Criteria: 2 CFR 200.1(1); 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations only allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors, which the department did not identify during their review process, that resulted in improper payment of Medicaid expenditures: • For one payment, management was unable to provide documentation to support charges related to the Medicaid program, resulting in known federally funded questioned costs of $2,153. • For one payment the expenditure was not related to Medicaid services, resulting in known federally funded questioned costs of $1,697. The above issues occurred due to human error and inadequate record maintenance which could lead to unallowed activities/costs being charged to the Medicaid program. We recommend department management strengthen controls over review to ensure transactions are adequately supported and reviewed. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2023-033 Oregon Department of Emergency Management Implement controls over FFATA reporting Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021; FEMA-4499-DR-OR, 2020 (COVID-19) Compliance Requirement: Reporting Type of Finding: Material Weakness; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a), (c)-(d); 2 CFR 170, Appendix A I(a) The Federal Funding Accountability and Transparency Act (FFATA) requires the department to submit information for any subaward action that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Department management stated there were no established internal controls over FFATA reporting that would ensure accurate, complete, and timely submission or tracking of subrecipient data. As a result, we were unable to perform tests of controls. We judgmentally selected five of the 678 subawards identified by ODEM as meeting the threshold for FFATA reporting in fiscal year 2023 for compliance review. The department indicated that none of the five selections had been reported as required; however, auditors independently verified on USAspending.gov that one of the subawards had been submitted. Department management stated that noncompliance with FFATA reporting requirements during the fiscal year was due to multiple factors, including a departmental restructuring, lack of established controls and procedures for identifying, reporting, and tracking the status of projects meeting the reporting threshold; turnover of key personnel; and inadequate training of the compliance requirements for staff. There is a risk the federal awarding agency could withhold grant funding if the department is not compliant with reporting requirements. We recommend department management implement controls to ensure all subawards are appropriately tracked and reported. The department should also work with the federal awarding agency to determine what actions it should take for older reports not submitted.

2023-034 Oregon Department of Emergency Management Fully implement subrecipient risk assessments Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared) 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021 FEMA-4499-DR-OR, 2020 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-033 Questioned Costs: N/A Criteria: Criteria: 2 CFR 200.332(b) Federal regulations stipulate that pass-through entities evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring. Monitoring activities should be completed based on the results of the subrecipient’s determined risk. In fiscal year 2020, we noted the department did not have systematic policies and procedures in place to adequately evaluate subrecipients’ risk for noncompliance with federal subrecipient monitoring requirements. In response, the department developed a subrecipient risk assessment policy and procedures, which included risk assessment questionnaires, a scoring matrix, and a tracking mechanism to track distribution and receipt of the questionnaires as well as the subrecipients’ overall risk level. We selected a random sample of 36 subrecipients who had received a payment during the fiscal year and reviewed the department’s February 2024 tracking spreadsheet. Four of the subrecipients had not returned the questionnaire or been evaluated for risk of noncompliance using other available information. One of the four was not listed as a subrecipient on the tracking spreadsheet. Management indicated that due to agency restructuring and the significant turnover of key management and staff during that period, full implementation of the subrecipient risk assessment procedures was still in process. Risk assessments help guide the agency in determining the appropriate level of monitoring for each subrecipient and the nature and extent of procedures to be applied. Without this guidance, the department may not provide an adequate level of monitoring. We recommend department management fully develop and implement its policies and procedures to ensure risk assessments are performed and documented for each subrecipient.

2023-033 Oregon Department of Emergency Management Implement controls over FFATA reporting Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021; FEMA-4499-DR-OR, 2020 (COVID-19) Compliance Requirement: Reporting Type of Finding: Material Weakness; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a), (c)-(d); 2 CFR 170, Appendix A I(a) The Federal Funding Accountability and Transparency Act (FFATA) requires the department to submit information for any subaward action that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Department management stated there were no established internal controls over FFATA reporting that would ensure accurate, complete, and timely submission or tracking of subrecipient data. As a result, we were unable to perform tests of controls. We judgmentally selected five of the 678 subawards identified by ODEM as meeting the threshold for FFATA reporting in fiscal year 2023 for compliance review. The department indicated that none of the five selections had been reported as required; however, auditors independently verified on USAspending.gov that one of the subawards had been submitted. Department management stated that noncompliance with FFATA reporting requirements during the fiscal year was due to multiple factors, including a departmental restructuring, lack of established controls and procedures for identifying, reporting, and tracking the status of projects meeting the reporting threshold; turnover of key personnel; and inadequate training of the compliance requirements for staff. There is a risk the federal awarding agency could withhold grant funding if the department is not compliant with reporting requirements. We recommend department management implement controls to ensure all subawards are appropriately tracked and reported. The department should also work with the federal awarding agency to determine what actions it should take for older reports not submitted.

2023-034 Oregon Department of Emergency Management Fully implement subrecipient risk assessments Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared) 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021 FEMA-4499-DR-OR, 2020 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-033 Questioned Costs: N/A Criteria: Criteria: 2 CFR 200.332(b) Federal regulations stipulate that pass-through entities evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring. Monitoring activities should be completed based on the results of the subrecipient’s determined risk. In fiscal year 2020, we noted the department did not have systematic policies and procedures in place to adequately evaluate subrecipients’ risk for noncompliance with federal subrecipient monitoring requirements. In response, the department developed a subrecipient risk assessment policy and procedures, which included risk assessment questionnaires, a scoring matrix, and a tracking mechanism to track distribution and receipt of the questionnaires as well as the subrecipients’ overall risk level. We selected a random sample of 36 subrecipients who had received a payment during the fiscal year and reviewed the department’s February 2024 tracking spreadsheet. Four of the subrecipients had not returned the questionnaire or been evaluated for risk of noncompliance using other available information. One of the four was not listed as a subrecipient on the tracking spreadsheet. Management indicated that due to agency restructuring and the significant turnover of key management and staff during that period, full implementation of the subrecipient risk assessment procedures was still in process. Risk assessments help guide the agency in determining the appropriate level of monitoring for each subrecipient and the nature and extent of procedures to be applied. Without this guidance, the department may not provide an adequate level of monitoring. We recommend department management fully develop and implement its policies and procedures to ensure risk assessments are performed and documented for each subrecipient.