Audit 305672

Reference Number: 2023-001 Prior Year Finding: 2022-003 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Eligibility Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Regular Unemployment Compensation (UC) Program – Under state UC laws, a worker’s benefit rights depend on the amount of the worker’s wages and/or weeks of work in covered employment in a “base period.” While most states define the base period as the first four of the last five completed calendar quarters prior to the filing of the claim, other base periods may be used. To qualify for benefits, a claimant must have earned a certain amount of wages or have worked a certain number of weeks or calendar quarters within the base period or meet some combination of wage and employment requirements. Some states require a waiting period of one week of total or partial unemployment before UC is payable. A “waiting period” is a non-compensable period of unemployment in which the worker is otherwise eligible for benefits. To be eligible to receive UC, all states provide that a claimant must have been separated from suitable work for non-disqualifying reasons under state law (i.e., not because of such acts as leaving voluntarily without good cause or discharge for misconduct connected with work). After separation, he or she must be able and available for work, actively seeking work, legally authorized to work in the United States and must not have refused an offer of suitable work. Pandemic Unemployment Assistance (PUA) – PUA provides benefits to covered individuals, who are those individuals not eligible for regular unemployment compensation (UC or extended benefits under state or federal law or Pandemic Emergency Unemployment Compensation (PEUC), including those who have exhausted all rights to such benefits. Covered individuals also include self-employed, those seeking part-time employment, individuals lacking sufficient work history, and those who otherwise do not qualify for regular unemployment compensation or extended benefits under state or federal law or PEUC. PUA is payable to individuals who are ineligible for regular UC, and are unemployed, partially unemployed, or unable or unavailable to work due to one of the COVID-19 related reasons identified Attachment I to UIPL No. 16-20, Change 5. Section 2102(a)(3)(A)(ii)(I) of the CARES Act included 10 specific COVID-19 related reasons. The Department, under the authority provided by Section 2102(a)(3)(A)(ii)(I)(kk) of the CARES Act, has added additional COVID-19 related reasons; these are discussed in more detail in Section 4.a. of UIPL No. 16-20, Change 5. While three of these new COVID- Section III – Federal Award Findings and Questioned Costs (Continued) 19 related reasons were introduced to states with the publication of UIPL No. 16-20, Change 5 on February 25, 2021, all COVID-19 related reasons apply retroactively to the beginning of the PUA program. Additionally, as described in Section 4.b.i. of UIPL No. 16-20, Change 5, paraphrasing of the COVID-19 related reasons is not permissible; individuals must be permitted to select more than one COVID-19 related reason; individuals must be permitted to select different COVID-19 related reasons each week; and individuals must be permitted to file and select no COVID-19 related reasons. Federal Pandemic Unemployment Compensation (FPUC) – To be eligible for FPUC during the program dates described in Section 8 above, individuals must be eligible to receive at least $1 of underlying benefits for the week in question (including regular UC, UCFE, UCX, PEUC, PUA, EB, STC, TRA, DUA, and SEA). FPUC does not require the individual to submit a separate initial application or continued claim. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: CLA noted that ineligible claimants were being paid unemployment insurance. The Department of Labor and Workforce Development (Department) did not maintain an effective control environment over eligibility requirements of the New Jersey Local Office Online Payment System (NJLOOPS) for both FPUC and PUA. Context: Sixty claimants were selected for testing which included 24 claimants for Regular UC and Extended Benefits, 25 claimants for FPUC and 11 claimants for PUA. We noted the following exceptions: • FPUC: 4 of 25 claimants receiving benefits did not receive $1 of other benefits for the payment period. • PUA: 3 of 11 claimants receiving PUA did not identify a COVID-19 reason for their unemployment and were ineligible for the program. • PUA: The Department was unable to provide support for 2 of 11 claimants and eligibility could not be verified. Questioned costs: $3,202 - The total amount of benefits received by ineligible recipients: • FPUC: $1,800 • PUA: $1,402 Section III – Federal Award Findings and Questioned Costs (Continued) Cause: The Department began providing benefits to claimants before NJLOOPS had completed the eligibility determination process. Effect: Ineligible claimants received unemployment compensation benefits. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that only eligible claimants receive unemployment compensation benefits. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) has controls in place to only allow an FPUC payment to be made when an underlying Unemployment Insurance (UI) payment has also been processed. FPUC payments should not be issued to any claim without the underlying UI payment being made for the same week. The FPUC payments issued and noted as exceptions during eligibility testing will be reviewed independently by DLWD to determine if the payments issued were to eligible recipients or not. For the PUA exceptions noted during Eligibility testing, overall the DLWD issued PUA payments to over 680,000 claimants during the COVID-19 pandemic. DLWD had controls in place to require a COVID related reason to make the claim PUA eligible and the weekly PUA certification required claimants to choose a COVID related reason for why they were out of work before they could get paid. The PUA payments in question will be reviewed independently by the DLWD to determine if the payments issued under PUA were appropriate or if they should have been paid instead under the regular UI program. DLWD corrective actions related to FPUC and PUA payments were fully implemented as of September 2023.

Reference Number: 2023-001 Prior Year Finding: 2022-003 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Eligibility Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Regular Unemployment Compensation (UC) Program – Under state UC laws, a worker’s benefit rights depend on the amount of the worker’s wages and/or weeks of work in covered employment in a “base period.” While most states define the base period as the first four of the last five completed calendar quarters prior to the filing of the claim, other base periods may be used. To qualify for benefits, a claimant must have earned a certain amount of wages or have worked a certain number of weeks or calendar quarters within the base period or meet some combination of wage and employment requirements. Some states require a waiting period of one week of total or partial unemployment before UC is payable. A “waiting period” is a non-compensable period of unemployment in which the worker is otherwise eligible for benefits. To be eligible to receive UC, all states provide that a claimant must have been separated from suitable work for non-disqualifying reasons under state law (i.e., not because of such acts as leaving voluntarily without good cause or discharge for misconduct connected with work). After separation, he or she must be able and available for work, actively seeking work, legally authorized to work in the United States and must not have refused an offer of suitable work. Pandemic Unemployment Assistance (PUA) – PUA provides benefits to covered individuals, who are those individuals not eligible for regular unemployment compensation (UC or extended benefits under state or federal law or Pandemic Emergency Unemployment Compensation (PEUC), including those who have exhausted all rights to such benefits. Covered individuals also include self-employed, those seeking part-time employment, individuals lacking sufficient work history, and those who otherwise do not qualify for regular unemployment compensation or extended benefits under state or federal law or PEUC. PUA is payable to individuals who are ineligible for regular UC, and are unemployed, partially unemployed, or unable or unavailable to work due to one of the COVID-19 related reasons identified Attachment I to UIPL No. 16-20, Change 5. Section 2102(a)(3)(A)(ii)(I) of the CARES Act included 10 specific COVID-19 related reasons. The Department, under the authority provided by Section 2102(a)(3)(A)(ii)(I)(kk) of the CARES Act, has added additional COVID-19 related reasons; these are discussed in more detail in Section 4.a. of UIPL No. 16-20, Change 5. While three of these new COVID- Section III – Federal Award Findings and Questioned Costs (Continued) 19 related reasons were introduced to states with the publication of UIPL No. 16-20, Change 5 on February 25, 2021, all COVID-19 related reasons apply retroactively to the beginning of the PUA program. Additionally, as described in Section 4.b.i. of UIPL No. 16-20, Change 5, paraphrasing of the COVID-19 related reasons is not permissible; individuals must be permitted to select more than one COVID-19 related reason; individuals must be permitted to select different COVID-19 related reasons each week; and individuals must be permitted to file and select no COVID-19 related reasons. Federal Pandemic Unemployment Compensation (FPUC) – To be eligible for FPUC during the program dates described in Section 8 above, individuals must be eligible to receive at least $1 of underlying benefits for the week in question (including regular UC, UCFE, UCX, PEUC, PUA, EB, STC, TRA, DUA, and SEA). FPUC does not require the individual to submit a separate initial application or continued claim. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: CLA noted that ineligible claimants were being paid unemployment insurance. The Department of Labor and Workforce Development (Department) did not maintain an effective control environment over eligibility requirements of the New Jersey Local Office Online Payment System (NJLOOPS) for both FPUC and PUA. Context: Sixty claimants were selected for testing which included 24 claimants for Regular UC and Extended Benefits, 25 claimants for FPUC and 11 claimants for PUA. We noted the following exceptions: • FPUC: 4 of 25 claimants receiving benefits did not receive $1 of other benefits for the payment period. • PUA: 3 of 11 claimants receiving PUA did not identify a COVID-19 reason for their unemployment and were ineligible for the program. • PUA: The Department was unable to provide support for 2 of 11 claimants and eligibility could not be verified. Questioned costs: $3,202 - The total amount of benefits received by ineligible recipients: • FPUC: $1,800 • PUA: $1,402 Section III – Federal Award Findings and Questioned Costs (Continued) Cause: The Department began providing benefits to claimants before NJLOOPS had completed the eligibility determination process. Effect: Ineligible claimants received unemployment compensation benefits. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that only eligible claimants receive unemployment compensation benefits. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) has controls in place to only allow an FPUC payment to be made when an underlying Unemployment Insurance (UI) payment has also been processed. FPUC payments should not be issued to any claim without the underlying UI payment being made for the same week. The FPUC payments issued and noted as exceptions during eligibility testing will be reviewed independently by DLWD to determine if the payments issued were to eligible recipients or not. For the PUA exceptions noted during Eligibility testing, overall the DLWD issued PUA payments to over 680,000 claimants during the COVID-19 pandemic. DLWD had controls in place to require a COVID related reason to make the claim PUA eligible and the weekly PUA certification required claimants to choose a COVID related reason for why they were out of work before they could get paid. The PUA payments in question will be reviewed independently by the DLWD to determine if the payments issued under PUA were appropriate or if they should have been paid instead under the regular UI program. DLWD corrective actions related to FPUC and PUA payments were fully implemented as of September 2023.

Reference Number: 2023-002 Prior Year Finding: 2022-005 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The WPRS and RESEA programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. WPRS, which is mandated by Section 303(j) of the Social Security Act, is designed to identify UI claimants who are most likely to exhaust their benefits and need reemployment assistance to return to work, and refer them to appropriate reemployment services, such as: job search and job placement assistance; counseling; testing; provision of occupational and labor market information; and assessments. WPRS provides reemployment services to selected claimants through an early intervention process. The number of individuals served under WPRS is determined by the state (and/or local areas) based on its capacity to serve these individuals. UIPL No. 41-94 provides guidance on WPRS requirements. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not retain documentation required by the RESEA program to verify compliance with federal program regulations. Controls were not working sufficiently to document that a staff member at the Department with knowledge of the program reviewed eligibility requirements prior to admission of participants to the RESEA program. Context: The Department’s policy is that RESEA eligibility interviews must be conducted and eligibility review forms completed. Both steps are to be reviewed and signed by the participant and an Unemployment Insurance (UI) staff member who is knowledgeable of the program requirements. Sixty cases were selected for testing and the following exceptions were noted: • For 9 of 60 cases selected for testing, the Department was unable to provide a signed RESEA worksheet indicating the interview had been completed and the claimant was reviewed and approved by a UI supervisor. • For 1 of 60 cases selected for testing, the Department was unable to provide the signed worksheet nor the Notice to Claimant that included the RESEA eligibility conditions, requirements, benefits, and clear warnings regarding the consequences of failure to comply with program requirements. • For 1 of 60 cases selected for testing, the claimant did not complete all required RESEA forms. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls are not sufficient to ensure compliance with RESEA requirements. Effect: Without clear documentation supporting a participant’s eligibility and supervisory review, ineligible participants could go undetected and federal funds could be paid to recipients who do not qualify to participate in the RESEA program. Recommendation: We recommend that policies and procedures be implemented to ensure that internal controls over RESEA include retention of documentation of each participant’s eligibility and review and approval by a UI supervisor. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: The Reemployment Services and Eligibility Assessments (RESEA) policy and controls presently in place at the Department of Labor and Workforce Development (DLWD) require eligibility interviews to be conducted and eligibility review forms to be completed and signed by the participant and UI program representative. DLWD implemented a new process that allows staff to electronically obtain signatures through Simpligov, beginning June 2023. This process requires that staff obtain all necessary signatures before a RESEA claimant record is completed. Supervisors are assigned to monitor this process in order to mitigate the risk associated with missing information on any single RESEA customer registration. DLWD will monitor this process to ensure that all interviews are properly documented, and forms are signed and electronically uploaded to its electronic case management system of record for future reference. During the initial rollout of this process, there were records that didn’t migrate to the case management system of record. This issue has now been addressed through training. DLWD has also developed dashboards that will assist with monitoring data entry. Monthly reviews of RESEA data entry will be conducted to identify possible errors. These RESEA process changes that will be implemented by DLWD will ensure compliance with regulatory standards and assist with maintaining the integrity of its data management process.

Reference Number: 2023-002 Prior Year Finding: 2022-005 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The WPRS and RESEA programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. WPRS, which is mandated by Section 303(j) of the Social Security Act, is designed to identify UI claimants who are most likely to exhaust their benefits and need reemployment assistance to return to work, and refer them to appropriate reemployment services, such as: job search and job placement assistance; counseling; testing; provision of occupational and labor market information; and assessments. WPRS provides reemployment services to selected claimants through an early intervention process. The number of individuals served under WPRS is determined by the state (and/or local areas) based on its capacity to serve these individuals. UIPL No. 41-94 provides guidance on WPRS requirements. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not retain documentation required by the RESEA program to verify compliance with federal program regulations. Controls were not working sufficiently to document that a staff member at the Department with knowledge of the program reviewed eligibility requirements prior to admission of participants to the RESEA program. Context: The Department’s policy is that RESEA eligibility interviews must be conducted and eligibility review forms completed. Both steps are to be reviewed and signed by the participant and an Unemployment Insurance (UI) staff member who is knowledgeable of the program requirements. Sixty cases were selected for testing and the following exceptions were noted: • For 9 of 60 cases selected for testing, the Department was unable to provide a signed RESEA worksheet indicating the interview had been completed and the claimant was reviewed and approved by a UI supervisor. • For 1 of 60 cases selected for testing, the Department was unable to provide the signed worksheet nor the Notice to Claimant that included the RESEA eligibility conditions, requirements, benefits, and clear warnings regarding the consequences of failure to comply with program requirements. • For 1 of 60 cases selected for testing, the claimant did not complete all required RESEA forms. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls are not sufficient to ensure compliance with RESEA requirements. Effect: Without clear documentation supporting a participant’s eligibility and supervisory review, ineligible participants could go undetected and federal funds could be paid to recipients who do not qualify to participate in the RESEA program. Recommendation: We recommend that policies and procedures be implemented to ensure that internal controls over RESEA include retention of documentation of each participant’s eligibility and review and approval by a UI supervisor. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: The Reemployment Services and Eligibility Assessments (RESEA) policy and controls presently in place at the Department of Labor and Workforce Development (DLWD) require eligibility interviews to be conducted and eligibility review forms to be completed and signed by the participant and UI program representative. DLWD implemented a new process that allows staff to electronically obtain signatures through Simpligov, beginning June 2023. This process requires that staff obtain all necessary signatures before a RESEA claimant record is completed. Supervisors are assigned to monitor this process in order to mitigate the risk associated with missing information on any single RESEA customer registration. DLWD will monitor this process to ensure that all interviews are properly documented, and forms are signed and electronically uploaded to its electronic case management system of record for future reference. During the initial rollout of this process, there were records that didn’t migrate to the case management system of record. This issue has now been addressed through training. DLWD has also developed dashboards that will assist with monitoring data entry. Monthly reviews of RESEA data entry will be conducted to identify possible errors. These RESEA process changes that will be implemented by DLWD will ensure compliance with regulatory standards and assist with maintaining the integrity of its data management process.

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or Section III – Federal Award Findings and Questioned Costs (Continued) the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor and Workforce Development (Department) was unable to provide documentation that case reviews were completed per the requirements of ET Handbook No. 395. Context: Forty cases were selected for testing, consisting of 20 Paid Benefit Claims and 20 Denied Claims. The following exceptions were noted: • 4 of 20 Paid Benefit Claims appear to have been reviewed, but the Department was unable to provide documentation that the case review had been completed and signed by appropriate staff. • 1 of 20 Paid Benefit Claims did not have evidence of case review. The Department was unable to provide a copy of the investigative report. • 8 of 20 Denied Claims appear to have been reviewed, but the Department was unable to provide documentation that the case review had been completed and signed by appropriate staff. • 1 of 20 Denied Claims did not have evidence of case review. The Department was unable to provide a copy of the investigative report. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure that BAM case reviews were completed and signed by appropriate staff. Effect: Noncompliance with BAM case investigation requirements could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely, that reviews are signed by appropriate staff, and that it maintains documentation supporting completion of the case reviews. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) will continue to review and enhance controls to ensure that BAM quality control case investigations are completed timely, that reviews are signed as required by appropriate staff, and that all required case review supporting documentation is maintained in case files. DLWD corrective actions will be completed by September 30, 2024. For the PUA exceptions noted during Eligibility testing, overall the DLWD issued PUA payments to over 680,000 claimants during the COVID-19 pandemic. DLWD had controls in place to require a COVID related reason to make the claim PUA eligible and the weekly PUA certification required claimants to choose a COVID related reason for why they were out of work before they could get paid. The PUA payments in question will be reviewed independently by the DLWD to determine if the payments issued under PUA were appropriate or if they should have been paid instead under the regular UI program.

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or Section III – Federal Award Findings and Questioned Costs (Continued) the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor and Workforce Development (Department) was unable to provide documentation that case reviews were completed per the requirements of ET Handbook No. 395. Context: Forty cases were selected for testing, consisting of 20 Paid Benefit Claims and 20 Denied Claims. The following exceptions were noted: • 4 of 20 Paid Benefit Claims appear to have been reviewed, but the Department was unable to provide documentation that the case review had been completed and signed by appropriate staff. • 1 of 20 Paid Benefit Claims did not have evidence of case review. The Department was unable to provide a copy of the investigative report. • 8 of 20 Denied Claims appear to have been reviewed, but the Department was unable to provide documentation that the case review had been completed and signed by appropriate staff. • 1 of 20 Denied Claims did not have evidence of case review. The Department was unable to provide a copy of the investigative report. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure that BAM case reviews were completed and signed by appropriate staff. Effect: Noncompliance with BAM case investigation requirements could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely, that reviews are signed by appropriate staff, and that it maintains documentation supporting completion of the case reviews. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) will continue to review and enhance controls to ensure that BAM quality control case investigations are completed timely, that reviews are signed as required by appropriate staff, and that all required case review supporting documentation is maintained in case files. DLWD corrective actions will be completed by September 30, 2024. For the PUA exceptions noted during Eligibility testing, overall the DLWD issued PUA payments to over 680,000 claimants during the COVID-19 pandemic. DLWD had controls in place to require a COVID related reason to make the claim PUA eligible and the weekly PUA certification required claimants to choose a COVID related reason for why they were out of work before they could get paid. The PUA payments in question will be reviewed independently by the DLWD to determine if the payments issued under PUA were appropriate or if they should have been paid instead under the regular UI program.

Reference Number: 2023-004 Prior Year Finding: 2022-004 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022), UI-34073-20-55-A-34 (10/1/19 – 12/31/22), UI-32614-19-55-A-34 (10/1/18 – 12/31/21), UI-37238-22-55-A-34 (10/1/21 – 12/31/24), UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025) Compliance Requirement: Reporting – ETA 9050 and ETA 9052 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The ETA 9050 – Time Lapse of All First Payments except Workshare report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. First Payments are considered timely at 14/21 days, Interstate and Intrastate UI, UCFE, and UCX, full and partial weeks. The report is due in the ETA National Office on the 20th of the month following the month to which the data relates. The ETA 9052 – Nonmonetary Determination Time Lapse Detection report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Nonmonetary determinations are considered timely if completed within 21 days. The report is due in the ETA National Office on the 20th of the month following the month to which the data relates. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Department of Labor and Workforce Development (Department) indicate that First Payment Time Lapse and Nonmonetary Determinations were untimely during FY 2023. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Four ETA 9050 and four ETA 9052 reports were selected for testing for the months of September 2022, November 2022, February 2023, and May 2023. We noted the following exceptions: • ETA 9050: 4 of 4 reports indicate that First Payments were made in more than 14/21 days. • ETA 9052: 4 of 4 reports indicate that nonmonetary determinations were completed in more than 21 days. Questioned costs: None noted. Cause: The Department’s procedures and controls were not operating effectively to ensure that first payments and nonmonetary determinations were completed timely. Effect: First Payments and Nonmonetary Determinations were not completed timely as required by the program. Recommendation: We recommend that the Department review its policies and procedures to ensure that it makes first payments within 14/21 days and that nonmonetary determinations are completed within 21 days per program requirements. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) continues to monitor all first payment and non-monetary time lapse figures in order to meet the established USDOL Acceptable Levels of Performance (ALP). As workloads return to normal levels after the increased activity from the COVID-19 pandemic related claims, greater emphasis will continue to be placed on meeting all ALPs. Specifically relating to first payments and the previously discussed issues with claimants verifying their identity before any payments can be made, the DLWD has made some internal changes to how returned verified IDs from our ID verification partner (ID.me) are handled. These modifications to the internal process used to clear verified IDs are expected to have a positive impact on overall time lapse numbers as verified claimants will not be delayed longer than they previously were under the old process. The month of April starts the new reporting year for these figures to USDOL and New Jersey expects to see significant increases to first payment and non-monetary time lapse figures by the third quarter of calendar year 2024.

Reference Number: 2023-004 Prior Year Finding: 2022-004 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022), UI-34073-20-55-A-34 (10/1/19 – 12/31/22), UI-32614-19-55-A-34 (10/1/18 – 12/31/21), UI-37238-22-55-A-34 (10/1/21 – 12/31/24), UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025) Compliance Requirement: Reporting – ETA 9050 and ETA 9052 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The ETA 9050 – Time Lapse of All First Payments except Workshare report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. First Payments are considered timely at 14/21 days, Interstate and Intrastate UI, UCFE, and UCX, full and partial weeks. The report is due in the ETA National Office on the 20th of the month following the month to which the data relates. The ETA 9052 – Nonmonetary Determination Time Lapse Detection report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Nonmonetary determinations are considered timely if completed within 21 days. The report is due in the ETA National Office on the 20th of the month following the month to which the data relates. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Department of Labor and Workforce Development (Department) indicate that First Payment Time Lapse and Nonmonetary Determinations were untimely during FY 2023. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Four ETA 9050 and four ETA 9052 reports were selected for testing for the months of September 2022, November 2022, February 2023, and May 2023. We noted the following exceptions: • ETA 9050: 4 of 4 reports indicate that First Payments were made in more than 14/21 days. • ETA 9052: 4 of 4 reports indicate that nonmonetary determinations were completed in more than 21 days. Questioned costs: None noted. Cause: The Department’s procedures and controls were not operating effectively to ensure that first payments and nonmonetary determinations were completed timely. Effect: First Payments and Nonmonetary Determinations were not completed timely as required by the program. Recommendation: We recommend that the Department review its policies and procedures to ensure that it makes first payments within 14/21 days and that nonmonetary determinations are completed within 21 days per program requirements. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) continues to monitor all first payment and non-monetary time lapse figures in order to meet the established USDOL Acceptable Levels of Performance (ALP). As workloads return to normal levels after the increased activity from the COVID-19 pandemic related claims, greater emphasis will continue to be placed on meeting all ALPs. Specifically relating to first payments and the previously discussed issues with claimants verifying their identity before any payments can be made, the DLWD has made some internal changes to how returned verified IDs from our ID verification partner (ID.me) are handled. These modifications to the internal process used to clear verified IDs are expected to have a positive impact on overall time lapse numbers as verified claimants will not be delayed longer than they previously were under the old process. The month of April starts the new reporting year for these figures to USDOL and New Jersey expects to see significant increases to first payment and non-monetary time lapse figures by the third quarter of calendar year 2024.

Reference Number: 2023-005 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Information Technology General Controls Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). As part of an entity’s internal controls to reasonably ensure compliance over Federal laws and regulations, an entity must maintain an effective control environment over their information technology systems used to generate and process information to administer Federal programs in accordance with the respective rules and regulations that govern the program. Condition: The Department of Labor and Workforce Development (Department) did not maintain an effective control environment over change management of the New Jersey Local Office Online Payment System (NJLOOPS). Context: The NJLOOPS application is an essential system hosted within the Office of Information Technology’s (OIT) infrastructure used by the Department for unemployment insurance eligibility, claims, benefit calculations, and payments. NJLOOPS application management is provided by Department staff. We noted that the prior year finding for internal controls over change management was not corrected. Specifically, we noted that while tickets have been documented for the sample of changes tested for the NJLOOPS change management procedures, they do not maintain key information described in the change management policy such as programmatic work performed, testing, and approval of the effort for promotion to the Production environment. Auditors were able to obtain evidence of testing and approval for 1 of the 5 change samples selected for testing via email communication. Further, we noted that two individuals have the ability to develop and promote their own changes to production which poses a segregation of duties issue. Section III – Federal Award Findings and Questioned Costs (Continued) Questioned costs: Undetermined. Cause: Due to limitations on staffing and increased demand on IT resources due to the additional requirements of the pandemic's unemployment program, the agency was unable to comply with its internal change management procedures requirements. Effect: Noncompliance with the requirements of internal change management procedures and a lack of segregation of duties could increase the risk of potential unauthorized or unapproved changes occurring to the application. Recommendation: We recommend the Department follow the statewide change management policy and formally document the request, testing, and approval of all changes related to the NJLOOPS application. We further recommend that the Department implement segregation of duties controls to prevent the same user from developing, approving, and promoting a system change to the production environment. Views of responsible officials: The Department of Labor and Workforce Development’s (DLWD) Office of Information Management, Services & Solutions (OIMSS) will continue its efforts to ensure staff compliance with existing controls over program change controls for the New Jersey Local Office Online Payment System (NJLOOPs). DLWD’s efforts will continue to be guided by statewide change management best practices. OIMSS will add a Director-level approval step to the program promotion process that will validate that the required documentation has been uploaded to the change ticket. Except in circumstances involving emergency off-hours break fix resolution, separation of duties will be included as a check-off for approval to deploy program changes.

Reference Number: 2023-005 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Information Technology General Controls Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). As part of an entity’s internal controls to reasonably ensure compliance over Federal laws and regulations, an entity must maintain an effective control environment over their information technology systems used to generate and process information to administer Federal programs in accordance with the respective rules and regulations that govern the program. Condition: The Department of Labor and Workforce Development (Department) did not maintain an effective control environment over change management of the New Jersey Local Office Online Payment System (NJLOOPS). Context: The NJLOOPS application is an essential system hosted within the Office of Information Technology’s (OIT) infrastructure used by the Department for unemployment insurance eligibility, claims, benefit calculations, and payments. NJLOOPS application management is provided by Department staff. We noted that the prior year finding for internal controls over change management was not corrected. Specifically, we noted that while tickets have been documented for the sample of changes tested for the NJLOOPS change management procedures, they do not maintain key information described in the change management policy such as programmatic work performed, testing, and approval of the effort for promotion to the Production environment. Auditors were able to obtain evidence of testing and approval for 1 of the 5 change samples selected for testing via email communication. Further, we noted that two individuals have the ability to develop and promote their own changes to production which poses a segregation of duties issue. Section III – Federal Award Findings and Questioned Costs (Continued) Questioned costs: Undetermined. Cause: Due to limitations on staffing and increased demand on IT resources due to the additional requirements of the pandemic's unemployment program, the agency was unable to comply with its internal change management procedures requirements. Effect: Noncompliance with the requirements of internal change management procedures and a lack of segregation of duties could increase the risk of potential unauthorized or unapproved changes occurring to the application. Recommendation: We recommend the Department follow the statewide change management policy and formally document the request, testing, and approval of all changes related to the NJLOOPS application. We further recommend that the Department implement segregation of duties controls to prevent the same user from developing, approving, and promoting a system change to the production environment. Views of responsible officials: The Department of Labor and Workforce Development’s (DLWD) Office of Information Management, Services & Solutions (OIMSS) will continue its efforts to ensure staff compliance with existing controls over program change controls for the New Jersey Local Office Online Payment System (NJLOOPs). DLWD’s efforts will continue to be guided by statewide change management best practices. OIMSS will add a Director-level approval step to the program promotion process that will validate that the required documentation has been uploaded to the change ticket. Except in circumstances involving emergency off-hours break fix resolution, separation of duties will be included as a check-off for approval to deploy program changes.

Reference Number: 2023-006 Prior Year Finding: 2022-007 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-33245-19-55-A-34 (7/1/2019 – 9/30/2022), AA-34783-20-55-A-34 (7/1/2020 – 9/30/2023), AA-36334-21-55-A-34 (7/1/2021 – 9/30/2024), AA-38544-22-55-A-34 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Labor and Workforce Development (Department) did not report subaward information timely to FSRS. Context: Six of eight subawards selected for testing were not reported timely to FSRS. The subawards were issued on 8/31/2022 and were not reported to FSRS until 3/1/2023, or 182 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) transitioned from a manual contract agreement process to a web-based grant administration system in recent years that employs the System for Administering Grants Electronically (SAGE) and IntelliGrants (IGX) applications. The DLWD FFATA Reporting Unit has access to these automated systems and monitors them on a monthly basis to identify when new subaward contracts/agreements are approved in order to report required data in the FFATA system timely. DLWD corrective actions regarding FFATA reporting are expected to be fully implemented as of June 30, 2024.

Reference Number: 2023-006 Prior Year Finding: 2022-007 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-33245-19-55-A-34 (7/1/2019 – 9/30/2022), AA-34783-20-55-A-34 (7/1/2020 – 9/30/2023), AA-36334-21-55-A-34 (7/1/2021 – 9/30/2024), AA-38544-22-55-A-34 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Labor and Workforce Development (Department) did not report subaward information timely to FSRS. Context: Six of eight subawards selected for testing were not reported timely to FSRS. The subawards were issued on 8/31/2022 and were not reported to FSRS until 3/1/2023, or 182 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) transitioned from a manual contract agreement process to a web-based grant administration system in recent years that employs the System for Administering Grants Electronically (SAGE) and IntelliGrants (IGX) applications. The DLWD FFATA Reporting Unit has access to these automated systems and monitors them on a monthly basis to identify when new subaward contracts/agreements are approved in order to report required data in the FFATA system timely. DLWD corrective actions regarding FFATA reporting are expected to be fully implemented as of June 30, 2024.

Reference Number: 2023-006 Prior Year Finding: 2022-007 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-33245-19-55-A-34 (7/1/2019 – 9/30/2022), AA-34783-20-55-A-34 (7/1/2020 – 9/30/2023), AA-36334-21-55-A-34 (7/1/2021 – 9/30/2024), AA-38544-22-55-A-34 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Labor and Workforce Development (Department) did not report subaward information timely to FSRS. Context: Six of eight subawards selected for testing were not reported timely to FSRS. The subawards were issued on 8/31/2022 and were not reported to FSRS until 3/1/2023, or 182 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) transitioned from a manual contract agreement process to a web-based grant administration system in recent years that employs the System for Administering Grants Electronically (SAGE) and IntelliGrants (IGX) applications. The DLWD FFATA Reporting Unit has access to these automated systems and monitors them on a monthly basis to identify when new subaward contracts/agreements are approved in order to report required data in the FFATA system timely. DLWD corrective actions regarding FFATA reporting are expected to be fully implemented as of June 30, 2024.

Reference Number: 2023-007 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Human Services Federal Program: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Award Number and Year: H126A230044 (10/1/2022-9/30/2023) H126A230044-A (10/1/2022-9/30/2023) H126A230044-B (10/1/2022-9/30/2023) H126A210043 (10/1/2020-9/30/2022) H126A220043-22C (10/1/2021-9/30/2022) H126A230043 (10/1/2022-9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) charged unallowable payroll costs to the program. Context: For one of forty samples selected for testing, the Department made an overpayment to an employee of $113.00 in salary and wages. Cause: Controls were not operating effectively to ensure that allowable payroll costs were charged to the program. A step increase was improperly applied to the employee which resulted in an overpayment of salary and wages. Effect: Unallowable employee salaries and wages were charged to the program. Questioned costs: $113.00, the amount of the overpayment. Recommendation: The Department should review procedures and controls to ensure that only allowable time and effort costs are charged to the program. Views of responsible officials: The Department of Human Services (DHS), Central Office Payroll group will run reports biweekly to determine if any employees are on a leave without pay status greater than 10 days. This added reporting function will ensure that all DHS employees who are on a leave of absence without pay beyond 10 days have their PMIS histories updated upon each extension and return to work.

Reference Number: 2023-008 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Award Number and Year: H126A230044 (10/1/2022-9/30/2023) H126A230044-A (10/1/2022-9/30/2023) H126A230044-B (10/1/2022-9/30/2023) H126A210043 (10/1/2020-9/30/2022) H126A220043-22C (10/1/2021-9/30/2022) H126A230043 (10/1/2022-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subaward information was not reported timely to FSRS by the Department of Human Services (Department). Context: Eight of eight subawards selected for testing were not reported to FSRS. Specifically, we noted the following: • Eight of eight subawards were issued on 8/16/2022 but were not reported to FSRS until 3/10/2023 or approximately 161 days after required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not establish effective procedures or internal controls over FFATA requirements to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop procedures and internal controls to ensure that all required subawards are reported to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: The Department of Labor and Workforce Development (DLWD), as the prime recipient of the federal awards, will ensure that all first-tier subawards made to entities totaling $30,000 or greater will be entered timely into the FSRS in accordance with FFATA reporting requirements. The audit sample selections in question were based on manual DLWD notice of awards that were not communicated correctly to staff who are responsible for entering the required subaward information into FSRS. Going forward, DLWD staff who are responsible for entering data into the FSRS will be copied on all emails containing the manual notice of award(s) once the notice is signed by the DLWD Commissioner. These email communications will trigger the information to be entered into the FSRS.

Reference Number: 2023-009 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: Supporting Effective Instruction State Grants Assistance Listing Number: 84.367 Award Number and Year: S367A200029 (7/1/2020-9/30/23) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Education (Department) did not report subaward information to FSRS during FY 2023. Context: Forty of forty subawards selected for testing were not reported to FSRS. Reports were due no later than 8/31/2022 but were not reported to FSRS until after they were selected by auditors for testing. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and internal controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the Section III – Federal Award Findings and Questioned Costs (Continued) FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. Section III – Federal Award Findings and Questioned Costs (Continued) • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; Section III – Federal Award Findings and Questioned Costs (Continued) xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Human Services (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Views of responsible officials: The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; Section III – Federal Award Findings and Questioned Costs (Continued) xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Human Services (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Views of responsible officials: The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; Section III – Federal Award Findings and Questioned Costs (Continued) xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Human Services (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Views of responsible officials: The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; Section III – Federal Award Findings and Questioned Costs (Continued) xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Human Services (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Views of responsible officials: The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; Section III – Federal Award Findings and Questioned Costs (Continued) xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Human Services (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Views of responsible officials: The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days.

Reference Number: 2023-012 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS timely during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were issued in January 2023 and were not reported to FSRS until July 2023. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subaward information was reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department enhance its controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Aging Services (DoAS) continues to work towards attaining full compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. The DoAS continues to consult with the Department and/or other DHS Division fiscal leadership to finalize the FFATA procedures. These procedures shall include creating a list of all active first-tier subawards of federal funds DoAS has issued at $30,000 or more. The list will include all the Section III – Federal Award Findings and Questioned Costs (Continued) data fields required for FFATA reporting. DoAS grants management members will ensure each of the identified subawards is entered on the Federal Subaward Reporting System (FSRS) website. DoAS will also revise internal procedures to ensure all future subawards of $30,000 or more are entered on FSRS within 30 days of award.

Reference Number: 2023-012 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS timely during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were issued in January 2023 and were not reported to FSRS until July 2023. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subaward information was reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department enhance its controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Aging Services (DoAS) continues to work towards attaining full compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. The DoAS continues to consult with the Department and/or other DHS Division fiscal leadership to finalize the FFATA procedures. These procedures shall include creating a list of all active first-tier subawards of federal funds DoAS has issued at $30,000 or more. The list will include all the Section III – Federal Award Findings and Questioned Costs (Continued) data fields required for FFATA reporting. DoAS grants management members will ensure each of the identified subawards is entered on the Federal Subaward Reporting System (FSRS) website. DoAS will also revise internal procedures to ensure all future subawards of $30,000 or more are entered on FSRS within 30 days of award.

Reference Number: 2023-012 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS timely during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were issued in January 2023 and were not reported to FSRS until July 2023. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subaward information was reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department enhance its controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Aging Services (DoAS) continues to work towards attaining full compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. The DoAS continues to consult with the Department and/or other DHS Division fiscal leadership to finalize the FFATA procedures. These procedures shall include creating a list of all active first-tier subawards of federal funds DoAS has issued at $30,000 or more. The list will include all the Section III – Federal Award Findings and Questioned Costs (Continued) data fields required for FFATA reporting. DoAS grants management members will ensure each of the identified subawards is entered on the Federal Subaward Reporting System (FSRS) website. DoAS will also revise internal procedures to ensure all future subawards of $30,000 or more are entered on FSRS within 30 days of award.

Reference Number: 2023-012 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS timely during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were issued in January 2023 and were not reported to FSRS until July 2023. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subaward information was reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department enhance its controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Aging Services (DoAS) continues to work towards attaining full compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. The DoAS continues to consult with the Department and/or other DHS Division fiscal leadership to finalize the FFATA procedures. These procedures shall include creating a list of all active first-tier subawards of federal funds DoAS has issued at $30,000 or more. The list will include all the Section III – Federal Award Findings and Questioned Costs (Continued) data fields required for FFATA reporting. DoAS grants management members will ensure each of the identified subawards is entered on the Federal Subaward Reporting System (FSRS) website. DoAS will also revise internal procedures to ensure all future subawards of $30,000 or more are entered on FSRS within 30 days of award.

Reference Number: 2023-012 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS timely during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were issued in January 2023 and were not reported to FSRS until July 2023. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subaward information was reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department enhance its controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Aging Services (DoAS) continues to work towards attaining full compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. The DoAS continues to consult with the Department and/or other DHS Division fiscal leadership to finalize the FFATA procedures. These procedures shall include creating a list of all active first-tier subawards of federal funds DoAS has issued at $30,000 or more. The list will include all the Section III – Federal Award Findings and Questioned Costs (Continued) data fields required for FFATA reporting. DoAS grants management members will ensure each of the identified subawards is entered on the Federal Subaward Reporting System (FSRS) website. DoAS will also revise internal procedures to ensure all future subawards of $30,000 or more are entered on FSRS within 30 days of award.

Reference Number: 2023-013 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: NH23IP922594 (7/1/19 – 6/30/24) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS by the Department of Health (Department). Context: Twelve of thirteen subawards selected for testing were not reported to FSRS. Specifically, we noted the following: • 8 of 13 subawards were issued on 7/1/2021 and they were not reported to FSRS until 7/20/2023, or approximately two years late. • 3 of 13 subawards was issued on 4/1/2022 and were reported to FSRS on 7/20/2023 and 9/22/2023, or 14 to 17 months late. • 1 of 13 subawards was issued on 12/19/2022 and was not reported to FSRS until 6/7/2023, or approximately five months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not allocate personnel nor establish procedures or controls for FFATA reporting. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop procedures and internal controls to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Health’s (DOH) Vaccine Preventable Disease Program (VPDP) is in compliance with the Federal Funding Accountability and Transparency Act (FFATA) requirements with regard to reporting all active first-tier subawards of federal COVID-19 funds that DOH divisions have issued totaling $30,000 or greater under this Cooperative Agreement and COVID-19 Supplemental. However, it is not in compliance with regard to reporting required subaward data in FSRS by the end of the month following the month in which DOH has made the subawards totaling $30,000 or greater. Section III – Federal Award Findings and Questioned Costs (Continued) The VPDP will continue to follow the DOH policy set forth in FMC 22-05 and report to FSRS all active first-tier subawards of federal COVID-19 funds DOH divisions have issued at $30,000 or greater under the COVID-19 Supplementals. The VPDP fiscal/grants leadership team will strive to ensure each of the identified subawards is entered on the FFATA Subaward Reporting System (FSRS) website by the end of the month following the month that DOH has made the subawards. VPDP will continue its efforts to bring the gap in reporting to FSRS down from five months presently to within the specified FFATA submission deadlines denoted above. VPDP also has on boarded a full-time Contract Administrator 2 who will be responsible for reporting FFATA data into FSRS for the Immunization Cooperative Agreement.

Reference Number: 2023-013 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: NH23IP922594 (7/1/19 – 6/30/24) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS by the Department of Health (Department). Context: Twelve of thirteen subawards selected for testing were not reported to FSRS. Specifically, we noted the following: • 8 of 13 subawards were issued on 7/1/2021 and they were not reported to FSRS until 7/20/2023, or approximately two years late. • 3 of 13 subawards was issued on 4/1/2022 and were reported to FSRS on 7/20/2023 and 9/22/2023, or 14 to 17 months late. • 1 of 13 subawards was issued on 12/19/2022 and was not reported to FSRS until 6/7/2023, or approximately five months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not allocate personnel nor establish procedures or controls for FFATA reporting. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop procedures and internal controls to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Health’s (DOH) Vaccine Preventable Disease Program (VPDP) is in compliance with the Federal Funding Accountability and Transparency Act (FFATA) requirements with regard to reporting all active first-tier subawards of federal COVID-19 funds that DOH divisions have issued totaling $30,000 or greater under this Cooperative Agreement and COVID-19 Supplemental. However, it is not in compliance with regard to reporting required subaward data in FSRS by the end of the month following the month in which DOH has made the subawards totaling $30,000 or greater. Section III – Federal Award Findings and Questioned Costs (Continued) The VPDP will continue to follow the DOH policy set forth in FMC 22-05 and report to FSRS all active first-tier subawards of federal COVID-19 funds DOH divisions have issued at $30,000 or greater under the COVID-19 Supplementals. The VPDP fiscal/grants leadership team will strive to ensure each of the identified subawards is entered on the FFATA Subaward Reporting System (FSRS) website by the end of the month following the month that DOH has made the subawards. VPDP will continue its efforts to bring the gap in reporting to FSRS down from five months presently to within the specified FFATA submission deadlines denoted above. VPDP also has on boarded a full-time Contract Administrator 2 who will be responsible for reporting FFATA data into FSRS for the Immunization Cooperative Agreement.

Reference Number: 2023-014 Prior Year Finding: 2022-015 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525-02-03 (8/1/2020 - 7/31/2024), 5NU50CK000525-03-00 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS in accordance with FFATA requirements. Context: Twenty-seven subawards were selected for testing. The Department of Health (DOH) is the primary recipient of program funding and, therefore, has overall responsibility for activities funded by the program. In addition to issuing subawards as the prime recipient, DOH also entered into an agreement with the Department of Education (DOE) to issue subawards to public and non-public schools on their behalf. Of the twenty-seven subawards selected for testing, twenty-three were issued by DOH and four were issued by DOE. The following exceptions were noted: • Four of twenty-seven subawards selected for testing were not reported to FSRS. DOE issued the subawards but was unable to provide copies of the subaward agreements or evidence that the subawards had been reported to FSRS. Therefore, the dollar amount of subawards not reported is undetermined. • Ten of twenty-seven subawards selected for testing were not reported timely to FSRS. DOH reported the subawards to FSRS from 21 to 543 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: DOH did not implement procedures or controls to ensure that subawards it issued were reported to FSRS timely. The agreement between DOH and DOE did not clearly state DOE’s responsibilities to maintain copies of subaward agreements and report those subawards to FSRS. In its oversight role, DOH did not review documentation maintained by DOE to ensure compliance with FFATA requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that DOH develop procedures and internal controls to ensure that all required subawards are reported to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. We further recommend that DOH develop procedures and controls over its agreements with other departments to ensure that FFATA reporting requirements are met. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: Based on the Corrective Action Plan (CAP) developed for the prior year FY 2022 audit finding cited for FFATA reporting, the Department of Health (DOH) Grants Unit, with coordination from the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) fiscal staff, added a new function to the System for Administering Grants Electronically (SAGE) that pulls all subaward data for the ELC program using the program’s 93.323 federal Assistance Listing Number (ALN). Thus, the CAP implemented in September 2022 for the prior year FY 2022 audit finding includes SAGE now pulling the subaward data for the entire ELC program by the ALN number and enables the ELC fiscal staff to access all ELC subawards within the DOH. ELC fiscal staff also has a task reminder set to report at the end of each month, enter subaward information into the FFATA Subaward Reporting System (FSRS), and upload each report submitted to the SharePoint ELC Document Library at the end of each month. As per the original CAP created under the FY 2022 audit, FFATA information for ELC subawards were entered into FSRS beginning on September 1, 2022 and DOH actions and efforts have continued to ensure compliance going forward.

Reference Number: 2023-014 Prior Year Finding: 2022-015 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525-02-03 (8/1/2020 - 7/31/2024), 5NU50CK000525-03-00 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS in accordance with FFATA requirements. Context: Twenty-seven subawards were selected for testing. The Department of Health (DOH) is the primary recipient of program funding and, therefore, has overall responsibility for activities funded by the program. In addition to issuing subawards as the prime recipient, DOH also entered into an agreement with the Department of Education (DOE) to issue subawards to public and non-public schools on their behalf. Of the twenty-seven subawards selected for testing, twenty-three were issued by DOH and four were issued by DOE. The following exceptions were noted: • Four of twenty-seven subawards selected for testing were not reported to FSRS. DOE issued the subawards but was unable to provide copies of the subaward agreements or evidence that the subawards had been reported to FSRS. Therefore, the dollar amount of subawards not reported is undetermined. • Ten of twenty-seven subawards selected for testing were not reported timely to FSRS. DOH reported the subawards to FSRS from 21 to 543 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: DOH did not implement procedures or controls to ensure that subawards it issued were reported to FSRS timely. The agreement between DOH and DOE did not clearly state DOE’s responsibilities to maintain copies of subaward agreements and report those subawards to FSRS. In its oversight role, DOH did not review documentation maintained by DOE to ensure compliance with FFATA requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that DOH develop procedures and internal controls to ensure that all required subawards are reported to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. We further recommend that DOH develop procedures and controls over its agreements with other departments to ensure that FFATA reporting requirements are met. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: Based on the Corrective Action Plan (CAP) developed for the prior year FY 2022 audit finding cited for FFATA reporting, the Department of Health (DOH) Grants Unit, with coordination from the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) fiscal staff, added a new function to the System for Administering Grants Electronically (SAGE) that pulls all subaward data for the ELC program using the program’s 93.323 federal Assistance Listing Number (ALN). Thus, the CAP implemented in September 2022 for the prior year FY 2022 audit finding includes SAGE now pulling the subaward data for the entire ELC program by the ALN number and enables the ELC fiscal staff to access all ELC subawards within the DOH. ELC fiscal staff also has a task reminder set to report at the end of each month, enter subaward information into the FFATA Subaward Reporting System (FSRS), and upload each report submitted to the SharePoint ELC Document Library at the end of each month. As per the original CAP created under the FY 2022 audit, FFATA information for ELC subawards were entered into FSRS beginning on September 1, 2022 and DOH actions and efforts have continued to ensure compliance going forward.

Reference Number: 2023-015 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525-02-03 (8/1/2020 - 7/31/2024), 5NU50CK000525-03-00 (8/1/2019 – 7/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 2 CFR section 200.332 also states that pass-through entities must: (d) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1) The subrecipient's prior experience with the same or similar subawards; 2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; 4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. Section III – Federal Award Findings and Questioned Costs (Continued) (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. (f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation of subaward agreements and monitoring activities was not maintained and was not available for audit. Context: The Department of Health (DOH) is the primary recipient of program funding and, therefore, has overall responsibility for activities funded by the program. DOH entered into an agreement with the Department of Education (DOE) to issue subawards to public and non-public schools on their behalf. Six of twenty-six subrecipients selected for testing received subawards issued by DOE. DOE was unable to provide copies of subaward agreements or documentation that subrecipient monitoring activities had been performed. Therefore, auditors were unable to verify compliance with Federal requirements for these subawards. Questioned costs: Undetermined. Cause: The agreement between DOH and DOE did not clearly state DOE’s responsibilities for subaward issuance and monitoring. As a result, DOE did not maintain copies of subaward agreements, nor was it able to provide documentation that it had performed risk assessments or monitoring activities for these subrecipients. In its oversight role, DOH did not review documentation maintained by DOE to ensure compliance with Federal subrecipient monitoring requirements. Effect: Auditors were unable to verify that subawards were issued in accordance with Federal requirements, that the subrecipients were eligible to receive program funding, nor that the subrecipients had been adequately monitored. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: DOH should review and enhance internal controls and procedures regarding agreements with other State departments to issue subawards on its behalf. Agreements should clearly define the responsibilities of other departments to ensure compliance with all Federal requirements. DOH should also periodically review the documentation maintained by other departments that issue subawards on its behalf to ensure it is adequate and is available for audit. DOE should review and enhance internal controls and procedures to ensure that it maintains copies of all subaward agreements, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed for all subrecipients. Documentation of subrecipient monitoring activities should be readily available for audit. Views of responsible officials: The Department of Health (DOH) will enhance its internal controls and procedures, regarding federal subawards issued by other New Jersey State departments and agencies on behalf of DOH. The Department’s Memorandum of Agreement (MOA) and Memorandum of Understanding (MOU) documents will be updated and enhanced to list and define the specific responsibilities and requirements of other departments and pass-through entities more clearly when issuing subawards with federal funding derived from DOH. If necessary, the updated MOA/MOU documents may also include an Exhibit specific to Subrecipient Monitoring, containing the federal Uniform Guidance compliance requirements including mandatory reporting of subgrantee performance indicators and listing records retention requirements for all documentation of monitored subrecipient activities.

Reference Number: 2023-015 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525-02-03 (8/1/2020 - 7/31/2024), 5NU50CK000525-03-00 (8/1/2019 – 7/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 2 CFR section 200.332 also states that pass-through entities must: (d) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1) The subrecipient's prior experience with the same or similar subawards; 2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; 4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. Section III – Federal Award Findings and Questioned Costs (Continued) (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. (f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation of subaward agreements and monitoring activities was not maintained and was not available for audit. Context: The Department of Health (DOH) is the primary recipient of program funding and, therefore, has overall responsibility for activities funded by the program. DOH entered into an agreement with the Department of Education (DOE) to issue subawards to public and non-public schools on their behalf. Six of twenty-six subrecipients selected for testing received subawards issued by DOE. DOE was unable to provide copies of subaward agreements or documentation that subrecipient monitoring activities had been performed. Therefore, auditors were unable to verify compliance with Federal requirements for these subawards. Questioned costs: Undetermined. Cause: The agreement between DOH and DOE did not clearly state DOE’s responsibilities for subaward issuance and monitoring. As a result, DOE did not maintain copies of subaward agreements, nor was it able to provide documentation that it had performed risk assessments or monitoring activities for these subrecipients. In its oversight role, DOH did not review documentation maintained by DOE to ensure compliance with Federal subrecipient monitoring requirements. Effect: Auditors were unable to verify that subawards were issued in accordance with Federal requirements, that the subrecipients were eligible to receive program funding, nor that the subrecipients had been adequately monitored. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: DOH should review and enhance internal controls and procedures regarding agreements with other State departments to issue subawards on its behalf. Agreements should clearly define the responsibilities of other departments to ensure compliance with all Federal requirements. DOH should also periodically review the documentation maintained by other departments that issue subawards on its behalf to ensure it is adequate and is available for audit. DOE should review and enhance internal controls and procedures to ensure that it maintains copies of all subaward agreements, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed for all subrecipients. Documentation of subrecipient monitoring activities should be readily available for audit. Views of responsible officials: The Department of Health (DOH) will enhance its internal controls and procedures, regarding federal subawards issued by other New Jersey State departments and agencies on behalf of DOH. The Department’s Memorandum of Agreement (MOA) and Memorandum of Understanding (MOU) documents will be updated and enhanced to list and define the specific responsibilities and requirements of other departments and pass-through entities more clearly when issuing subawards with federal funding derived from DOH. If necessary, the updated MOA/MOU documents may also include an Exhibit specific to Subrecipient Monitoring, containing the federal Uniform Guidance compliance requirements including mandatory reporting of subgrantee performance indicators and listing records retention requirements for all documentation of monitored subrecipient activities.

Reference Number: 2023-016 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 230INJTANF-00 (10/1/2022-9/30/2023) 230INJTANF-01 (10/1/2022-9/30/2023) 230INJTANF-02 (10/1/2022-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS during FY 2023. Context: Zero of twenty-two subrecipients selected for testing were reported to FSRS during FY 2023. Total subawards tested were $12,764,925.00, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department was unaware of FFATA reporting requirements and did not report subaward information to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Department develop controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services’ Division of Family Development (DFD) agrees with the audit finding regarding the required submission of subawards to the FFATA Subaward Reporting System (FSRS). Due to the complexity and time required to compile and report FFATA subaward data, the DFD is in the process of creating a new full-time equivalent position (FTE) for this required federal reporting task. In accordance with the finding recommendation, the DFD will develop internal controls and procedures to ensure the timely reporting of all required subawards to FSRS. An initial review of the FSRS by DFD fiscal staff appeared to indicate that some federal grant award data that should be prepopulated by the awarding federal agency and available on the website was missing (e.g. Child Care M&M available; Discretionary not found). Staff will reach out to the necessary federal agencies to communicate Section III – Federal Award Findings and Questioned Costs (Continued) instances of missing federal award information in an effort to ensure that the DFD has the ability to input the required subaward information. DFD anticipates that the assessment and development of policy and procedures related to this task will take approximately three (3) months. Staff assignment, training, and submission of federal grant subaward information to the federal website will occur over the next state fiscal year.

Reference Number: 2023-017 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Community Affairs (Department) did not report subaward information timely or accurately to FSRS during FY 2023. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 1 of 8 subawards selected, the amount reported to FSRS did not match the subaward amount. The subaward was issued for $53,278 but the amount reported was $71,021,779. • For 1 of 8 subawards selected, the amount reported to FSRS did not match the subaward amount. The subaward was issued for $566,494 but the amount reported was $465,750. The Division did not report a subaward amendment of $100,744. • Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were reported from 68 to 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subawards were reported accurately and timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department evaluate its procedures and controls to ensure that subawards are reported accurately and timely to FSRS no later than the end of the month following the date of subaward issuance or amendment. Views of responsible officials: The Department of Community Affairs (DCA) has recently implemented timely reporting of required FFATA subaward data in the Federal Subaward Reporting System (FSRS). The FFATA reporting process is fully documented, and additional staff have been hired and trained on the process to further support the federal reporting functions. The FFATA reports identified by the auditors with inaccurate subaward amounts reported have also been corrected in FSRS.

Reference Number: 2023-017 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Community Affairs (Department) did not report subaward information timely or accurately to FSRS during FY 2023. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 1 of 8 subawards selected, the amount reported to FSRS did not match the subaward amount. The subaward was issued for $53,278 but the amount reported was $71,021,779. • For 1 of 8 subawards selected, the amount reported to FSRS did not match the subaward amount. The subaward was issued for $566,494 but the amount reported was $465,750. The Division did not report a subaward amendment of $100,744. • Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were reported from 68 to 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subawards were reported accurately and timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department evaluate its procedures and controls to ensure that subawards are reported accurately and timely to FSRS no later than the end of the month following the date of subaward issuance or amendment. Views of responsible officials: The Department of Community Affairs (DCA) has recently implemented timely reporting of required FFATA subaward data in the Federal Subaward Reporting System (FSRS). The FFATA reporting process is fully documented, and additional staff have been hired and trained on the process to further support the federal reporting functions. The FFATA reports identified by the auditors with inaccurate subaward amounts reported have also been corrected in FSRS.

Reference Number: 2023-018 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: xv. Subrecipient name (which must match the name associated with its unique entity identifier); xvi. Subrecipient's unique entity identifier; xvii. Federal Award Identification Number (FAIN); xviii. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; xix. Subaward Period of Performance Start and End Date; xx. Subaward Budget Period Start and End Date; xxi. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; xxii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; xxiii. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; xxiv. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xxv. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xxvi. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xxvii. Identification of whether the award is R&D; and xxviii. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Community Affairs (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (v) Federal Award Identification Number (FAIN); (vi) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (x) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (xi) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: The Department of Community Affairs (DCA) has reviewed and enhanced internal controls and procedures to ensure that all required information, as per the federal Uniform Guidance pass-through entity requirements, is included in all new LIHEAP subaward contracts. These subaward agreement control enhancements have been implemented effective with the fiscal year 2024 contracts.

Reference Number: 2023-018 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: xv. Subrecipient name (which must match the name associated with its unique entity identifier); xvi. Subrecipient's unique entity identifier; xvii. Federal Award Identification Number (FAIN); xviii. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; xix. Subaward Period of Performance Start and End Date; xx. Subaward Budget Period Start and End Date; xxi. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; xxii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; xxiii. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; xxiv. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xxv. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xxvi. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xxvii. Identification of whether the award is R&D; and xxviii. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Community Affairs (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (v) Federal Award Identification Number (FAIN); (vi) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (x) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (xi) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: The Department of Community Affairs (DCA) has reviewed and enhanced internal controls and procedures to ensure that all required information, as per the federal Uniform Guidance pass-through entity requirements, is included in all new LIHEAP subaward contracts. These subaward agreement control enhancements have been implemented effective with the fiscal year 2024 contracts.

Reference Number: 2023-019 Prior Year Finding: 2022-019 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Performance and Special Reporting Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Quarterly Performance and Management Report (OMB No. 0970-0589) – Grant recipients must submit data and information about LIHEAP during the current FY, including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, and training and technical assistance needs. Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) – As part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. Territories with annual allotments of less than $200,000 and all Indian tribes are required to report only on the number of households served for each program component. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Community Affairs (Department) did not submit performance and special reports timely. The LIHEAP Performance Management Report and Annual Report on Households Assisted by LIHEAP were submitted after their respective due dates. Section III – Federal Award Findings and Questioned Costs (Continued) Context: The following special reporting exceptions were noted: • One of two Quarterly Performance and Management Reports was not submitted timely. The report was due by 7/31/2023, but was not submitted until 8/10/2023, or 10 days late. • One of one Annual Report on Households Assisted by LIHEAP was not submitted timely. The report was due by 12/15/2023 but was not submitted until 12/19/2023, or 4 days late. Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure that the Annual Report on Households Assisted by LIHEAP and the Quarterly Performance and Management Report were submitted timely. Internal controls did not prevent or detect the errors. Effect: Delays in submission of annual performance and special reports could impact the Federal agency’s ability to manage the program, could result in delays in annual awards, and possible penalties or sanctions could be imposed by the grantor. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that performance and special reports are submitted timely. Views of responsible officials: The Department of Community Affairs (DCA) Low-Income Home Energy Assistance Program (LIHEAP) staff have been fully trained to coordinate with the Applied Public Policy Research Institute for Study and Evaluation (APPRISE) and the federal U.S. Department of Health and Human Services (HHS) to ensure that all required reports are submitted timely. DCA has created a schedule of required reports that includes corresponding submission due dates and the process is designed to ensure adequate time is available to accommodate the necessary back and forth communications between DCA and APPRISE required to complete all reporting timely.

Reference Number: 2023-019 Prior Year Finding: 2022-019 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Performance and Special Reporting Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Quarterly Performance and Management Report (OMB No. 0970-0589) – Grant recipients must submit data and information about LIHEAP during the current FY, including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, and training and technical assistance needs. Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) – As part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. Territories with annual allotments of less than $200,000 and all Indian tribes are required to report only on the number of households served for each program component. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Community Affairs (Department) did not submit performance and special reports timely. The LIHEAP Performance Management Report and Annual Report on Households Assisted by LIHEAP were submitted after their respective due dates. Section III – Federal Award Findings and Questioned Costs (Continued) Context: The following special reporting exceptions were noted: • One of two Quarterly Performance and Management Reports was not submitted timely. The report was due by 7/31/2023, but was not submitted until 8/10/2023, or 10 days late. • One of one Annual Report on Households Assisted by LIHEAP was not submitted timely. The report was due by 12/15/2023 but was not submitted until 12/19/2023, or 4 days late. Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure that the Annual Report on Households Assisted by LIHEAP and the Quarterly Performance and Management Report were submitted timely. Internal controls did not prevent or detect the errors. Effect: Delays in submission of annual performance and special reports could impact the Federal agency’s ability to manage the program, could result in delays in annual awards, and possible penalties or sanctions could be imposed by the grantor. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that performance and special reports are submitted timely. Views of responsible officials: The Department of Community Affairs (DCA) Low-Income Home Energy Assistance Program (LIHEAP) staff have been fully trained to coordinate with the Applied Public Policy Research Institute for Study and Evaluation (APPRISE) and the federal U.S. Department of Health and Human Services (HHS) to ensure that all required reports are submitted timely. DCA has created a schedule of required reports that includes corresponding submission due dates and the process is designed to ensure adequate time is available to accommodate the necessary back and forth communications between DCA and APPRISE required to complete all reporting timely.

Reference Number: 2023-020 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS during FY 2023. Total subawards tested were $32,469,131, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department was unaware of FFATA reporting requirements and did not report subaward information to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Department develop controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services’ Division of Family Development (DFD) agrees with the audit finding regarding the required submission of subawards to the FFATA Subaward Reporting System (FSRS). Due to the complexity and time required to compile and report FFATA subaward data, the Section III – Federal Award Findings and Questioned Costs (Continued) DFD is in the process of creating a new full-time equivalent position (FTE) for this required federal reporting task. In accordance with the finding recommendation, the DFD will develop internal controls and procedures to ensure the timely reporting of all required subawards to FSRS. An initial review of the FSRS by DFD fiscal staff appeared to indicate that some federal grant award data that should be prepopulated by the awarding federal agency and available on the website was missing (e.g. Child Care M&M available; Discretionary not found). Staff will reach out to the necessary federal agencies to communicate instances of missing federal award information in an effort to ensure that the DFD has the ability to input the required subaward information. DFD anticipates that the assessment and development of policy and procedures related to this task will take approximately three (3) months. Staff assignment, training, and submission of federal grant subaward information to the federal website will occur over the next state fiscal year.

Reference Number: 2023-020 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS during FY 2023. Total subawards tested were $32,469,131, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department was unaware of FFATA reporting requirements and did not report subaward information to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Department develop controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services’ Division of Family Development (DFD) agrees with the audit finding regarding the required submission of subawards to the FFATA Subaward Reporting System (FSRS). Due to the complexity and time required to compile and report FFATA subaward data, the Section III – Federal Award Findings and Questioned Costs (Continued) DFD is in the process of creating a new full-time equivalent position (FTE) for this required federal reporting task. In accordance with the finding recommendation, the DFD will develop internal controls and procedures to ensure the timely reporting of all required subawards to FSRS. An initial review of the FSRS by DFD fiscal staff appeared to indicate that some federal grant award data that should be prepopulated by the awarding federal agency and available on the website was missing (e.g. Child Care M&M available; Discretionary not found). Staff will reach out to the necessary federal agencies to communicate instances of missing federal award information in an effort to ensure that the DFD has the ability to input the required subaward information. DFD anticipates that the assessment and development of policy and procedures related to this task will take approximately three (3) months. Staff assignment, training, and submission of federal grant subaward information to the federal website will occur over the next state fiscal year.

Reference Number: 2023-020 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS during FY 2023. Total subawards tested were $32,469,131, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department was unaware of FFATA reporting requirements and did not report subaward information to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Department develop controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services’ Division of Family Development (DFD) agrees with the audit finding regarding the required submission of subawards to the FFATA Subaward Reporting System (FSRS). Due to the complexity and time required to compile and report FFATA subaward data, the Section III – Federal Award Findings and Questioned Costs (Continued) DFD is in the process of creating a new full-time equivalent position (FTE) for this required federal reporting task. In accordance with the finding recommendation, the DFD will develop internal controls and procedures to ensure the timely reporting of all required subawards to FSRS. An initial review of the FSRS by DFD fiscal staff appeared to indicate that some federal grant award data that should be prepopulated by the awarding federal agency and available on the website was missing (e.g. Child Care M&M available; Discretionary not found). Staff will reach out to the necessary federal agencies to communicate instances of missing federal award information in an effort to ensure that the DFD has the ability to input the required subaward information. DFD anticipates that the assessment and development of policy and procedures related to this task will take approximately three (3) months. Staff assignment, training, and submission of federal grant subaward information to the federal website will occur over the next state fiscal year.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 2 CFR section 200.332(d) states that pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (4) Reviewing financial and performance reports required by the pass-through entity. (5) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (6) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not comply with subrecipient monitoring requirements for the program. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 2 of 8 subawards selected for testing, the subaward did not include all required Federal Award information. The subawards were missing the Federal Award Date of award to the recipient by the Federal agency. • For 1 of 8 subawards selected for testing, the Department did not conduct an annual desk review for the award as required by the Department’s procedures. Questioned costs: None noted. Cause: The Department’s procedures were not effective to ensure that subawards were issued in compliance with Federal requirements, nor that subrecipient monitoring was performed timely in accordance with Departmental procedures. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements and that proper subrecipient monitoring is performed. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 2 CFR section 200.332(d) states that pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (4) Reviewing financial and performance reports required by the pass-through entity. (5) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (6) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not comply with subrecipient monitoring requirements for the program. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 2 of 8 subawards selected for testing, the subaward did not include all required Federal Award information. The subawards were missing the Federal Award Date of award to the recipient by the Federal agency. • For 1 of 8 subawards selected for testing, the Department did not conduct an annual desk review for the award as required by the Department’s procedures. Questioned costs: None noted. Cause: The Department’s procedures were not effective to ensure that subawards were issued in compliance with Federal requirements, nor that subrecipient monitoring was performed timely in accordance with Departmental procedures. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements and that proper subrecipient monitoring is performed. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 2 CFR section 200.332(d) states that pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (4) Reviewing financial and performance reports required by the pass-through entity. (5) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (6) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not comply with subrecipient monitoring requirements for the program. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 2 of 8 subawards selected for testing, the subaward did not include all required Federal Award information. The subawards were missing the Federal Award Date of award to the recipient by the Federal agency. • For 1 of 8 subawards selected for testing, the Department did not conduct an annual desk review for the award as required by the Department’s procedures. Questioned costs: None noted. Cause: The Department’s procedures were not effective to ensure that subawards were issued in compliance with Federal requirements, nor that subrecipient monitoring was performed timely in accordance with Departmental procedures. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements and that proper subrecipient monitoring is performed. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – CMS-64 Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: CMS-64, Quarterly Statement of Expenditures for the Medical Assistance Program (OMB No. 0938-1265) – Required to be used in lieu of the SF-425, Federal Financial Report (for all components of the cluster other administrative costs of the state MFCUs), prepared quarterly, and submitted electronically to CMS within 30 days after the end of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not file the CMS-64 report timely. Context: One of two CMS-64 reports selected for testing was not filed timely. The report for the 12/31/2022 quarter was due 1/30/2023 but was submitted 2/9/2023, or 10 days late. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that CMS-64 reports were filed timely. Internal controls did not prevent or detect the error. Effect: Failure to submit CMS-64 reports timely could impact the Federal Agency’s ability to oversee the program. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: We recommend that the Department enhance its procedures and controls to ensure that CMS-64 reports are filed timely, no later than 30 days after the end of each quarter. Views of responsible officials: With regard to the late quarterly CMS 64 report submission noted in the audit finding, the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) notified the Center for Medicaid Services (CMS) in advance that the report for the December 31, 2022 quarter would be filed after the due date. DMHAS is working to streamline reporting of the CMS-64 by improving automation where possible in order to adhere to the due date. However, as in the case of the report for quarter ending December 31, 2022, the DMAHS places strong emphasis on the accuracy and integrity of its quarterly CMS-64 reporting, which may at times lead to submission after the required due date. In the event this occurs, the DMAHS will continue to notify CMS in advance when reports will be submitted after the due date.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – CMS-64 Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: CMS-64, Quarterly Statement of Expenditures for the Medical Assistance Program (OMB No. 0938-1265) – Required to be used in lieu of the SF-425, Federal Financial Report (for all components of the cluster other administrative costs of the state MFCUs), prepared quarterly, and submitted electronically to CMS within 30 days after the end of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not file the CMS-64 report timely. Context: One of two CMS-64 reports selected for testing was not filed timely. The report for the 12/31/2022 quarter was due 1/30/2023 but was submitted 2/9/2023, or 10 days late. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that CMS-64 reports were filed timely. Internal controls did not prevent or detect the error. Effect: Failure to submit CMS-64 reports timely could impact the Federal Agency’s ability to oversee the program. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: We recommend that the Department enhance its procedures and controls to ensure that CMS-64 reports are filed timely, no later than 30 days after the end of each quarter. Views of responsible officials: With regard to the late quarterly CMS 64 report submission noted in the audit finding, the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) notified the Center for Medicaid Services (CMS) in advance that the report for the December 31, 2022 quarter would be filed after the due date. DMHAS is working to streamline reporting of the CMS-64 by improving automation where possible in order to adhere to the due date. However, as in the case of the report for quarter ending December 31, 2022, the DMAHS places strong emphasis on the accuracy and integrity of its quarterly CMS-64 reporting, which may at times lead to submission after the required due date. In the event this occurs, the DMAHS will continue to notify CMS in advance when reports will be submitted after the due date.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – CMS-64 Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: CMS-64, Quarterly Statement of Expenditures for the Medical Assistance Program (OMB No. 0938-1265) – Required to be used in lieu of the SF-425, Federal Financial Report (for all components of the cluster other administrative costs of the state MFCUs), prepared quarterly, and submitted electronically to CMS within 30 days after the end of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not file the CMS-64 report timely. Context: One of two CMS-64 reports selected for testing was not filed timely. The report for the 12/31/2022 quarter was due 1/30/2023 but was submitted 2/9/2023, or 10 days late. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that CMS-64 reports were filed timely. Internal controls did not prevent or detect the error. Effect: Failure to submit CMS-64 reports timely could impact the Federal Agency’s ability to oversee the program. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: We recommend that the Department enhance its procedures and controls to ensure that CMS-64 reports are filed timely, no later than 30 days after the end of each quarter. Views of responsible officials: With regard to the late quarterly CMS 64 report submission noted in the audit finding, the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) notified the Center for Medicaid Services (CMS) in advance that the report for the December 31, 2022 quarter would be filed after the due date. DMHAS is working to streamline reporting of the CMS-64 by improving automation where possible in order to adhere to the due date. However, as in the case of the report for quarter ending December 31, 2022, the DMAHS places strong emphasis on the accuracy and integrity of its quarterly CMS-64 reporting, which may at times lead to submission after the required due date. In the event this occurs, the DMAHS will continue to notify CMS in advance when reports will be submitted after the due date.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – CMS-64 Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: CMS-64, Quarterly Statement of Expenditures for the Medical Assistance Program (OMB No. 0938-1265) – Required to be used in lieu of the SF-425, Federal Financial Report (for all components of the cluster other administrative costs of the state MFCUs), prepared quarterly, and submitted electronically to CMS within 30 days after the end of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not file the CMS-64 report timely. Context: One of two CMS-64 reports selected for testing was not filed timely. The report for the 12/31/2022 quarter was due 1/30/2023 but was submitted 2/9/2023, or 10 days late. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that CMS-64 reports were filed timely. Internal controls did not prevent or detect the error. Effect: Failure to submit CMS-64 reports timely could impact the Federal Agency’s ability to oversee the program. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: We recommend that the Department enhance its procedures and controls to ensure that CMS-64 reports are filed timely, no later than 30 days after the end of each quarter. Views of responsible officials: With regard to the late quarterly CMS 64 report submission noted in the audit finding, the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) notified the Center for Medicaid Services (CMS) in advance that the report for the December 31, 2022 quarter would be filed after the due date. DMHAS is working to streamline reporting of the CMS-64 by improving automation where possible in order to adhere to the due date. However, as in the case of the report for quarter ending December 31, 2022, the DMAHS places strong emphasis on the accuracy and integrity of its quarterly CMS-64 reporting, which may at times lead to submission after the required due date. In the event this occurs, the DMAHS will continue to notify CMS in advance when reports will be submitted after the due date.

Reference Number: 2023-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Opioid STR Assistance Listing Number: 93.788 Award Number and Year: H79T1083317 (9/3/2020 – 9/29/2023), H79T1085743 (9/30/2022 – 9/29/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Health (Department) did not report subaward information to FSRS during FY 2023. Context: Zero of ten subawards selected for testing were reported to FSRS during FY 2023. Total subawards tested were $6,500,401, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not develop procedures and controls to ensure subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Department develop controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 there were no Federal Funding Accountability & Transparency Act (FFATA) reporting procedures in place. It is important to note however, that DMHAS provided adequate support for subrecipient payments to each of the selected samples and corresponding dollar amounts. DMHAS was unable to comply with the FFATA reporting requirements due to insufficient staffing levels, the significant volume of data and effort required, and the significant demands and operational challenges precipitated by the Covid-19 Public Health Emergency. DMHAS will develop a formal policy with procedures to comply with FFATA reporting requirements. More specifically, the policy will identify all FFATA reporting requirements consistent with the law, and dictate standard operating procedures, including ongoing monitoring and progress reporting. DMHAS’s policy and practices will rely upon, and comport with, the applicable materials and Awardee User resources available at: https://www.fsrs.gov/ and https://www.fsrs.gov/documents/FSRS_Awardee_User_Guide.pdf. Section III – Federal Award Findings and Questioned Costs (Continued) DMHAS procedures will ensure the reporting of all first-tier subawards of $30,000 or more to the FSRS with all required FFATA data elements included. DMHAS will hire at least one (1) additional staff for the requisite data entry. The new staff member will be situated in the DMHAS Fiscal Unit, and will report directly to, and be under the supervision of the Fiscal Unit Budget Manager. One hundred percent of the new hire’s effort will be dedicated to FFATA reporting and data entry. DMHAS began the new hire process on or about March 22, 2024, and anticipates that the new hire will be on boarded in approximately ninety (90) days. In addition, the DMHAS Fiscal Unit Contract Manager (or the Contract Manager’s designated staff) will work with the Budget Manager and the FFATA new hire to assist with the collection and verification of the requisite Subrecipient data that must be entered into the FSRS portal. DMHAS will require all staff with FFATA reporting duties to complete the available online trainings. Furthermore, designated staff will be required to complete a FFATA Access Request Form that will be reviewed and approved by the DMHAS Chief Financial Officer. Designated staff shall also be subject to fixed Eligibility Criteria (e.g. completion of all IT Security Trainings, FFATA training(s), current DHS Confidentiality and Non-Disclosure Agreement, etc.). Access will be revoked if a Disqualifying Event such as separation of employment or failure to complete training occurs. DMHAS conferred recently with DHS, the designated grant recipient, and secured from DHS the requisite FSRS login credentials. DMHAS Fiscal logged into the reporting system and began work on a process description. DMHAS is committed to FFATA compliance, is prioritizing FFATA policy, procedures and reporting, and is making a good faith effort to comply. DMHAS will ensure that the requisite sub-award data is entered timely (no later than the end of the month following the month of issuance) into the FSRS portal, beginning January 1, 2025. In the event DMHAS cannot complete timely data entry into FSRS because of system issues outside of its control (e.g. the underlying federal award does not appear in FSRS), DMHAS will keep a record of the requisite data and document its efforts.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Opioid STR Assistance Listing Number: 93.788 Award Number and Year: H79T1083317 (9/3/2020 – 9/29/2023), H79T1085743 (9/30/2022 – 9/29/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not include all required information in subaward agreements. Context: Ten subawards were selected for testing and the following exceptions were noted: • For 10 of 10 subawards selected for testing, the Federal Award Date of award to the recipient by the Federal agency was omitted from the subaward agreement. • For 2 of 10 subawards selected for testing, the subrecipient’s unique entity identifier was not obtained and was omitted from the subaward agreement. Questioned costs: None noted. Cause: The Department’s procedures were not effective to ensure that subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Section III – Federal Award Findings and Questioned Costs (Continued) Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements. Views of responsible officials: The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with Section III – Federal Award Findings and Questioned Costs (Continued) 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this 2023 Audit, and in order to correct and mitigate against clerical/ministerial errors, DMHAS is transferring responsibility for the preparation and execution of Notices of Subrecipient Award from Program/Initiative Managers, to the DMHAS Fiscal Unit, Contract Manager (and the Contract Manager’s Contract Administration staff). Such staff will have total SAGE AGATE system access, and be best suited to ensure that Notices of Subrecipient Award comply with 2 CFR 200.332. Finally, as a preventive action, the DMHAS Compliance Unit will audit the issuance of post-contract negotiation Notices of Award in three (3) months, and again in six (6) months. The internal audit will sample no less than ten (10) newly awarded/renewed deficit-funded contracts for substance use disorder services, and will measure compliance with every element identified in 2 CFR 200.332.

Reference Number: 2023-026 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 – Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: B08TI083538 (3/15/2021 – 3/14/2023), B08TI084660 (10/1/2020 – 9/30/2023), B08TI083465 (10/1/2020 – 9/30/2022), B08TI085822 (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS by the Department of Human Services (Department). Context: Eight of eight subawards selected for testing were not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not establish effective procedures and internal controls over FFATA requirements to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: Undetermined. Recommendation: We recommend that the Department develop procedures and internal controls to ensure that all required subawards are reported to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 there were no Federal Funding Accountability & Transparency Act (FFATA) reporting procedures in place. It is important to note however, that DMHAS provided adequate support for subrecipient payments to each of the selected samples and corresponding dollar amounts. DMHAS was unable to comply with the FFATA reporting requirements due to insufficient staffing levels, the significant volume of data and effort required, and the significant demands and operational challenges precipitated by the Covid-19 Public Health Emergency. DMHAS will develop a formal policy with procedures to comply with FFATA reporting requirements. More specifically, the policy will identify all FFATA reporting requirements consistent with the law, and dictate standard operating procedures, including ongoing monitoring and progress reporting. DMHAS’s policy and practices will rely upon, and comport with, the applicable materials and Awardee User resources available at: https://www.fsrs.gov/ and https://www.fsrs.gov/documents/FSRS_Awardee_User_Guide.pdf. Section III – Federal Award Findings and Questioned Costs (Continued) DMHAS procedures will ensure the reporting of all first-tier subawards of $30,000 or more to the FSRS with all required FFATA data elements included. DMHAS will hire at least one (1) additional staff for the requisite data entry. The new staff member will be situated in the DMHAS Fiscal Unit, and will report directly to, and be under the supervision of the Fiscal Unit Budget Manager. One hundred percent of the new hire’s effort will be dedicated to FFATA reporting and data entry. DMHAS began the new hire process on or about March 22, 2024, and anticipates that the new hire will be on boarded in approximately ninety (90) days. In addition, the DMHAS Fiscal Unit Contract Manager (or the Contract Manager’s designated staff) will work with the Budget Manager and the FFATA new hire to assist with the collection and verification of the requisite Subrecipient data that must be entered into the FSRS portal. DMHAS will require all staff with FFATA reporting duties to complete the available online trainings. Furthermore, designated staff will be required to complete a FFATA Access Request Form that will be reviewed and approved by the DMHAS Chief Financial Officer. Designated staff shall also be subject to fixed Eligibility Criteria (e.g. completion of all IT Security Trainings, FFATA training(s), current DHS Confidentiality and Non-Disclosure Agreement, etc.). Access will be revoked if a Disqualifying Event such as separation of employment or failure to complete training occurs. DMHAS conferred recently with DHS, the designated grant recipient, and secured from DHS the requisite FSRS login credentials. DMHAS Fiscal logged into the reporting system and began work on a process description. DMHAS is committed to FFATA compliance, is prioritizing FFATA policy, procedures and reporting, and is making a good faith effort to comply. DMHAS will ensure that the requisite sub-award data is entered timely (no later than the end of the month following the month of issuance) into the FSRS portal, beginning January 1, 2025. In the event DMHAS cannot complete timely data entry into FSRS because of system issues outside of its control (e.g. the underlying federal award does not appear in FSRS), DMHAS will keep a record of the requisite data and document its efforts.

Reference Number: 2023-026 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 – Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: B08TI083538 (3/15/2021 – 3/14/2023), B08TI084660 (10/1/2020 – 9/30/2023), B08TI083465 (10/1/2020 – 9/30/2022), B08TI085822 (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS by the Department of Human Services (Department). Context: Eight of eight subawards selected for testing were not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not establish effective procedures and internal controls over FFATA requirements to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: Undetermined. Recommendation: We recommend that the Department develop procedures and internal controls to ensure that all required subawards are reported to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 there were no Federal Funding Accountability & Transparency Act (FFATA) reporting procedures in place. It is important to note however, that DMHAS provided adequate support for subrecipient payments to each of the selected samples and corresponding dollar amounts. DMHAS was unable to comply with the FFATA reporting requirements due to insufficient staffing levels, the significant volume of data and effort required, and the significant demands and operational challenges precipitated by the Covid-19 Public Health Emergency. DMHAS will develop a formal policy with procedures to comply with FFATA reporting requirements. More specifically, the policy will identify all FFATA reporting requirements consistent with the law, and dictate standard operating procedures, including ongoing monitoring and progress reporting. DMHAS’s policy and practices will rely upon, and comport with, the applicable materials and Awardee User resources available at: https://www.fsrs.gov/ and https://www.fsrs.gov/documents/FSRS_Awardee_User_Guide.pdf. Section III – Federal Award Findings and Questioned Costs (Continued) DMHAS procedures will ensure the reporting of all first-tier subawards of $30,000 or more to the FSRS with all required FFATA data elements included. DMHAS will hire at least one (1) additional staff for the requisite data entry. The new staff member will be situated in the DMHAS Fiscal Unit, and will report directly to, and be under the supervision of the Fiscal Unit Budget Manager. One hundred percent of the new hire’s effort will be dedicated to FFATA reporting and data entry. DMHAS began the new hire process on or about March 22, 2024, and anticipates that the new hire will be on boarded in approximately ninety (90) days. In addition, the DMHAS Fiscal Unit Contract Manager (or the Contract Manager’s designated staff) will work with the Budget Manager and the FFATA new hire to assist with the collection and verification of the requisite Subrecipient data that must be entered into the FSRS portal. DMHAS will require all staff with FFATA reporting duties to complete the available online trainings. Furthermore, designated staff will be required to complete a FFATA Access Request Form that will be reviewed and approved by the DMHAS Chief Financial Officer. Designated staff shall also be subject to fixed Eligibility Criteria (e.g. completion of all IT Security Trainings, FFATA training(s), current DHS Confidentiality and Non-Disclosure Agreement, etc.). Access will be revoked if a Disqualifying Event such as separation of employment or failure to complete training occurs. DMHAS conferred recently with DHS, the designated grant recipient, and secured from DHS the requisite FSRS login credentials. DMHAS Fiscal logged into the reporting system and began work on a process description. DMHAS is committed to FFATA compliance, is prioritizing FFATA policy, procedures and reporting, and is making a good faith effort to comply. DMHAS will ensure that the requisite sub-award data is entered timely (no later than the end of the month following the month of issuance) into the FSRS portal, beginning January 1, 2025. In the event DMHAS cannot complete timely data entry into FSRS because of system issues outside of its control (e.g. the underlying federal award does not appear in FSRS), DMHAS will keep a record of the requisite data and document its efforts.

Reference Number: 2023-027 Prior Year Finding: No Federal Agency: Social Security Administration State Agency: Department of Labor and Workforce Development Federal Program: Disability Insurance/SSI Cluster Assistance Listing Number: 96.001 Award Number and Year: 04-2304NJD100 (10/1/2022 – 9/30/2023), 04-2204NJD100 (10/1/2021 – 9/30/2022) Compliance Requirement: Special Tests and Provisions – Qualified Providers Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Each state agency is responsible for comprehensive oversight management of its process and for ensuring accuracy, integrity, and economy of its process (20 CFR sections 404.1519g and 416.919g, and POMS DI 39569.300). As part of these duties, Disability Determination Services (DDS) must have, and follow, procedures for performing medical license verifications to ensure that only qualified providers perform DDSs task. By “qualified,” Social Security Administration (SSA) means that the medical source must: Be currently licensed in the state and have the training and experience to perform the type of examination or test the DDS requests; and a. Not be barred from participation in Medicare or Medicaid programs or other federal or federally assisted programs (20 CFR sections 404.1519g and 416.919g). Prior to using the services of any medical provider, the DDS must check the System of Award Management (SAM) website (https://sam.gov/SAM/) to verify medical licenses, credentials, and certifications with state medical boards (POMS DI 39569.300). and ensure medical staff and CE providers are qualified to perform the assigned tasks. Assigned tasks may include, but are not limited to, providing consultative examinations (CE) or final review of disability determinations. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor and Workforce Development (Department) did not perform timely periodic reviews of providers performing Consultative Examination (CE) services. Context: For one of forty CE providers selected for testing, the periodic review was not completed timely during FY2023. Section III – Federal Award Findings and Questioned Costs (Continued) Questioned costs: Undetermined. Cause: The Department’s procedures were not effective to ensure that CE provider reviews were completed timely. Internal controls did not prevent or detect the errors. Effect: Untimely provider periodic reviews could result in ineligible CE providers performing services under the program. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all periodic CE provider reviews are completely timely. Views of responsible officials: The audit finding noted one Consultative Examination (CE) provider where the qualified provider review was not completed timely and this was an oversight on the part of the Department of Labor and Workforce Development’s Division of Disability Services (DDS) due to attrition of staff. Going forward, each DDS Professional Relations Officer will be responsible for reviewing eight to 10 CE provider’s qualifications each month until the yearly review is completed for each vendor. The Chief of Professional Relations will submit a monthly report to the DDS Assistant Director detailing how many sites were visited that month and any findings that may have occurred. Each month, the report will detail how many reports remain outstanding in order to complete the yearly reviews.

Reference Number: 2023-028 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Department of Law and Public Safety Federal Program: COVID-19 - Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: 066124021PA: 8/31/11; 066224614PA: 9/5/21; 066164264PA: 3/14/16; 066214597PA: 4/28/21; 066184368PA: 6/6/18; 066214574PA: 12/11/20; 066204488PA: 3/13/20; 066134086PA: 10/30/12 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Law and Public Safety (Department) did not report subaward information to FSRS during FY 2023. Context: Forty of forty subawards selected for testing were not reported to FSRS. The subawards were issued from 2/18/2022 through 11/22/2023 and were not reported to FSRS until after they were selected for testing by auditors during January and February 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has insufficient procedures and internal controls to ensure that subawards are reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: Unlike other subgrants managed by the Department of Law and Public Safety (DLPS), the subgrants in the Public Assistance program are not issued by the Department but instead are issued by the Federal Emergency Management Agency (FEMA). These FEMA-issued subgrants take the form of Project Worksheets (PWs) and are directly related to a specific disaster. FEMA informs the DLPS of the approved PWs after they are issued. Given the unique nature of the PW issuance, the DLPS is not in a position to report on the FFATA Subaward Reporting System (FSRS) at the time PWs are issued. This contrasts with other grant programs overseen by the DLPS, which do allow for timely subaward reporting in FSRS. The Department will continue to work with our FEMA partners, incorporating any guidance they provide, to develop procedures that ensure subawards are reported in FSRS within the FFATA reporting requirements.

Reference Number: 2023-028 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Department of Law and Public Safety Federal Program: COVID-19 - Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: 066124021PA: 8/31/11; 066224614PA: 9/5/21; 066164264PA: 3/14/16; 066214597PA: 4/28/21; 066184368PA: 6/6/18; 066214574PA: 12/11/20; 066204488PA: 3/13/20; 066134086PA: 10/30/12 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Law and Public Safety (Department) did not report subaward information to FSRS during FY 2023. Context: Forty of forty subawards selected for testing were not reported to FSRS. The subawards were issued from 2/18/2022 through 11/22/2023 and were not reported to FSRS until after they were selected for testing by auditors during January and February 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has insufficient procedures and internal controls to ensure that subawards are reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: Unlike other subgrants managed by the Department of Law and Public Safety (DLPS), the subgrants in the Public Assistance program are not issued by the Department but instead are issued by the Federal Emergency Management Agency (FEMA). These FEMA-issued subgrants take the form of Project Worksheets (PWs) and are directly related to a specific disaster. FEMA informs the DLPS of the approved PWs after they are issued. Given the unique nature of the PW issuance, the DLPS is not in a position to report on the FFATA Subaward Reporting System (FSRS) at the time PWs are issued. This contrasts with other grant programs overseen by the DLPS, which do allow for timely subaward reporting in FSRS. The Department will continue to work with our FEMA partners, incorporating any guidance they provide, to develop procedures that ensure subawards are reported in FSRS within the FFATA reporting requirements.

Reference Number: 2023-001 Prior Year Finding: 2022-003 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Eligibility Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Regular Unemployment Compensation (UC) Program – Under state UC laws, a worker’s benefit rights depend on the amount of the worker’s wages and/or weeks of work in covered employment in a “base period.” While most states define the base period as the first four of the last five completed calendar quarters prior to the filing of the claim, other base periods may be used. To qualify for benefits, a claimant must have earned a certain amount of wages or have worked a certain number of weeks or calendar quarters within the base period or meet some combination of wage and employment requirements. Some states require a waiting period of one week of total or partial unemployment before UC is payable. A “waiting period” is a non-compensable period of unemployment in which the worker is otherwise eligible for benefits. To be eligible to receive UC, all states provide that a claimant must have been separated from suitable work for non-disqualifying reasons under state law (i.e., not because of such acts as leaving voluntarily without good cause or discharge for misconduct connected with work). After separation, he or she must be able and available for work, actively seeking work, legally authorized to work in the United States and must not have refused an offer of suitable work. Pandemic Unemployment Assistance (PUA) – PUA provides benefits to covered individuals, who are those individuals not eligible for regular unemployment compensation (UC or extended benefits under state or federal law or Pandemic Emergency Unemployment Compensation (PEUC), including those who have exhausted all rights to such benefits. Covered individuals also include self-employed, those seeking part-time employment, individuals lacking sufficient work history, and those who otherwise do not qualify for regular unemployment compensation or extended benefits under state or federal law or PEUC. PUA is payable to individuals who are ineligible for regular UC, and are unemployed, partially unemployed, or unable or unavailable to work due to one of the COVID-19 related reasons identified Attachment I to UIPL No. 16-20, Change 5. Section 2102(a)(3)(A)(ii)(I) of the CARES Act included 10 specific COVID-19 related reasons. The Department, under the authority provided by Section 2102(a)(3)(A)(ii)(I)(kk) of the CARES Act, has added additional COVID-19 related reasons; these are discussed in more detail in Section 4.a. of UIPL No. 16-20, Change 5. While three of these new COVID- Section III – Federal Award Findings and Questioned Costs (Continued) 19 related reasons were introduced to states with the publication of UIPL No. 16-20, Change 5 on February 25, 2021, all COVID-19 related reasons apply retroactively to the beginning of the PUA program. Additionally, as described in Section 4.b.i. of UIPL No. 16-20, Change 5, paraphrasing of the COVID-19 related reasons is not permissible; individuals must be permitted to select more than one COVID-19 related reason; individuals must be permitted to select different COVID-19 related reasons each week; and individuals must be permitted to file and select no COVID-19 related reasons. Federal Pandemic Unemployment Compensation (FPUC) – To be eligible for FPUC during the program dates described in Section 8 above, individuals must be eligible to receive at least $1 of underlying benefits for the week in question (including regular UC, UCFE, UCX, PEUC, PUA, EB, STC, TRA, DUA, and SEA). FPUC does not require the individual to submit a separate initial application or continued claim. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: CLA noted that ineligible claimants were being paid unemployment insurance. The Department of Labor and Workforce Development (Department) did not maintain an effective control environment over eligibility requirements of the New Jersey Local Office Online Payment System (NJLOOPS) for both FPUC and PUA. Context: Sixty claimants were selected for testing which included 24 claimants for Regular UC and Extended Benefits, 25 claimants for FPUC and 11 claimants for PUA. We noted the following exceptions: • FPUC: 4 of 25 claimants receiving benefits did not receive $1 of other benefits for the payment period. • PUA: 3 of 11 claimants receiving PUA did not identify a COVID-19 reason for their unemployment and were ineligible for the program. • PUA: The Department was unable to provide support for 2 of 11 claimants and eligibility could not be verified. Questioned costs: $3,202 - The total amount of benefits received by ineligible recipients: • FPUC: $1,800 • PUA: $1,402 Section III – Federal Award Findings and Questioned Costs (Continued) Cause: The Department began providing benefits to claimants before NJLOOPS had completed the eligibility determination process. Effect: Ineligible claimants received unemployment compensation benefits. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that only eligible claimants receive unemployment compensation benefits. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) has controls in place to only allow an FPUC payment to be made when an underlying Unemployment Insurance (UI) payment has also been processed. FPUC payments should not be issued to any claim without the underlying UI payment being made for the same week. The FPUC payments issued and noted as exceptions during eligibility testing will be reviewed independently by DLWD to determine if the payments issued were to eligible recipients or not. For the PUA exceptions noted during Eligibility testing, overall the DLWD issued PUA payments to over 680,000 claimants during the COVID-19 pandemic. DLWD had controls in place to require a COVID related reason to make the claim PUA eligible and the weekly PUA certification required claimants to choose a COVID related reason for why they were out of work before they could get paid. The PUA payments in question will be reviewed independently by the DLWD to determine if the payments issued under PUA were appropriate or if they should have been paid instead under the regular UI program. DLWD corrective actions related to FPUC and PUA payments were fully implemented as of September 2023.

Reference Number: 2023-001 Prior Year Finding: 2022-003 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Eligibility Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Regular Unemployment Compensation (UC) Program – Under state UC laws, a worker’s benefit rights depend on the amount of the worker’s wages and/or weeks of work in covered employment in a “base period.” While most states define the base period as the first four of the last five completed calendar quarters prior to the filing of the claim, other base periods may be used. To qualify for benefits, a claimant must have earned a certain amount of wages or have worked a certain number of weeks or calendar quarters within the base period or meet some combination of wage and employment requirements. Some states require a waiting period of one week of total or partial unemployment before UC is payable. A “waiting period” is a non-compensable period of unemployment in which the worker is otherwise eligible for benefits. To be eligible to receive UC, all states provide that a claimant must have been separated from suitable work for non-disqualifying reasons under state law (i.e., not because of such acts as leaving voluntarily without good cause or discharge for misconduct connected with work). After separation, he or she must be able and available for work, actively seeking work, legally authorized to work in the United States and must not have refused an offer of suitable work. Pandemic Unemployment Assistance (PUA) – PUA provides benefits to covered individuals, who are those individuals not eligible for regular unemployment compensation (UC or extended benefits under state or federal law or Pandemic Emergency Unemployment Compensation (PEUC), including those who have exhausted all rights to such benefits. Covered individuals also include self-employed, those seeking part-time employment, individuals lacking sufficient work history, and those who otherwise do not qualify for regular unemployment compensation or extended benefits under state or federal law or PEUC. PUA is payable to individuals who are ineligible for regular UC, and are unemployed, partially unemployed, or unable or unavailable to work due to one of the COVID-19 related reasons identified Attachment I to UIPL No. 16-20, Change 5. Section 2102(a)(3)(A)(ii)(I) of the CARES Act included 10 specific COVID-19 related reasons. The Department, under the authority provided by Section 2102(a)(3)(A)(ii)(I)(kk) of the CARES Act, has added additional COVID-19 related reasons; these are discussed in more detail in Section 4.a. of UIPL No. 16-20, Change 5. While three of these new COVID- Section III – Federal Award Findings and Questioned Costs (Continued) 19 related reasons were introduced to states with the publication of UIPL No. 16-20, Change 5 on February 25, 2021, all COVID-19 related reasons apply retroactively to the beginning of the PUA program. Additionally, as described in Section 4.b.i. of UIPL No. 16-20, Change 5, paraphrasing of the COVID-19 related reasons is not permissible; individuals must be permitted to select more than one COVID-19 related reason; individuals must be permitted to select different COVID-19 related reasons each week; and individuals must be permitted to file and select no COVID-19 related reasons. Federal Pandemic Unemployment Compensation (FPUC) – To be eligible for FPUC during the program dates described in Section 8 above, individuals must be eligible to receive at least $1 of underlying benefits for the week in question (including regular UC, UCFE, UCX, PEUC, PUA, EB, STC, TRA, DUA, and SEA). FPUC does not require the individual to submit a separate initial application or continued claim. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: CLA noted that ineligible claimants were being paid unemployment insurance. The Department of Labor and Workforce Development (Department) did not maintain an effective control environment over eligibility requirements of the New Jersey Local Office Online Payment System (NJLOOPS) for both FPUC and PUA. Context: Sixty claimants were selected for testing which included 24 claimants for Regular UC and Extended Benefits, 25 claimants for FPUC and 11 claimants for PUA. We noted the following exceptions: • FPUC: 4 of 25 claimants receiving benefits did not receive $1 of other benefits for the payment period. • PUA: 3 of 11 claimants receiving PUA did not identify a COVID-19 reason for their unemployment and were ineligible for the program. • PUA: The Department was unable to provide support for 2 of 11 claimants and eligibility could not be verified. Questioned costs: $3,202 - The total amount of benefits received by ineligible recipients: • FPUC: $1,800 • PUA: $1,402 Section III – Federal Award Findings and Questioned Costs (Continued) Cause: The Department began providing benefits to claimants before NJLOOPS had completed the eligibility determination process. Effect: Ineligible claimants received unemployment compensation benefits. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that only eligible claimants receive unemployment compensation benefits. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) has controls in place to only allow an FPUC payment to be made when an underlying Unemployment Insurance (UI) payment has also been processed. FPUC payments should not be issued to any claim without the underlying UI payment being made for the same week. The FPUC payments issued and noted as exceptions during eligibility testing will be reviewed independently by DLWD to determine if the payments issued were to eligible recipients or not. For the PUA exceptions noted during Eligibility testing, overall the DLWD issued PUA payments to over 680,000 claimants during the COVID-19 pandemic. DLWD had controls in place to require a COVID related reason to make the claim PUA eligible and the weekly PUA certification required claimants to choose a COVID related reason for why they were out of work before they could get paid. The PUA payments in question will be reviewed independently by the DLWD to determine if the payments issued under PUA were appropriate or if they should have been paid instead under the regular UI program. DLWD corrective actions related to FPUC and PUA payments were fully implemented as of September 2023.

Reference Number: 2023-002 Prior Year Finding: 2022-005 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The WPRS and RESEA programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. WPRS, which is mandated by Section 303(j) of the Social Security Act, is designed to identify UI claimants who are most likely to exhaust their benefits and need reemployment assistance to return to work, and refer them to appropriate reemployment services, such as: job search and job placement assistance; counseling; testing; provision of occupational and labor market information; and assessments. WPRS provides reemployment services to selected claimants through an early intervention process. The number of individuals served under WPRS is determined by the state (and/or local areas) based on its capacity to serve these individuals. UIPL No. 41-94 provides guidance on WPRS requirements. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not retain documentation required by the RESEA program to verify compliance with federal program regulations. Controls were not working sufficiently to document that a staff member at the Department with knowledge of the program reviewed eligibility requirements prior to admission of participants to the RESEA program. Context: The Department’s policy is that RESEA eligibility interviews must be conducted and eligibility review forms completed. Both steps are to be reviewed and signed by the participant and an Unemployment Insurance (UI) staff member who is knowledgeable of the program requirements. Sixty cases were selected for testing and the following exceptions were noted: • For 9 of 60 cases selected for testing, the Department was unable to provide a signed RESEA worksheet indicating the interview had been completed and the claimant was reviewed and approved by a UI supervisor. • For 1 of 60 cases selected for testing, the Department was unable to provide the signed worksheet nor the Notice to Claimant that included the RESEA eligibility conditions, requirements, benefits, and clear warnings regarding the consequences of failure to comply with program requirements. • For 1 of 60 cases selected for testing, the claimant did not complete all required RESEA forms. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls are not sufficient to ensure compliance with RESEA requirements. Effect: Without clear documentation supporting a participant’s eligibility and supervisory review, ineligible participants could go undetected and federal funds could be paid to recipients who do not qualify to participate in the RESEA program. Recommendation: We recommend that policies and procedures be implemented to ensure that internal controls over RESEA include retention of documentation of each participant’s eligibility and review and approval by a UI supervisor. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: The Reemployment Services and Eligibility Assessments (RESEA) policy and controls presently in place at the Department of Labor and Workforce Development (DLWD) require eligibility interviews to be conducted and eligibility review forms to be completed and signed by the participant and UI program representative. DLWD implemented a new process that allows staff to electronically obtain signatures through Simpligov, beginning June 2023. This process requires that staff obtain all necessary signatures before a RESEA claimant record is completed. Supervisors are assigned to monitor this process in order to mitigate the risk associated with missing information on any single RESEA customer registration. DLWD will monitor this process to ensure that all interviews are properly documented, and forms are signed and electronically uploaded to its electronic case management system of record for future reference. During the initial rollout of this process, there were records that didn’t migrate to the case management system of record. This issue has now been addressed through training. DLWD has also developed dashboards that will assist with monitoring data entry. Monthly reviews of RESEA data entry will be conducted to identify possible errors. These RESEA process changes that will be implemented by DLWD will ensure compliance with regulatory standards and assist with maintaining the integrity of its data management process.

Reference Number: 2023-002 Prior Year Finding: 2022-005 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The WPRS and RESEA programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. WPRS, which is mandated by Section 303(j) of the Social Security Act, is designed to identify UI claimants who are most likely to exhaust their benefits and need reemployment assistance to return to work, and refer them to appropriate reemployment services, such as: job search and job placement assistance; counseling; testing; provision of occupational and labor market information; and assessments. WPRS provides reemployment services to selected claimants through an early intervention process. The number of individuals served under WPRS is determined by the state (and/or local areas) based on its capacity to serve these individuals. UIPL No. 41-94 provides guidance on WPRS requirements. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not retain documentation required by the RESEA program to verify compliance with federal program regulations. Controls were not working sufficiently to document that a staff member at the Department with knowledge of the program reviewed eligibility requirements prior to admission of participants to the RESEA program. Context: The Department’s policy is that RESEA eligibility interviews must be conducted and eligibility review forms completed. Both steps are to be reviewed and signed by the participant and an Unemployment Insurance (UI) staff member who is knowledgeable of the program requirements. Sixty cases were selected for testing and the following exceptions were noted: • For 9 of 60 cases selected for testing, the Department was unable to provide a signed RESEA worksheet indicating the interview had been completed and the claimant was reviewed and approved by a UI supervisor. • For 1 of 60 cases selected for testing, the Department was unable to provide the signed worksheet nor the Notice to Claimant that included the RESEA eligibility conditions, requirements, benefits, and clear warnings regarding the consequences of failure to comply with program requirements. • For 1 of 60 cases selected for testing, the claimant did not complete all required RESEA forms. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls are not sufficient to ensure compliance with RESEA requirements. Effect: Without clear documentation supporting a participant’s eligibility and supervisory review, ineligible participants could go undetected and federal funds could be paid to recipients who do not qualify to participate in the RESEA program. Recommendation: We recommend that policies and procedures be implemented to ensure that internal controls over RESEA include retention of documentation of each participant’s eligibility and review and approval by a UI supervisor. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: The Reemployment Services and Eligibility Assessments (RESEA) policy and controls presently in place at the Department of Labor and Workforce Development (DLWD) require eligibility interviews to be conducted and eligibility review forms to be completed and signed by the participant and UI program representative. DLWD implemented a new process that allows staff to electronically obtain signatures through Simpligov, beginning June 2023. This process requires that staff obtain all necessary signatures before a RESEA claimant record is completed. Supervisors are assigned to monitor this process in order to mitigate the risk associated with missing information on any single RESEA customer registration. DLWD will monitor this process to ensure that all interviews are properly documented, and forms are signed and electronically uploaded to its electronic case management system of record for future reference. During the initial rollout of this process, there were records that didn’t migrate to the case management system of record. This issue has now been addressed through training. DLWD has also developed dashboards that will assist with monitoring data entry. Monthly reviews of RESEA data entry will be conducted to identify possible errors. These RESEA process changes that will be implemented by DLWD will ensure compliance with regulatory standards and assist with maintaining the integrity of its data management process.

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or Section III – Federal Award Findings and Questioned Costs (Continued) the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor and Workforce Development (Department) was unable to provide documentation that case reviews were completed per the requirements of ET Handbook No. 395. Context: Forty cases were selected for testing, consisting of 20 Paid Benefit Claims and 20 Denied Claims. The following exceptions were noted: • 4 of 20 Paid Benefit Claims appear to have been reviewed, but the Department was unable to provide documentation that the case review had been completed and signed by appropriate staff. • 1 of 20 Paid Benefit Claims did not have evidence of case review. The Department was unable to provide a copy of the investigative report. • 8 of 20 Denied Claims appear to have been reviewed, but the Department was unable to provide documentation that the case review had been completed and signed by appropriate staff. • 1 of 20 Denied Claims did not have evidence of case review. The Department was unable to provide a copy of the investigative report. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure that BAM case reviews were completed and signed by appropriate staff. Effect: Noncompliance with BAM case investigation requirements could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely, that reviews are signed by appropriate staff, and that it maintains documentation supporting completion of the case reviews. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) will continue to review and enhance controls to ensure that BAM quality control case investigations are completed timely, that reviews are signed as required by appropriate staff, and that all required case review supporting documentation is maintained in case files. DLWD corrective actions will be completed by September 30, 2024. For the PUA exceptions noted during Eligibility testing, overall the DLWD issued PUA payments to over 680,000 claimants during the COVID-19 pandemic. DLWD had controls in place to require a COVID related reason to make the claim PUA eligible and the weekly PUA certification required claimants to choose a COVID related reason for why they were out of work before they could get paid. The PUA payments in question will be reviewed independently by the DLWD to determine if the payments issued under PUA were appropriate or if they should have been paid instead under the regular UI program.

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or Section III – Federal Award Findings and Questioned Costs (Continued) the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor and Workforce Development (Department) was unable to provide documentation that case reviews were completed per the requirements of ET Handbook No. 395. Context: Forty cases were selected for testing, consisting of 20 Paid Benefit Claims and 20 Denied Claims. The following exceptions were noted: • 4 of 20 Paid Benefit Claims appear to have been reviewed, but the Department was unable to provide documentation that the case review had been completed and signed by appropriate staff. • 1 of 20 Paid Benefit Claims did not have evidence of case review. The Department was unable to provide a copy of the investigative report. • 8 of 20 Denied Claims appear to have been reviewed, but the Department was unable to provide documentation that the case review had been completed and signed by appropriate staff. • 1 of 20 Denied Claims did not have evidence of case review. The Department was unable to provide a copy of the investigative report. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure that BAM case reviews were completed and signed by appropriate staff. Effect: Noncompliance with BAM case investigation requirements could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely, that reviews are signed by appropriate staff, and that it maintains documentation supporting completion of the case reviews. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) will continue to review and enhance controls to ensure that BAM quality control case investigations are completed timely, that reviews are signed as required by appropriate staff, and that all required case review supporting documentation is maintained in case files. DLWD corrective actions will be completed by September 30, 2024. For the PUA exceptions noted during Eligibility testing, overall the DLWD issued PUA payments to over 680,000 claimants during the COVID-19 pandemic. DLWD had controls in place to require a COVID related reason to make the claim PUA eligible and the weekly PUA certification required claimants to choose a COVID related reason for why they were out of work before they could get paid. The PUA payments in question will be reviewed independently by the DLWD to determine if the payments issued under PUA were appropriate or if they should have been paid instead under the regular UI program.

Reference Number: 2023-004 Prior Year Finding: 2022-004 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022), UI-34073-20-55-A-34 (10/1/19 – 12/31/22), UI-32614-19-55-A-34 (10/1/18 – 12/31/21), UI-37238-22-55-A-34 (10/1/21 – 12/31/24), UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025) Compliance Requirement: Reporting – ETA 9050 and ETA 9052 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The ETA 9050 – Time Lapse of All First Payments except Workshare report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. First Payments are considered timely at 14/21 days, Interstate and Intrastate UI, UCFE, and UCX, full and partial weeks. The report is due in the ETA National Office on the 20th of the month following the month to which the data relates. The ETA 9052 – Nonmonetary Determination Time Lapse Detection report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Nonmonetary determinations are considered timely if completed within 21 days. The report is due in the ETA National Office on the 20th of the month following the month to which the data relates. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Department of Labor and Workforce Development (Department) indicate that First Payment Time Lapse and Nonmonetary Determinations were untimely during FY 2023. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Four ETA 9050 and four ETA 9052 reports were selected for testing for the months of September 2022, November 2022, February 2023, and May 2023. We noted the following exceptions: • ETA 9050: 4 of 4 reports indicate that First Payments were made in more than 14/21 days. • ETA 9052: 4 of 4 reports indicate that nonmonetary determinations were completed in more than 21 days. Questioned costs: None noted. Cause: The Department’s procedures and controls were not operating effectively to ensure that first payments and nonmonetary determinations were completed timely. Effect: First Payments and Nonmonetary Determinations were not completed timely as required by the program. Recommendation: We recommend that the Department review its policies and procedures to ensure that it makes first payments within 14/21 days and that nonmonetary determinations are completed within 21 days per program requirements. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) continues to monitor all first payment and non-monetary time lapse figures in order to meet the established USDOL Acceptable Levels of Performance (ALP). As workloads return to normal levels after the increased activity from the COVID-19 pandemic related claims, greater emphasis will continue to be placed on meeting all ALPs. Specifically relating to first payments and the previously discussed issues with claimants verifying their identity before any payments can be made, the DLWD has made some internal changes to how returned verified IDs from our ID verification partner (ID.me) are handled. These modifications to the internal process used to clear verified IDs are expected to have a positive impact on overall time lapse numbers as verified claimants will not be delayed longer than they previously were under the old process. The month of April starts the new reporting year for these figures to USDOL and New Jersey expects to see significant increases to first payment and non-monetary time lapse figures by the third quarter of calendar year 2024.

Reference Number: 2023-004 Prior Year Finding: 2022-004 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022), UI-34073-20-55-A-34 (10/1/19 – 12/31/22), UI-32614-19-55-A-34 (10/1/18 – 12/31/21), UI-37238-22-55-A-34 (10/1/21 – 12/31/24), UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025) Compliance Requirement: Reporting – ETA 9050 and ETA 9052 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The ETA 9050 – Time Lapse of All First Payments except Workshare report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. First Payments are considered timely at 14/21 days, Interstate and Intrastate UI, UCFE, and UCX, full and partial weeks. The report is due in the ETA National Office on the 20th of the month following the month to which the data relates. The ETA 9052 – Nonmonetary Determination Time Lapse Detection report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Nonmonetary determinations are considered timely if completed within 21 days. The report is due in the ETA National Office on the 20th of the month following the month to which the data relates. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Department of Labor and Workforce Development (Department) indicate that First Payment Time Lapse and Nonmonetary Determinations were untimely during FY 2023. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Four ETA 9050 and four ETA 9052 reports were selected for testing for the months of September 2022, November 2022, February 2023, and May 2023. We noted the following exceptions: • ETA 9050: 4 of 4 reports indicate that First Payments were made in more than 14/21 days. • ETA 9052: 4 of 4 reports indicate that nonmonetary determinations were completed in more than 21 days. Questioned costs: None noted. Cause: The Department’s procedures and controls were not operating effectively to ensure that first payments and nonmonetary determinations were completed timely. Effect: First Payments and Nonmonetary Determinations were not completed timely as required by the program. Recommendation: We recommend that the Department review its policies and procedures to ensure that it makes first payments within 14/21 days and that nonmonetary determinations are completed within 21 days per program requirements. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) continues to monitor all first payment and non-monetary time lapse figures in order to meet the established USDOL Acceptable Levels of Performance (ALP). As workloads return to normal levels after the increased activity from the COVID-19 pandemic related claims, greater emphasis will continue to be placed on meeting all ALPs. Specifically relating to first payments and the previously discussed issues with claimants verifying their identity before any payments can be made, the DLWD has made some internal changes to how returned verified IDs from our ID verification partner (ID.me) are handled. These modifications to the internal process used to clear verified IDs are expected to have a positive impact on overall time lapse numbers as verified claimants will not be delayed longer than they previously were under the old process. The month of April starts the new reporting year for these figures to USDOL and New Jersey expects to see significant increases to first payment and non-monetary time lapse figures by the third quarter of calendar year 2024.

Reference Number: 2023-005 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Information Technology General Controls Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). As part of an entity’s internal controls to reasonably ensure compliance over Federal laws and regulations, an entity must maintain an effective control environment over their information technology systems used to generate and process information to administer Federal programs in accordance with the respective rules and regulations that govern the program. Condition: The Department of Labor and Workforce Development (Department) did not maintain an effective control environment over change management of the New Jersey Local Office Online Payment System (NJLOOPS). Context: The NJLOOPS application is an essential system hosted within the Office of Information Technology’s (OIT) infrastructure used by the Department for unemployment insurance eligibility, claims, benefit calculations, and payments. NJLOOPS application management is provided by Department staff. We noted that the prior year finding for internal controls over change management was not corrected. Specifically, we noted that while tickets have been documented for the sample of changes tested for the NJLOOPS change management procedures, they do not maintain key information described in the change management policy such as programmatic work performed, testing, and approval of the effort for promotion to the Production environment. Auditors were able to obtain evidence of testing and approval for 1 of the 5 change samples selected for testing via email communication. Further, we noted that two individuals have the ability to develop and promote their own changes to production which poses a segregation of duties issue. Section III – Federal Award Findings and Questioned Costs (Continued) Questioned costs: Undetermined. Cause: Due to limitations on staffing and increased demand on IT resources due to the additional requirements of the pandemic's unemployment program, the agency was unable to comply with its internal change management procedures requirements. Effect: Noncompliance with the requirements of internal change management procedures and a lack of segregation of duties could increase the risk of potential unauthorized or unapproved changes occurring to the application. Recommendation: We recommend the Department follow the statewide change management policy and formally document the request, testing, and approval of all changes related to the NJLOOPS application. We further recommend that the Department implement segregation of duties controls to prevent the same user from developing, approving, and promoting a system change to the production environment. Views of responsible officials: The Department of Labor and Workforce Development’s (DLWD) Office of Information Management, Services & Solutions (OIMSS) will continue its efforts to ensure staff compliance with existing controls over program change controls for the New Jersey Local Office Online Payment System (NJLOOPs). DLWD’s efforts will continue to be guided by statewide change management best practices. OIMSS will add a Director-level approval step to the program promotion process that will validate that the required documentation has been uploaded to the change ticket. Except in circumstances involving emergency off-hours break fix resolution, separation of duties will be included as a check-off for approval to deploy program changes.

Reference Number: 2023-005 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-39337-23-55-A-34 (10/1/2022 – 12/31/2025), UI-37238-22-55-A-34 (10/1/2021 – 12/31/2024), UI-35663-21-55-A-34 (10/1/2020 – 12/31/2023), UI-35959-21-60-A-34 (1/1/2021 – 9/30/2022) Compliance Requirement: Information Technology General Controls Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). As part of an entity’s internal controls to reasonably ensure compliance over Federal laws and regulations, an entity must maintain an effective control environment over their information technology systems used to generate and process information to administer Federal programs in accordance with the respective rules and regulations that govern the program. Condition: The Department of Labor and Workforce Development (Department) did not maintain an effective control environment over change management of the New Jersey Local Office Online Payment System (NJLOOPS). Context: The NJLOOPS application is an essential system hosted within the Office of Information Technology’s (OIT) infrastructure used by the Department for unemployment insurance eligibility, claims, benefit calculations, and payments. NJLOOPS application management is provided by Department staff. We noted that the prior year finding for internal controls over change management was not corrected. Specifically, we noted that while tickets have been documented for the sample of changes tested for the NJLOOPS change management procedures, they do not maintain key information described in the change management policy such as programmatic work performed, testing, and approval of the effort for promotion to the Production environment. Auditors were able to obtain evidence of testing and approval for 1 of the 5 change samples selected for testing via email communication. Further, we noted that two individuals have the ability to develop and promote their own changes to production which poses a segregation of duties issue. Section III – Federal Award Findings and Questioned Costs (Continued) Questioned costs: Undetermined. Cause: Due to limitations on staffing and increased demand on IT resources due to the additional requirements of the pandemic's unemployment program, the agency was unable to comply with its internal change management procedures requirements. Effect: Noncompliance with the requirements of internal change management procedures and a lack of segregation of duties could increase the risk of potential unauthorized or unapproved changes occurring to the application. Recommendation: We recommend the Department follow the statewide change management policy and formally document the request, testing, and approval of all changes related to the NJLOOPS application. We further recommend that the Department implement segregation of duties controls to prevent the same user from developing, approving, and promoting a system change to the production environment. Views of responsible officials: The Department of Labor and Workforce Development’s (DLWD) Office of Information Management, Services & Solutions (OIMSS) will continue its efforts to ensure staff compliance with existing controls over program change controls for the New Jersey Local Office Online Payment System (NJLOOPs). DLWD’s efforts will continue to be guided by statewide change management best practices. OIMSS will add a Director-level approval step to the program promotion process that will validate that the required documentation has been uploaded to the change ticket. Except in circumstances involving emergency off-hours break fix resolution, separation of duties will be included as a check-off for approval to deploy program changes.

Reference Number: 2023-006 Prior Year Finding: 2022-007 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-33245-19-55-A-34 (7/1/2019 – 9/30/2022), AA-34783-20-55-A-34 (7/1/2020 – 9/30/2023), AA-36334-21-55-A-34 (7/1/2021 – 9/30/2024), AA-38544-22-55-A-34 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Labor and Workforce Development (Department) did not report subaward information timely to FSRS. Context: Six of eight subawards selected for testing were not reported timely to FSRS. The subawards were issued on 8/31/2022 and were not reported to FSRS until 3/1/2023, or 182 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) transitioned from a manual contract agreement process to a web-based grant administration system in recent years that employs the System for Administering Grants Electronically (SAGE) and IntelliGrants (IGX) applications. The DLWD FFATA Reporting Unit has access to these automated systems and monitors them on a monthly basis to identify when new subaward contracts/agreements are approved in order to report required data in the FFATA system timely. DLWD corrective actions regarding FFATA reporting are expected to be fully implemented as of June 30, 2024.

Reference Number: 2023-006 Prior Year Finding: 2022-007 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-33245-19-55-A-34 (7/1/2019 – 9/30/2022), AA-34783-20-55-A-34 (7/1/2020 – 9/30/2023), AA-36334-21-55-A-34 (7/1/2021 – 9/30/2024), AA-38544-22-55-A-34 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Labor and Workforce Development (Department) did not report subaward information timely to FSRS. Context: Six of eight subawards selected for testing were not reported timely to FSRS. The subawards were issued on 8/31/2022 and were not reported to FSRS until 3/1/2023, or 182 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) transitioned from a manual contract agreement process to a web-based grant administration system in recent years that employs the System for Administering Grants Electronically (SAGE) and IntelliGrants (IGX) applications. The DLWD FFATA Reporting Unit has access to these automated systems and monitors them on a monthly basis to identify when new subaward contracts/agreements are approved in order to report required data in the FFATA system timely. DLWD corrective actions regarding FFATA reporting are expected to be fully implemented as of June 30, 2024.

Reference Number: 2023-006 Prior Year Finding: 2022-007 Federal Agency: U.S. Department of Labor State Agency: Department of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-33245-19-55-A-34 (7/1/2019 – 9/30/2022), AA-34783-20-55-A-34 (7/1/2020 – 9/30/2023), AA-36334-21-55-A-34 (7/1/2021 – 9/30/2024), AA-38544-22-55-A-34 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Labor and Workforce Development (Department) did not report subaward information timely to FSRS. Context: Six of eight subawards selected for testing were not reported timely to FSRS. The subawards were issued on 8/31/2022 and were not reported to FSRS until 3/1/2023, or 182 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Labor and Workforce Development (DLWD) transitioned from a manual contract agreement process to a web-based grant administration system in recent years that employs the System for Administering Grants Electronically (SAGE) and IntelliGrants (IGX) applications. The DLWD FFATA Reporting Unit has access to these automated systems and monitors them on a monthly basis to identify when new subaward contracts/agreements are approved in order to report required data in the FFATA system timely. DLWD corrective actions regarding FFATA reporting are expected to be fully implemented as of June 30, 2024.

Reference Number: 2023-007 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Human Services Federal Program: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Award Number and Year: H126A230044 (10/1/2022-9/30/2023) H126A230044-A (10/1/2022-9/30/2023) H126A230044-B (10/1/2022-9/30/2023) H126A210043 (10/1/2020-9/30/2022) H126A220043-22C (10/1/2021-9/30/2022) H126A230043 (10/1/2022-9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) charged unallowable payroll costs to the program. Context: For one of forty samples selected for testing, the Department made an overpayment to an employee of $113.00 in salary and wages. Cause: Controls were not operating effectively to ensure that allowable payroll costs were charged to the program. A step increase was improperly applied to the employee which resulted in an overpayment of salary and wages. Effect: Unallowable employee salaries and wages were charged to the program. Questioned costs: $113.00, the amount of the overpayment. Recommendation: The Department should review procedures and controls to ensure that only allowable time and effort costs are charged to the program. Views of responsible officials: The Department of Human Services (DHS), Central Office Payroll group will run reports biweekly to determine if any employees are on a leave without pay status greater than 10 days. This added reporting function will ensure that all DHS employees who are on a leave of absence without pay beyond 10 days have their PMIS histories updated upon each extension and return to work.

Reference Number: 2023-008 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Award Number and Year: H126A230044 (10/1/2022-9/30/2023) H126A230044-A (10/1/2022-9/30/2023) H126A230044-B (10/1/2022-9/30/2023) H126A210043 (10/1/2020-9/30/2022) H126A220043-22C (10/1/2021-9/30/2022) H126A230043 (10/1/2022-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subaward information was not reported timely to FSRS by the Department of Human Services (Department). Context: Eight of eight subawards selected for testing were not reported to FSRS. Specifically, we noted the following: • Eight of eight subawards were issued on 8/16/2022 but were not reported to FSRS until 3/10/2023 or approximately 161 days after required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not establish effective procedures or internal controls over FFATA requirements to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop procedures and internal controls to ensure that all required subawards are reported to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: The Department of Labor and Workforce Development (DLWD), as the prime recipient of the federal awards, will ensure that all first-tier subawards made to entities totaling $30,000 or greater will be entered timely into the FSRS in accordance with FFATA reporting requirements. The audit sample selections in question were based on manual DLWD notice of awards that were not communicated correctly to staff who are responsible for entering the required subaward information into FSRS. Going forward, DLWD staff who are responsible for entering data into the FSRS will be copied on all emails containing the manual notice of award(s) once the notice is signed by the DLWD Commissioner. These email communications will trigger the information to be entered into the FSRS.

Reference Number: 2023-009 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: Supporting Effective Instruction State Grants Assistance Listing Number: 84.367 Award Number and Year: S367A200029 (7/1/2020-9/30/23) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Education (Department) did not report subaward information to FSRS during FY 2023. Context: Forty of forty subawards selected for testing were not reported to FSRS. Reports were due no later than 8/31/2022 but were not reported to FSRS until after they were selected by auditors for testing. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and internal controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the Section III – Federal Award Findings and Questioned Costs (Continued) FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. Section III – Federal Award Findings and Questioned Costs (Continued) • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-010 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Elementary and Secondary School Emergency Relief (ESSER) Fund, COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) program, COVID-19 - American Rescue Plan -Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D,R,U Award Number and Year: S425D200027 (5/1/2020-9/30/2022) S425R210031 (2/22/2021-9/30/2022) S425U210027 (3/24/2021-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Sub awardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not report subaward information timely to FSRS during FY 2023. Context: Sixty out of sixty subawards selected for testing were due on 8/31/2022 and were not reported to FSRS until 11/3/2022, or 76 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s internal controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The New Jersey Department of Education (NJDOE) Office of Grants Management (OGM) understands the need to be compliant with FFATA reporting in accordance with the Uniform Guidance. Internal controls and processes are in place to ensure NJDOE’s FFATA reporting process is working efficiently and timely. This noncompliance finding is not due to a lack of controls within NJDOE but lies squarely on system issues at SAM.gov and the FFATA Subaward Reporting System (FSRS) sites and until the Section III – Federal Award Findings and Questioned Costs (Continued) issues listed below are corrected on these federal system sites, NJDOE will continue to be noncompliant with timely FFATA reporting. Issues with the SAM.gov and FSRS sites: • SAM.gov has approved NJDOE’s local education agency (LEA) registrations without a ZIP+4, but FSRS reporting system for FFATA uploads requires ZIP+4 for each LEA. The two systems use the same database, which means information registered on SAM.gov feeds directly into the FSRS system. However, because FSRS batch uploads require a ZIP+4, those LEAs that were approved by SAM.gov without a ZIP+4 during the registration process, are rejected from the FFATA report batch upload. There is an option to manually load each LEA and their details into the system, but the process becomes incredibly time consuming, given the 700+ LEAs in the state, the number of federal awards granted, and the steps for identifying & removing rejected LEAs from the batch upload. • Issues NJDOE has with SAM.gov and FSRS have been shared with the federal helpdesk and a USED representative without avail, as the systematic issue remains unresolved and continues to delay our FFATA reporting process. • There are several rural LEAs in the state that do not have a ZIP+4. These LEAs will continue to be rejected from the batch upload, delaying our FFATA reporting process, if SAM.gov and FSRS do not come up with a viable solution. • There were a number of LEAs that were continuously rejected from the upload by FSRS for no obvious reasons. The error message received was the same exact error we receive for incorrect zip codes. After spending much time investigating the cause with the helpdesk support, it was identified that FSRS did not update their system to reflect the Congressional District code changes during New Jersey’s redistricting process. • The FSRS system rejects batch uploads if a single lower-case SAM UEIs is entered in the batch file. However, SAM.gov search box and the FSRS manual uploads are not case sensitive. Batch uploads are the only place where SAM UEIs are case sensitive. Further, this information is not included in any of the FSRS User Guides or manuals. I have shared this with the FSRS helpdesk, but no solution was provided. Again, this discrepancy in their system affects and delays our FFATA reporting processes. NJDOE dedicated personnel, including the director of OGM, continuously work with SAM.gov, FSRS system, and both system sites’ help desks, to bring to light the issues mentioned above in order to express the urgent need for corrective actions at the federal system sites to allow for timely FFATA reporting. In addition internal controls and procedures are in place at NJDOE related to FFATA reporting and corrective actions are constantly performed in real time to perform the below NJDOE Internal Controls and Procedures. Some of these procedures include reviewing internal SAM applications and troubleshooting with NJDOE’s local education agencies (LEAs) to correct data in the application and resubmit to the federal reporting system sites with more detail included below. NJDOE Internal Controls and Procedures: • Due to the large number of LEAs in the state (700+), each FFATA report must be submitted via batch upload, which saves an enormous amount of time it takes to input data manually for every single LEA, for every grant. To address this need and to expedite the process, our vendor has created a reporting tool that generates a FFATA batch report. Section III – Federal Award Findings and Questioned Costs (Continued) • We have been contacting the federal helpdesk to address the issues on their sites and asking for support. Some of those tickets were closed without providing any support and most were not helpful. • We have created and implemented an in-house System for Award Management (SAM) application, mandatory for all of our federal grant recipients. This was done specifically for FFATA reporting purposes to ensure data in these applications are directly tied to the FFATA batch reports. • The SAM applications go through a thorough review process, where data entered by the districts is compared with the data registered with SAM.gov (applicants are required to upload a copy of their Entity Overview Record, issued by SAM.gov). • SAM applications are returned for changes whenever an applicant has entered data that is inconsistent with data on SAM.gov (i.e.. Incorrect SAM UEI, incorrect zip code, incorrect zip+4, incorrect City name). • We have asked many of our districts to contact SAM.gov and update their physical address information to include the full 9-digit zip code, which was SAM.gov reviewers’ oversight. Our school districts have commented that this process can take months. • We are communicating with our districts/applicants on a daily basis through the review summary checklist, outlining the changes that must be made, as well as by email and phone. • We have implemented an automatic messaging system, where applicants are reminded to update their SAM registration expiration date, multiple times a month leading up to their expiration date. Due to the system discrepancy in the FSRS system’s batch upload, we had to create a workaround pertaining to the district’s SAM UEIs. As stated above, SAM UEIs, in batch FFATA reports, are case sensitive while not case sensitive anywhere else in the two system sites. We have updated our instructions in NJDOE’s SAM application and have added another layer of application review, to ensure that all UEIs entered are in all capital letters. Because the federal helpdesk has ignored this discrepancy and did not resolve the issue, we are obligated to take additional steps and spend additional time on FFATA batch reports.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; Section III – Federal Award Findings and Questioned Costs (Continued) xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Human Services (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Views of responsible officials: The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; Section III – Federal Award Findings and Questioned Costs (Continued) xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Human Services (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Views of responsible officials: The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; Section III – Federal Award Findings and Questioned Costs (Continued) xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Human Services (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Views of responsible officials: The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; Section III – Federal Award Findings and Questioned Costs (Continued) xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Human Services (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Views of responsible officials: The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; Section III – Federal Award Findings and Questioned Costs (Continued) xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Human Services (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Views of responsible officials: The Division of Aging Services (DoAS) will comply with the pass-through entity and subrecipient monitoring requirements under the federal Uniform Guidance as per CFR § 200.332(a). The DoAS will provide all required information to the subrecipient at the time of award issuance. This subaward notice will be posted as a miscellaneous attachment to contracts in the Division's System for Administering Grants Electronically (SAGE), or via mail, fax or email to those subawards not administered in SAGE. DoAS plans to complete and update this information on SAGE within 60 days.

Reference Number: 2023-012 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS timely during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were issued in January 2023 and were not reported to FSRS until July 2023. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subaward information was reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department enhance its controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Aging Services (DoAS) continues to work towards attaining full compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. The DoAS continues to consult with the Department and/or other DHS Division fiscal leadership to finalize the FFATA procedures. These procedures shall include creating a list of all active first-tier subawards of federal funds DoAS has issued at $30,000 or more. The list will include all the Section III – Federal Award Findings and Questioned Costs (Continued) data fields required for FFATA reporting. DoAS grants management members will ensure each of the identified subawards is entered on the Federal Subaward Reporting System (FSRS) website. DoAS will also revise internal procedures to ensure all future subawards of $30,000 or more are entered on FSRS within 30 days of award.

Reference Number: 2023-012 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS timely during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were issued in January 2023 and were not reported to FSRS until July 2023. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subaward information was reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department enhance its controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Aging Services (DoAS) continues to work towards attaining full compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. The DoAS continues to consult with the Department and/or other DHS Division fiscal leadership to finalize the FFATA procedures. These procedures shall include creating a list of all active first-tier subawards of federal funds DoAS has issued at $30,000 or more. The list will include all the Section III – Federal Award Findings and Questioned Costs (Continued) data fields required for FFATA reporting. DoAS grants management members will ensure each of the identified subawards is entered on the Federal Subaward Reporting System (FSRS) website. DoAS will also revise internal procedures to ensure all future subawards of $30,000 or more are entered on FSRS within 30 days of award.

Reference Number: 2023-012 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS timely during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were issued in January 2023 and were not reported to FSRS until July 2023. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subaward information was reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department enhance its controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Aging Services (DoAS) continues to work towards attaining full compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. The DoAS continues to consult with the Department and/or other DHS Division fiscal leadership to finalize the FFATA procedures. These procedures shall include creating a list of all active first-tier subawards of federal funds DoAS has issued at $30,000 or more. The list will include all the Section III – Federal Award Findings and Questioned Costs (Continued) data fields required for FFATA reporting. DoAS grants management members will ensure each of the identified subawards is entered on the Federal Subaward Reporting System (FSRS) website. DoAS will also revise internal procedures to ensure all future subawards of $30,000 or more are entered on FSRS within 30 days of award.

Reference Number: 2023-012 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS timely during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were issued in January 2023 and were not reported to FSRS until July 2023. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subaward information was reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department enhance its controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Aging Services (DoAS) continues to work towards attaining full compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. The DoAS continues to consult with the Department and/or other DHS Division fiscal leadership to finalize the FFATA procedures. These procedures shall include creating a list of all active first-tier subawards of federal funds DoAS has issued at $30,000 or more. The list will include all the Section III – Federal Award Findings and Questioned Costs (Continued) data fields required for FFATA reporting. DoAS grants management members will ensure each of the identified subawards is entered on the Federal Subaward Reporting System (FSRS) website. DoAS will also revise internal procedures to ensure all future subawards of $30,000 or more are entered on FSRS within 30 days of award.

Reference Number: 2023-012 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Aging Cluster and COVID-19 Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101NJOASS (10/1/2020 – 9/30/2022) 2101NJOANS (10/1/2020 – 9/30/2022) 2101NJSSC6 (4/1/2021 – 9/30/2024) 2101NJHDC6 (4/1/2021 – 9/3/2024) 2101NJOANS (10/1/2020 – 9/30/2022) 2201NJOASS (10/1/2021 – 9/30/2023) 2201NJOACM (10/1/2021 – 9/30/2023) 2201NJOAHD (10/1/2021-9/30/2023) 2201NJOAPH (10/1/2021-9/30/2023) 2201NJOAFC (10/1/2021-9/30/2023) 2301NJOACM (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS timely during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were issued in January 2023 and were not reported to FSRS until July 2023. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subaward information was reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department enhance its controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Aging Services (DoAS) continues to work towards attaining full compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. The DoAS continues to consult with the Department and/or other DHS Division fiscal leadership to finalize the FFATA procedures. These procedures shall include creating a list of all active first-tier subawards of federal funds DoAS has issued at $30,000 or more. The list will include all the Section III – Federal Award Findings and Questioned Costs (Continued) data fields required for FFATA reporting. DoAS grants management members will ensure each of the identified subawards is entered on the Federal Subaward Reporting System (FSRS) website. DoAS will also revise internal procedures to ensure all future subawards of $30,000 or more are entered on FSRS within 30 days of award.

Reference Number: 2023-013 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: NH23IP922594 (7/1/19 – 6/30/24) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS by the Department of Health (Department). Context: Twelve of thirteen subawards selected for testing were not reported to FSRS. Specifically, we noted the following: • 8 of 13 subawards were issued on 7/1/2021 and they were not reported to FSRS until 7/20/2023, or approximately two years late. • 3 of 13 subawards was issued on 4/1/2022 and were reported to FSRS on 7/20/2023 and 9/22/2023, or 14 to 17 months late. • 1 of 13 subawards was issued on 12/19/2022 and was not reported to FSRS until 6/7/2023, or approximately five months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not allocate personnel nor establish procedures or controls for FFATA reporting. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop procedures and internal controls to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Health’s (DOH) Vaccine Preventable Disease Program (VPDP) is in compliance with the Federal Funding Accountability and Transparency Act (FFATA) requirements with regard to reporting all active first-tier subawards of federal COVID-19 funds that DOH divisions have issued totaling $30,000 or greater under this Cooperative Agreement and COVID-19 Supplemental. However, it is not in compliance with regard to reporting required subaward data in FSRS by the end of the month following the month in which DOH has made the subawards totaling $30,000 or greater. Section III – Federal Award Findings and Questioned Costs (Continued) The VPDP will continue to follow the DOH policy set forth in FMC 22-05 and report to FSRS all active first-tier subawards of federal COVID-19 funds DOH divisions have issued at $30,000 or greater under the COVID-19 Supplementals. The VPDP fiscal/grants leadership team will strive to ensure each of the identified subawards is entered on the FFATA Subaward Reporting System (FSRS) website by the end of the month following the month that DOH has made the subawards. VPDP will continue its efforts to bring the gap in reporting to FSRS down from five months presently to within the specified FFATA submission deadlines denoted above. VPDP also has on boarded a full-time Contract Administrator 2 who will be responsible for reporting FFATA data into FSRS for the Immunization Cooperative Agreement.

Reference Number: 2023-013 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: NH23IP922594 (7/1/19 – 6/30/24) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS by the Department of Health (Department). Context: Twelve of thirteen subawards selected for testing were not reported to FSRS. Specifically, we noted the following: • 8 of 13 subawards were issued on 7/1/2021 and they were not reported to FSRS until 7/20/2023, or approximately two years late. • 3 of 13 subawards was issued on 4/1/2022 and were reported to FSRS on 7/20/2023 and 9/22/2023, or 14 to 17 months late. • 1 of 13 subawards was issued on 12/19/2022 and was not reported to FSRS until 6/7/2023, or approximately five months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not allocate personnel nor establish procedures or controls for FFATA reporting. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop procedures and internal controls to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Health’s (DOH) Vaccine Preventable Disease Program (VPDP) is in compliance with the Federal Funding Accountability and Transparency Act (FFATA) requirements with regard to reporting all active first-tier subawards of federal COVID-19 funds that DOH divisions have issued totaling $30,000 or greater under this Cooperative Agreement and COVID-19 Supplemental. However, it is not in compliance with regard to reporting required subaward data in FSRS by the end of the month following the month in which DOH has made the subawards totaling $30,000 or greater. Section III – Federal Award Findings and Questioned Costs (Continued) The VPDP will continue to follow the DOH policy set forth in FMC 22-05 and report to FSRS all active first-tier subawards of federal COVID-19 funds DOH divisions have issued at $30,000 or greater under the COVID-19 Supplementals. The VPDP fiscal/grants leadership team will strive to ensure each of the identified subawards is entered on the FFATA Subaward Reporting System (FSRS) website by the end of the month following the month that DOH has made the subawards. VPDP will continue its efforts to bring the gap in reporting to FSRS down from five months presently to within the specified FFATA submission deadlines denoted above. VPDP also has on boarded a full-time Contract Administrator 2 who will be responsible for reporting FFATA data into FSRS for the Immunization Cooperative Agreement.

Reference Number: 2023-014 Prior Year Finding: 2022-015 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525-02-03 (8/1/2020 - 7/31/2024), 5NU50CK000525-03-00 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS in accordance with FFATA requirements. Context: Twenty-seven subawards were selected for testing. The Department of Health (DOH) is the primary recipient of program funding and, therefore, has overall responsibility for activities funded by the program. In addition to issuing subawards as the prime recipient, DOH also entered into an agreement with the Department of Education (DOE) to issue subawards to public and non-public schools on their behalf. Of the twenty-seven subawards selected for testing, twenty-three were issued by DOH and four were issued by DOE. The following exceptions were noted: • Four of twenty-seven subawards selected for testing were not reported to FSRS. DOE issued the subawards but was unable to provide copies of the subaward agreements or evidence that the subawards had been reported to FSRS. Therefore, the dollar amount of subawards not reported is undetermined. • Ten of twenty-seven subawards selected for testing were not reported timely to FSRS. DOH reported the subawards to FSRS from 21 to 543 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: DOH did not implement procedures or controls to ensure that subawards it issued were reported to FSRS timely. The agreement between DOH and DOE did not clearly state DOE’s responsibilities to maintain copies of subaward agreements and report those subawards to FSRS. In its oversight role, DOH did not review documentation maintained by DOE to ensure compliance with FFATA requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that DOH develop procedures and internal controls to ensure that all required subawards are reported to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. We further recommend that DOH develop procedures and controls over its agreements with other departments to ensure that FFATA reporting requirements are met. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: Based on the Corrective Action Plan (CAP) developed for the prior year FY 2022 audit finding cited for FFATA reporting, the Department of Health (DOH) Grants Unit, with coordination from the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) fiscal staff, added a new function to the System for Administering Grants Electronically (SAGE) that pulls all subaward data for the ELC program using the program’s 93.323 federal Assistance Listing Number (ALN). Thus, the CAP implemented in September 2022 for the prior year FY 2022 audit finding includes SAGE now pulling the subaward data for the entire ELC program by the ALN number and enables the ELC fiscal staff to access all ELC subawards within the DOH. ELC fiscal staff also has a task reminder set to report at the end of each month, enter subaward information into the FFATA Subaward Reporting System (FSRS), and upload each report submitted to the SharePoint ELC Document Library at the end of each month. As per the original CAP created under the FY 2022 audit, FFATA information for ELC subawards were entered into FSRS beginning on September 1, 2022 and DOH actions and efforts have continued to ensure compliance going forward.

Reference Number: 2023-014 Prior Year Finding: 2022-015 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525-02-03 (8/1/2020 - 7/31/2024), 5NU50CK000525-03-00 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS in accordance with FFATA requirements. Context: Twenty-seven subawards were selected for testing. The Department of Health (DOH) is the primary recipient of program funding and, therefore, has overall responsibility for activities funded by the program. In addition to issuing subawards as the prime recipient, DOH also entered into an agreement with the Department of Education (DOE) to issue subawards to public and non-public schools on their behalf. Of the twenty-seven subawards selected for testing, twenty-three were issued by DOH and four were issued by DOE. The following exceptions were noted: • Four of twenty-seven subawards selected for testing were not reported to FSRS. DOE issued the subawards but was unable to provide copies of the subaward agreements or evidence that the subawards had been reported to FSRS. Therefore, the dollar amount of subawards not reported is undetermined. • Ten of twenty-seven subawards selected for testing were not reported timely to FSRS. DOH reported the subawards to FSRS from 21 to 543 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: DOH did not implement procedures or controls to ensure that subawards it issued were reported to FSRS timely. The agreement between DOH and DOE did not clearly state DOE’s responsibilities to maintain copies of subaward agreements and report those subawards to FSRS. In its oversight role, DOH did not review documentation maintained by DOE to ensure compliance with FFATA requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that DOH develop procedures and internal controls to ensure that all required subawards are reported to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. We further recommend that DOH develop procedures and controls over its agreements with other departments to ensure that FFATA reporting requirements are met. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: Based on the Corrective Action Plan (CAP) developed for the prior year FY 2022 audit finding cited for FFATA reporting, the Department of Health (DOH) Grants Unit, with coordination from the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) fiscal staff, added a new function to the System for Administering Grants Electronically (SAGE) that pulls all subaward data for the ELC program using the program’s 93.323 federal Assistance Listing Number (ALN). Thus, the CAP implemented in September 2022 for the prior year FY 2022 audit finding includes SAGE now pulling the subaward data for the entire ELC program by the ALN number and enables the ELC fiscal staff to access all ELC subawards within the DOH. ELC fiscal staff also has a task reminder set to report at the end of each month, enter subaward information into the FFATA Subaward Reporting System (FSRS), and upload each report submitted to the SharePoint ELC Document Library at the end of each month. As per the original CAP created under the FY 2022 audit, FFATA information for ELC subawards were entered into FSRS beginning on September 1, 2022 and DOH actions and efforts have continued to ensure compliance going forward.

Reference Number: 2023-015 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525-02-03 (8/1/2020 - 7/31/2024), 5NU50CK000525-03-00 (8/1/2019 – 7/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 2 CFR section 200.332 also states that pass-through entities must: (d) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1) The subrecipient's prior experience with the same or similar subawards; 2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; 4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. Section III – Federal Award Findings and Questioned Costs (Continued) (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. (f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation of subaward agreements and monitoring activities was not maintained and was not available for audit. Context: The Department of Health (DOH) is the primary recipient of program funding and, therefore, has overall responsibility for activities funded by the program. DOH entered into an agreement with the Department of Education (DOE) to issue subawards to public and non-public schools on their behalf. Six of twenty-six subrecipients selected for testing received subawards issued by DOE. DOE was unable to provide copies of subaward agreements or documentation that subrecipient monitoring activities had been performed. Therefore, auditors were unable to verify compliance with Federal requirements for these subawards. Questioned costs: Undetermined. Cause: The agreement between DOH and DOE did not clearly state DOE’s responsibilities for subaward issuance and monitoring. As a result, DOE did not maintain copies of subaward agreements, nor was it able to provide documentation that it had performed risk assessments or monitoring activities for these subrecipients. In its oversight role, DOH did not review documentation maintained by DOE to ensure compliance with Federal subrecipient monitoring requirements. Effect: Auditors were unable to verify that subawards were issued in accordance with Federal requirements, that the subrecipients were eligible to receive program funding, nor that the subrecipients had been adequately monitored. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: DOH should review and enhance internal controls and procedures regarding agreements with other State departments to issue subawards on its behalf. Agreements should clearly define the responsibilities of other departments to ensure compliance with all Federal requirements. DOH should also periodically review the documentation maintained by other departments that issue subawards on its behalf to ensure it is adequate and is available for audit. DOE should review and enhance internal controls and procedures to ensure that it maintains copies of all subaward agreements, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed for all subrecipients. Documentation of subrecipient monitoring activities should be readily available for audit. Views of responsible officials: The Department of Health (DOH) will enhance its internal controls and procedures, regarding federal subawards issued by other New Jersey State departments and agencies on behalf of DOH. The Department’s Memorandum of Agreement (MOA) and Memorandum of Understanding (MOU) documents will be updated and enhanced to list and define the specific responsibilities and requirements of other departments and pass-through entities more clearly when issuing subawards with federal funding derived from DOH. If necessary, the updated MOA/MOU documents may also include an Exhibit specific to Subrecipient Monitoring, containing the federal Uniform Guidance compliance requirements including mandatory reporting of subgrantee performance indicators and listing records retention requirements for all documentation of monitored subrecipient activities.

Reference Number: 2023-015 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525 (8/1/2019 – 7/31/2024), 6NU50CK000525-02-03 (8/1/2020 - 7/31/2024), 5NU50CK000525-03-00 (8/1/2019 – 7/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 2 CFR section 200.332 also states that pass-through entities must: (d) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1) The subrecipient's prior experience with the same or similar subawards; 2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; 4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. Section III – Federal Award Findings and Questioned Costs (Continued) (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. (f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation of subaward agreements and monitoring activities was not maintained and was not available for audit. Context: The Department of Health (DOH) is the primary recipient of program funding and, therefore, has overall responsibility for activities funded by the program. DOH entered into an agreement with the Department of Education (DOE) to issue subawards to public and non-public schools on their behalf. Six of twenty-six subrecipients selected for testing received subawards issued by DOE. DOE was unable to provide copies of subaward agreements or documentation that subrecipient monitoring activities had been performed. Therefore, auditors were unable to verify compliance with Federal requirements for these subawards. Questioned costs: Undetermined. Cause: The agreement between DOH and DOE did not clearly state DOE’s responsibilities for subaward issuance and monitoring. As a result, DOE did not maintain copies of subaward agreements, nor was it able to provide documentation that it had performed risk assessments or monitoring activities for these subrecipients. In its oversight role, DOH did not review documentation maintained by DOE to ensure compliance with Federal subrecipient monitoring requirements. Effect: Auditors were unable to verify that subawards were issued in accordance with Federal requirements, that the subrecipients were eligible to receive program funding, nor that the subrecipients had been adequately monitored. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: DOH should review and enhance internal controls and procedures regarding agreements with other State departments to issue subawards on its behalf. Agreements should clearly define the responsibilities of other departments to ensure compliance with all Federal requirements. DOH should also periodically review the documentation maintained by other departments that issue subawards on its behalf to ensure it is adequate and is available for audit. DOE should review and enhance internal controls and procedures to ensure that it maintains copies of all subaward agreements, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed for all subrecipients. Documentation of subrecipient monitoring activities should be readily available for audit. Views of responsible officials: The Department of Health (DOH) will enhance its internal controls and procedures, regarding federal subawards issued by other New Jersey State departments and agencies on behalf of DOH. The Department’s Memorandum of Agreement (MOA) and Memorandum of Understanding (MOU) documents will be updated and enhanced to list and define the specific responsibilities and requirements of other departments and pass-through entities more clearly when issuing subawards with federal funding derived from DOH. If necessary, the updated MOA/MOU documents may also include an Exhibit specific to Subrecipient Monitoring, containing the federal Uniform Guidance compliance requirements including mandatory reporting of subgrantee performance indicators and listing records retention requirements for all documentation of monitored subrecipient activities.

Reference Number: 2023-016 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 230INJTANF-00 (10/1/2022-9/30/2023) 230INJTANF-01 (10/1/2022-9/30/2023) 230INJTANF-02 (10/1/2022-9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS during FY 2023. Context: Zero of twenty-two subrecipients selected for testing were reported to FSRS during FY 2023. Total subawards tested were $12,764,925.00, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department was unaware of FFATA reporting requirements and did not report subaward information to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Department develop controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services’ Division of Family Development (DFD) agrees with the audit finding regarding the required submission of subawards to the FFATA Subaward Reporting System (FSRS). Due to the complexity and time required to compile and report FFATA subaward data, the DFD is in the process of creating a new full-time equivalent position (FTE) for this required federal reporting task. In accordance with the finding recommendation, the DFD will develop internal controls and procedures to ensure the timely reporting of all required subawards to FSRS. An initial review of the FSRS by DFD fiscal staff appeared to indicate that some federal grant award data that should be prepopulated by the awarding federal agency and available on the website was missing (e.g. Child Care M&M available; Discretionary not found). Staff will reach out to the necessary federal agencies to communicate Section III – Federal Award Findings and Questioned Costs (Continued) instances of missing federal award information in an effort to ensure that the DFD has the ability to input the required subaward information. DFD anticipates that the assessment and development of policy and procedures related to this task will take approximately three (3) months. Staff assignment, training, and submission of federal grant subaward information to the federal website will occur over the next state fiscal year.

Reference Number: 2023-017 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Community Affairs (Department) did not report subaward information timely or accurately to FSRS during FY 2023. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 1 of 8 subawards selected, the amount reported to FSRS did not match the subaward amount. The subaward was issued for $53,278 but the amount reported was $71,021,779. • For 1 of 8 subawards selected, the amount reported to FSRS did not match the subaward amount. The subaward was issued for $566,494 but the amount reported was $465,750. The Division did not report a subaward amendment of $100,744. • Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were reported from 68 to 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subawards were reported accurately and timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department evaluate its procedures and controls to ensure that subawards are reported accurately and timely to FSRS no later than the end of the month following the date of subaward issuance or amendment. Views of responsible officials: The Department of Community Affairs (DCA) has recently implemented timely reporting of required FFATA subaward data in the Federal Subaward Reporting System (FSRS). The FFATA reporting process is fully documented, and additional staff have been hired and trained on the process to further support the federal reporting functions. The FFATA reports identified by the auditors with inaccurate subaward amounts reported have also been corrected in FSRS.

Reference Number: 2023-017 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Community Affairs (Department) did not report subaward information timely or accurately to FSRS during FY 2023. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 1 of 8 subawards selected, the amount reported to FSRS did not match the subaward amount. The subaward was issued for $53,278 but the amount reported was $71,021,779. • For 1 of 8 subawards selected, the amount reported to FSRS did not match the subaward amount. The subaward was issued for $566,494 but the amount reported was $465,750. The Division did not report a subaward amendment of $100,744. • Zero of eight subawards selected for testing were reported to FSRS timely. The subawards were reported from 68 to 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subawards were reported accurately and timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department evaluate its procedures and controls to ensure that subawards are reported accurately and timely to FSRS no later than the end of the month following the date of subaward issuance or amendment. Views of responsible officials: The Department of Community Affairs (DCA) has recently implemented timely reporting of required FFATA subaward data in the Federal Subaward Reporting System (FSRS). The FFATA reporting process is fully documented, and additional staff have been hired and trained on the process to further support the federal reporting functions. The FFATA reports identified by the auditors with inaccurate subaward amounts reported have also been corrected in FSRS.

Reference Number: 2023-018 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: xv. Subrecipient name (which must match the name associated with its unique entity identifier); xvi. Subrecipient's unique entity identifier; xvii. Federal Award Identification Number (FAIN); xviii. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; xix. Subaward Period of Performance Start and End Date; xx. Subaward Budget Period Start and End Date; xxi. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; xxii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; xxiii. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; xxiv. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xxv. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xxvi. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xxvii. Identification of whether the award is R&D; and xxviii. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Community Affairs (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (v) Federal Award Identification Number (FAIN); (vi) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (x) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (xi) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: The Department of Community Affairs (DCA) has reviewed and enhanced internal controls and procedures to ensure that all required information, as per the federal Uniform Guidance pass-through entity requirements, is included in all new LIHEAP subaward contracts. These subaward agreement control enhancements have been implemented effective with the fiscal year 2024 contracts.

Reference Number: 2023-018 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: xv. Subrecipient name (which must match the name associated with its unique entity identifier); xvi. Subrecipient's unique entity identifier; xvii. Federal Award Identification Number (FAIN); xviii. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; xix. Subaward Period of Performance Start and End Date; xx. Subaward Budget Period Start and End Date; xxi. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; xxii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; xxiii. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; xxiv. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xxv. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xxvi. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xxvii. Identification of whether the award is R&D; and xxviii. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Department of Community Affairs (Department) did not include all required federal award information. Context: For 8 of 8 subawards selected for testing, the following required information was not provided to the subrecipient at the time of award issuance: (v) Federal Award Identification Number (FAIN); (vi) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (x) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (xi) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414 Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure the subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subawards. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: The Department of Community Affairs (DCA) has reviewed and enhanced internal controls and procedures to ensure that all required information, as per the federal Uniform Guidance pass-through entity requirements, is included in all new LIHEAP subaward contracts. These subaward agreement control enhancements have been implemented effective with the fiscal year 2024 contracts.

Reference Number: 2023-019 Prior Year Finding: 2022-019 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Performance and Special Reporting Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Quarterly Performance and Management Report (OMB No. 0970-0589) – Grant recipients must submit data and information about LIHEAP during the current FY, including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, and training and technical assistance needs. Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) – As part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. Territories with annual allotments of less than $200,000 and all Indian tribes are required to report only on the number of households served for each program component. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Community Affairs (Department) did not submit performance and special reports timely. The LIHEAP Performance Management Report and Annual Report on Households Assisted by LIHEAP were submitted after their respective due dates. Section III – Federal Award Findings and Questioned Costs (Continued) Context: The following special reporting exceptions were noted: • One of two Quarterly Performance and Management Reports was not submitted timely. The report was due by 7/31/2023, but was not submitted until 8/10/2023, or 10 days late. • One of one Annual Report on Households Assisted by LIHEAP was not submitted timely. The report was due by 12/15/2023 but was not submitted until 12/19/2023, or 4 days late. Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure that the Annual Report on Households Assisted by LIHEAP and the Quarterly Performance and Management Report were submitted timely. Internal controls did not prevent or detect the errors. Effect: Delays in submission of annual performance and special reports could impact the Federal agency’s ability to manage the program, could result in delays in annual awards, and possible penalties or sanctions could be imposed by the grantor. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that performance and special reports are submitted timely. Views of responsible officials: The Department of Community Affairs (DCA) Low-Income Home Energy Assistance Program (LIHEAP) staff have been fully trained to coordinate with the Applied Public Policy Research Institute for Study and Evaluation (APPRISE) and the federal U.S. Department of Health and Human Services (HHS) to ensure that all required reports are submitted timely. DCA has created a schedule of required reports that includes corresponding submission due dates and the process is designed to ensure adequate time is available to accommodate the necessary back and forth communications between DCA and APPRISE required to complete all reporting timely.

Reference Number: 2023-019 Prior Year Finding: 2022-019 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Community Affairs Federal Program: Low-Income Home Energy Assistance, COVID-19 - Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2102NJE5C6 (3/11/21 – 9/30/22), 2202NJLIEA (10/1/21 – 9/30/22), 2001NJLIEA (10/1/19 – 9/30/22), 2302NJLIEA (10/1/2022 – 9/30/2024), 2302NJLIEI (10/1/2022 – 9/30/2024), 2202NJLIEA (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Performance and Special Reporting Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Quarterly Performance and Management Report (OMB No. 0970-0589) – Grant recipients must submit data and information about LIHEAP during the current FY, including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, and training and technical assistance needs. Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) – As part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. Territories with annual allotments of less than $200,000 and all Indian tribes are required to report only on the number of households served for each program component. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Community Affairs (Department) did not submit performance and special reports timely. The LIHEAP Performance Management Report and Annual Report on Households Assisted by LIHEAP were submitted after their respective due dates. Section III – Federal Award Findings and Questioned Costs (Continued) Context: The following special reporting exceptions were noted: • One of two Quarterly Performance and Management Reports was not submitted timely. The report was due by 7/31/2023, but was not submitted until 8/10/2023, or 10 days late. • One of one Annual Report on Households Assisted by LIHEAP was not submitted timely. The report was due by 12/15/2023 but was not submitted until 12/19/2023, or 4 days late. Questioned costs: None noted. Cause: The Department’s procedures were not sufficient to ensure that the Annual Report on Households Assisted by LIHEAP and the Quarterly Performance and Management Report were submitted timely. Internal controls did not prevent or detect the errors. Effect: Delays in submission of annual performance and special reports could impact the Federal agency’s ability to manage the program, could result in delays in annual awards, and possible penalties or sanctions could be imposed by the grantor. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that performance and special reports are submitted timely. Views of responsible officials: The Department of Community Affairs (DCA) Low-Income Home Energy Assistance Program (LIHEAP) staff have been fully trained to coordinate with the Applied Public Policy Research Institute for Study and Evaluation (APPRISE) and the federal U.S. Department of Health and Human Services (HHS) to ensure that all required reports are submitted timely. DCA has created a schedule of required reports that includes corresponding submission due dates and the process is designed to ensure adequate time is available to accommodate the necessary back and forth communications between DCA and APPRISE required to complete all reporting timely.

Reference Number: 2023-020 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS during FY 2023. Total subawards tested were $32,469,131, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department was unaware of FFATA reporting requirements and did not report subaward information to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Department develop controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services’ Division of Family Development (DFD) agrees with the audit finding regarding the required submission of subawards to the FFATA Subaward Reporting System (FSRS). Due to the complexity and time required to compile and report FFATA subaward data, the Section III – Federal Award Findings and Questioned Costs (Continued) DFD is in the process of creating a new full-time equivalent position (FTE) for this required federal reporting task. In accordance with the finding recommendation, the DFD will develop internal controls and procedures to ensure the timely reporting of all required subawards to FSRS. An initial review of the FSRS by DFD fiscal staff appeared to indicate that some federal grant award data that should be prepopulated by the awarding federal agency and available on the website was missing (e.g. Child Care M&M available; Discretionary not found). Staff will reach out to the necessary federal agencies to communicate instances of missing federal award information in an effort to ensure that the DFD has the ability to input the required subaward information. DFD anticipates that the assessment and development of policy and procedures related to this task will take approximately three (3) months. Staff assignment, training, and submission of federal grant subaward information to the federal website will occur over the next state fiscal year.

Reference Number: 2023-020 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS during FY 2023. Total subawards tested were $32,469,131, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department was unaware of FFATA reporting requirements and did not report subaward information to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Department develop controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services’ Division of Family Development (DFD) agrees with the audit finding regarding the required submission of subawards to the FFATA Subaward Reporting System (FSRS). Due to the complexity and time required to compile and report FFATA subaward data, the Section III – Federal Award Findings and Questioned Costs (Continued) DFD is in the process of creating a new full-time equivalent position (FTE) for this required federal reporting task. In accordance with the finding recommendation, the DFD will develop internal controls and procedures to ensure the timely reporting of all required subawards to FSRS. An initial review of the FSRS by DFD fiscal staff appeared to indicate that some federal grant award data that should be prepopulated by the awarding federal agency and available on the website was missing (e.g. Child Care M&M available; Discretionary not found). Staff will reach out to the necessary federal agencies to communicate instances of missing federal award information in an effort to ensure that the DFD has the ability to input the required subaward information. DFD anticipates that the assessment and development of policy and procedures related to this task will take approximately three (3) months. Staff assignment, training, and submission of federal grant subaward information to the federal website will occur over the next state fiscal year.

Reference Number: 2023-020 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Federal Award Findings and Questioned Costs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not report subaward information to FSRS during FY 2023. Context: Zero of eight subawards selected for testing were reported to FSRS during FY 2023. Total subawards tested were $32,469,131, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department was unaware of FFATA reporting requirements and did not report subaward information to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Department develop controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services’ Division of Family Development (DFD) agrees with the audit finding regarding the required submission of subawards to the FFATA Subaward Reporting System (FSRS). Due to the complexity and time required to compile and report FFATA subaward data, the Section III – Federal Award Findings and Questioned Costs (Continued) DFD is in the process of creating a new full-time equivalent position (FTE) for this required federal reporting task. In accordance with the finding recommendation, the DFD will develop internal controls and procedures to ensure the timely reporting of all required subawards to FSRS. An initial review of the FSRS by DFD fiscal staff appeared to indicate that some federal grant award data that should be prepopulated by the awarding federal agency and available on the website was missing (e.g. Child Care M&M available; Discretionary not found). Staff will reach out to the necessary federal agencies to communicate instances of missing federal award information in an effort to ensure that the DFD has the ability to input the required subaward information. DFD anticipates that the assessment and development of policy and procedures related to this task will take approximately three (3) months. Staff assignment, training, and submission of federal grant subaward information to the federal website will occur over the next state fiscal year.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 2 CFR section 200.332(d) states that pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (4) Reviewing financial and performance reports required by the pass-through entity. (5) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (6) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not comply with subrecipient monitoring requirements for the program. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 2 of 8 subawards selected for testing, the subaward did not include all required Federal Award information. The subawards were missing the Federal Award Date of award to the recipient by the Federal agency. • For 1 of 8 subawards selected for testing, the Department did not conduct an annual desk review for the award as required by the Department’s procedures. Questioned costs: None noted. Cause: The Department’s procedures were not effective to ensure that subawards were issued in compliance with Federal requirements, nor that subrecipient monitoring was performed timely in accordance with Departmental procedures. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements and that proper subrecipient monitoring is performed. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 2 CFR section 200.332(d) states that pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (4) Reviewing financial and performance reports required by the pass-through entity. (5) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (6) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not comply with subrecipient monitoring requirements for the program. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 2 of 8 subawards selected for testing, the subaward did not include all required Federal Award information. The subawards were missing the Federal Award Date of award to the recipient by the Federal agency. • For 1 of 8 subawards selected for testing, the Department did not conduct an annual desk review for the award as required by the Department’s procedures. Questioned costs: None noted. Cause: The Department’s procedures were not effective to ensure that subawards were issued in compliance with Federal requirements, nor that subrecipient monitoring was performed timely in accordance with Departmental procedures. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements and that proper subrecipient monitoring is performed. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster, COVID-19 – CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301NJCCDD (10/1/2022 – 9/30/2025) 2301NJCCDF (10/1/2022 – 9/30/2025) 2201NJCCDF (10/1/2021 – 9/30/2024) 2201NJCCDD (10/1/2021 – 9/30/2024) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2020 – 9/30/2023) 2101NJCCDF (10/1/2019 – 9/30/2022) 2001NJCCDF (10/1/2019 – 9/30/2022) 2101NJCSC6 (10/1/2020 – 9/30/2023) 2101NJCDC6 (10/1/2020 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 2 CFR section 200.332(d) states that pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (4) Reviewing financial and performance reports required by the pass-through entity. (5) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (6) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Section III – Federal Award Findings and Questioned Costs (Continued) Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not comply with subrecipient monitoring requirements for the program. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 2 of 8 subawards selected for testing, the subaward did not include all required Federal Award information. The subawards were missing the Federal Award Date of award to the recipient by the Federal agency. • For 1 of 8 subawards selected for testing, the Department did not conduct an annual desk review for the award as required by the Department’s procedures. Questioned costs: None noted. Cause: The Department’s procedures were not effective to ensure that subawards were issued in compliance with Federal requirements, nor that subrecipient monitoring was performed timely in accordance with Departmental procedures. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements and that proper subrecipient monitoring is performed. Section III – Federal Award Findings and Questioned Costs (Continued) Views of responsible officials: In accordance with the audit finding recommendation, the Department of Human Services’ Division of Family Development (DFD) will ensure that the applicable federal award date will be included with the contract award information as required by Uniform Guidance pass-through entity requirements. Subrecipient monitoring was performed in a timely manner in compliance with DHS Contract Policy with the exception of one subrecipient, NJSACC. NJSACC’s fiscal review documents are due back to DFD on April 15, 2024. Once received, DFD will schedule a fiscal review meeting with the agency and the entire process should be completed within one (1) month of receipt. In addition, DFD will review the current policy for clarity, reasonableness, and to ensure compliance.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-022 Prior Year Finding: 2022-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster, Children’s Health Insurance Program, COVID-19 - Children’s Health Insurance Program Assistance Listing Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) 2305NJ3002 (10/1/2022 – 9/30/2024) 2305NJ5021 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions: Managed Care Financial Audit Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) received audit reports from its MCOs, but these reports were Agreed Upon Procedures (AUP) reports which were not conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section III – Federal Award Findings and Questioned Costs (Continued) Context: Five of five MCO audit reports received by the Department were AUP reports. An AUP engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. In an engagement performed under this section, the practitioner does not perform an examination or a review and does not provide an opinion or negative assurance. Therefore, AUP reports do not fulfill the requirement that the audit is conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Questioned costs: Undetermined. Cause: The Department held the opinion that AUP reports were sufficient to meet the requirement of obtaining a financial statement audit report per the flexibility given to States in Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10, dated November 10, 2016. Effect: The Department is unable to ensure that its MCOs were audited in accordance with generally accepted accounting principles and generally accepted auditing standards. Failure to obtain qualified audit reports from its MCOs would result in the Division of Medical Assistance and Human Services (DMAHS) being unaware of deficiencies, corrective action plans or unmet requirements which would be identified as a result of qualified audits. Recommendation: We recommend that DMAHS update its contracts with its MCOs to remove the language specifying the requirement for an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and instead to specify that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10. Views of responsible officials: There is no change to the prior year corrective action plan provided by the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) as corrective actions have been fully implemented as of January 2023. Current Managed Care Organization (MCO) contracts no longer contain the language requiring an audit conducted specifically in accordance with generally accepted accounting principles and generally accepted auditing standards and now specify that AUP reports are acceptable. Section 7.25.1(B) of the MCO Contract was updated effective January 2023 and removed the language requiring audits in accordance with generally accepted accounting principles and generally accepted auditing standards, and specifies that an AUP report is acceptable per guidance provided under Medicaid and CHIP Managed Care Final Rule (CMS-2390-F) Frequently Asked Question number Q10.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – CMS-64 Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: CMS-64, Quarterly Statement of Expenditures for the Medical Assistance Program (OMB No. 0938-1265) – Required to be used in lieu of the SF-425, Federal Financial Report (for all components of the cluster other administrative costs of the state MFCUs), prepared quarterly, and submitted electronically to CMS within 30 days after the end of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not file the CMS-64 report timely. Context: One of two CMS-64 reports selected for testing was not filed timely. The report for the 12/31/2022 quarter was due 1/30/2023 but was submitted 2/9/2023, or 10 days late. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that CMS-64 reports were filed timely. Internal controls did not prevent or detect the error. Effect: Failure to submit CMS-64 reports timely could impact the Federal Agency’s ability to oversee the program. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: We recommend that the Department enhance its procedures and controls to ensure that CMS-64 reports are filed timely, no later than 30 days after the end of each quarter. Views of responsible officials: With regard to the late quarterly CMS 64 report submission noted in the audit finding, the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) notified the Center for Medicaid Services (CMS) in advance that the report for the December 31, 2022 quarter would be filed after the due date. DMHAS is working to streamline reporting of the CMS-64 by improving automation where possible in order to adhere to the due date. However, as in the case of the report for quarter ending December 31, 2022, the DMAHS places strong emphasis on the accuracy and integrity of its quarterly CMS-64 reporting, which may at times lead to submission after the required due date. In the event this occurs, the DMAHS will continue to notify CMS in advance when reports will be submitted after the due date.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – CMS-64 Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: CMS-64, Quarterly Statement of Expenditures for the Medical Assistance Program (OMB No. 0938-1265) – Required to be used in lieu of the SF-425, Federal Financial Report (for all components of the cluster other administrative costs of the state MFCUs), prepared quarterly, and submitted electronically to CMS within 30 days after the end of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not file the CMS-64 report timely. Context: One of two CMS-64 reports selected for testing was not filed timely. The report for the 12/31/2022 quarter was due 1/30/2023 but was submitted 2/9/2023, or 10 days late. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that CMS-64 reports were filed timely. Internal controls did not prevent or detect the error. Effect: Failure to submit CMS-64 reports timely could impact the Federal Agency’s ability to oversee the program. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: We recommend that the Department enhance its procedures and controls to ensure that CMS-64 reports are filed timely, no later than 30 days after the end of each quarter. Views of responsible officials: With regard to the late quarterly CMS 64 report submission noted in the audit finding, the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) notified the Center for Medicaid Services (CMS) in advance that the report for the December 31, 2022 quarter would be filed after the due date. DMHAS is working to streamline reporting of the CMS-64 by improving automation where possible in order to adhere to the due date. However, as in the case of the report for quarter ending December 31, 2022, the DMAHS places strong emphasis on the accuracy and integrity of its quarterly CMS-64 reporting, which may at times lead to submission after the required due date. In the event this occurs, the DMAHS will continue to notify CMS in advance when reports will be submitted after the due date.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – CMS-64 Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: CMS-64, Quarterly Statement of Expenditures for the Medical Assistance Program (OMB No. 0938-1265) – Required to be used in lieu of the SF-425, Federal Financial Report (for all components of the cluster other administrative costs of the state MFCUs), prepared quarterly, and submitted electronically to CMS within 30 days after the end of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not file the CMS-64 report timely. Context: One of two CMS-64 reports selected for testing was not filed timely. The report for the 12/31/2022 quarter was due 1/30/2023 but was submitted 2/9/2023, or 10 days late. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that CMS-64 reports were filed timely. Internal controls did not prevent or detect the error. Effect: Failure to submit CMS-64 reports timely could impact the Federal Agency’s ability to oversee the program. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: We recommend that the Department enhance its procedures and controls to ensure that CMS-64 reports are filed timely, no later than 30 days after the end of each quarter. Views of responsible officials: With regard to the late quarterly CMS 64 report submission noted in the audit finding, the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) notified the Center for Medicaid Services (CMS) in advance that the report for the December 31, 2022 quarter would be filed after the due date. DMHAS is working to streamline reporting of the CMS-64 by improving automation where possible in order to adhere to the due date. However, as in the case of the report for quarter ending December 31, 2022, the DMAHS places strong emphasis on the accuracy and integrity of its quarterly CMS-64 reporting, which may at times lead to submission after the required due date. In the event this occurs, the DMAHS will continue to notify CMS in advance when reports will be submitted after the due date.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Medicaid Cluster, COVID-19 - Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305NJ5MAP (10/1/2022 – 9/30/2023) 2305NJ5ADM (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – CMS-64 Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: CMS-64, Quarterly Statement of Expenditures for the Medical Assistance Program (OMB No. 0938-1265) – Required to be used in lieu of the SF-425, Federal Financial Report (for all components of the cluster other administrative costs of the state MFCUs), prepared quarterly, and submitted electronically to CMS within 30 days after the end of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not file the CMS-64 report timely. Context: One of two CMS-64 reports selected for testing was not filed timely. The report for the 12/31/2022 quarter was due 1/30/2023 but was submitted 2/9/2023, or 10 days late. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that CMS-64 reports were filed timely. Internal controls did not prevent or detect the error. Effect: Failure to submit CMS-64 reports timely could impact the Federal Agency’s ability to oversee the program. Section III – Federal Award Findings and Questioned Costs (Continued) Recommendation: We recommend that the Department enhance its procedures and controls to ensure that CMS-64 reports are filed timely, no later than 30 days after the end of each quarter. Views of responsible officials: With regard to the late quarterly CMS 64 report submission noted in the audit finding, the Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) notified the Center for Medicaid Services (CMS) in advance that the report for the December 31, 2022 quarter would be filed after the due date. DMHAS is working to streamline reporting of the CMS-64 by improving automation where possible in order to adhere to the due date. However, as in the case of the report for quarter ending December 31, 2022, the DMAHS places strong emphasis on the accuracy and integrity of its quarterly CMS-64 reporting, which may at times lead to submission after the required due date. In the event this occurs, the DMAHS will continue to notify CMS in advance when reports will be submitted after the due date.

Reference Number: 2023-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Opioid STR Assistance Listing Number: 93.788 Award Number and Year: H79T1083317 (9/3/2020 – 9/29/2023), H79T1085743 (9/30/2022 – 9/29/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Health (Department) did not report subaward information to FSRS during FY 2023. Context: Zero of ten subawards selected for testing were reported to FSRS during FY 2023. Total subawards tested were $6,500,401, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not develop procedures and controls to ensure subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Department develop controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 there were no Federal Funding Accountability & Transparency Act (FFATA) reporting procedures in place. It is important to note however, that DMHAS provided adequate support for subrecipient payments to each of the selected samples and corresponding dollar amounts. DMHAS was unable to comply with the FFATA reporting requirements due to insufficient staffing levels, the significant volume of data and effort required, and the significant demands and operational challenges precipitated by the Covid-19 Public Health Emergency. DMHAS will develop a formal policy with procedures to comply with FFATA reporting requirements. More specifically, the policy will identify all FFATA reporting requirements consistent with the law, and dictate standard operating procedures, including ongoing monitoring and progress reporting. DMHAS’s policy and practices will rely upon, and comport with, the applicable materials and Awardee User resources available at: https://www.fsrs.gov/ and https://www.fsrs.gov/documents/FSRS_Awardee_User_Guide.pdf. Section III – Federal Award Findings and Questioned Costs (Continued) DMHAS procedures will ensure the reporting of all first-tier subawards of $30,000 or more to the FSRS with all required FFATA data elements included. DMHAS will hire at least one (1) additional staff for the requisite data entry. The new staff member will be situated in the DMHAS Fiscal Unit, and will report directly to, and be under the supervision of the Fiscal Unit Budget Manager. One hundred percent of the new hire’s effort will be dedicated to FFATA reporting and data entry. DMHAS began the new hire process on or about March 22, 2024, and anticipates that the new hire will be on boarded in approximately ninety (90) days. In addition, the DMHAS Fiscal Unit Contract Manager (or the Contract Manager’s designated staff) will work with the Budget Manager and the FFATA new hire to assist with the collection and verification of the requisite Subrecipient data that must be entered into the FSRS portal. DMHAS will require all staff with FFATA reporting duties to complete the available online trainings. Furthermore, designated staff will be required to complete a FFATA Access Request Form that will be reviewed and approved by the DMHAS Chief Financial Officer. Designated staff shall also be subject to fixed Eligibility Criteria (e.g. completion of all IT Security Trainings, FFATA training(s), current DHS Confidentiality and Non-Disclosure Agreement, etc.). Access will be revoked if a Disqualifying Event such as separation of employment or failure to complete training occurs. DMHAS conferred recently with DHS, the designated grant recipient, and secured from DHS the requisite FSRS login credentials. DMHAS Fiscal logged into the reporting system and began work on a process description. DMHAS is committed to FFATA compliance, is prioritizing FFATA policy, procedures and reporting, and is making a good faith effort to comply. DMHAS will ensure that the requisite sub-award data is entered timely (no later than the end of the month following the month of issuance) into the FSRS portal, beginning January 1, 2025. In the event DMHAS cannot complete timely data entry into FSRS because of system issues outside of its control (e.g. the underlying federal award does not appear in FSRS), DMHAS will keep a record of the requisite data and document its efforts.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Opioid STR Assistance Listing Number: 93.788 Award Number and Year: H79T1083317 (9/3/2020 – 9/29/2023), H79T1085743 (9/30/2022 – 9/29/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not include all required information in subaward agreements. Context: Ten subawards were selected for testing and the following exceptions were noted: • For 10 of 10 subawards selected for testing, the Federal Award Date of award to the recipient by the Federal agency was omitted from the subaward agreement. • For 2 of 10 subawards selected for testing, the subrecipient’s unique entity identifier was not obtained and was omitted from the subaward agreement. Questioned costs: None noted. Cause: The Department’s procedures were not effective to ensure that subawards were issued in compliance with Federal requirements. Internal controls did not prevent or detect the errors. Section III – Federal Award Findings and Questioned Costs (Continued) Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements. Views of responsible officials: The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 it did not provide at the time of subaward one (1) of the fourteen (14) elements required by the federal Uniform Guidance (UG) pass-through entity requirements. More specifically, DMHAS did not communicate to subrecipients at the time of subaward the date on which DMHAS received its Notice of Award from the U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Substance Abuse Treatment (SMAHSA). This single piece of information was omitted in each of the ten (10) samples tested. It is important to note, however, that DMHAS could certify that it did not communicate to any pool of applicants or subrecipients that funding was available until such time as DMHAS received its federal award. The failure to include the federal date of award was the result of clerical/ministerial error, and DMHAS’s inability to evidence the federal award date in its software system, known as the Contract Information Management System (CIMS). CIMS is accessible to subrecipients and DMHAS relies on it to document and track subawards. DMHAS satisfied every remaining subaward information element of the UG pass-through entity requirements with the exception of subsection (ii) – the subrecipient’s Unique Entity Identifier (UEI), for two (2) of the ten (10) samples tested. More specifically, DMHAS did not reference two (2) subrecipients UEI numbers at the time of each subrecipient’s subaward. It is important to note that DMHAS has the UEIs available to it, but it could not establish that it referenced two (2) of the UEIs at the time of award. The failure to include the UEI for each of the two (2) subrecipients was the result of clerical/ministerial error, and DMHAS’s inability to enter the data for the particular subrecipients into CIMS. Each of the two (2) samples related to a “specialty contract” that cannot be captured in CIMS. DMHAS has already undertaken efforts to update its software system and replace CIMS with SAGE AGATE. Although federal regulation does not require that every data element referenced in 2 CFR 200.332(a)(1) be available in a single document, as part of its ongoing systems improvement plans, the DMHAS is completing the procurement of a new contract information management system, SAGE AGATE, so that all federal award and contract information is available in a single report through a single software application. DMHAS has prepared a purchase order for SAGE AGATE, the State funds have been appropriated and the DMHAS is in the process of scheduling a kick off meeting, along with Section III – Federal Award Findings and Questioned Costs (Continued) 3-day training sessions. The DMHAS SAGE AGATE Scope of Work includes IntelliGrants software, as well as limited customization of the IntelliGrants software to satisfy any needs particular to DMHAS. DMHAS will ensure that the final software package provides DMHAS with the means to document and communicate to subrecipients at the time of subaward each of the requisite elements of 2 CFR 200.332(a)(1), including the Federal Date of Award and the UEI. In the interim, DMHAS has drafted an updated Notice of Subrecipient Award Template, which Template includes every component required by 2 CFR 200.332(a)(1). Upon DMHAS executive review and approval of the Template, Contract staff in the DMHAS Fiscal Unit will utilize the Template for each Notice of Subrecipient Award. DMHAS anticipates that the Template will be superseded by a Notice maintained within, and/or generated by, SAGE AGATE. Prior to the date of this CAP, DMHAS Program/Initiative Managers throughout the various DMHAS treatment service and support units were responsible for preparing and executing Notices of Subrecipient Award. As a result of the Significant Deficiency identified in this 2023 Audit, and in order to correct and mitigate against clerical/ministerial errors, DMHAS is transferring responsibility for the preparation and execution of Notices of Subrecipient Award from Program/Initiative Managers, to the DMHAS Fiscal Unit, Contract Manager (and the Contract Manager’s Contract Administration staff). Such staff will have total SAGE AGATE system access, and be best suited to ensure that Notices of Subrecipient Award comply with 2 CFR 200.332. Finally, as a preventive action, the DMHAS Compliance Unit will audit the issuance of post-contract negotiation Notices of Award in three (3) months, and again in six (6) months. The internal audit will sample no less than ten (10) newly awarded/renewed deficit-funded contracts for substance use disorder services, and will measure compliance with every element identified in 2 CFR 200.332.

Reference Number: 2023-026 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 – Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: B08TI083538 (3/15/2021 – 3/14/2023), B08TI084660 (10/1/2020 – 9/30/2023), B08TI083465 (10/1/2020 – 9/30/2022), B08TI085822 (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS by the Department of Human Services (Department). Context: Eight of eight subawards selected for testing were not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not establish effective procedures and internal controls over FFATA requirements to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: Undetermined. Recommendation: We recommend that the Department develop procedures and internal controls to ensure that all required subawards are reported to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 there were no Federal Funding Accountability & Transparency Act (FFATA) reporting procedures in place. It is important to note however, that DMHAS provided adequate support for subrecipient payments to each of the selected samples and corresponding dollar amounts. DMHAS was unable to comply with the FFATA reporting requirements due to insufficient staffing levels, the significant volume of data and effort required, and the significant demands and operational challenges precipitated by the Covid-19 Public Health Emergency. DMHAS will develop a formal policy with procedures to comply with FFATA reporting requirements. More specifically, the policy will identify all FFATA reporting requirements consistent with the law, and dictate standard operating procedures, including ongoing monitoring and progress reporting. DMHAS’s policy and practices will rely upon, and comport with, the applicable materials and Awardee User resources available at: https://www.fsrs.gov/ and https://www.fsrs.gov/documents/FSRS_Awardee_User_Guide.pdf. Section III – Federal Award Findings and Questioned Costs (Continued) DMHAS procedures will ensure the reporting of all first-tier subawards of $30,000 or more to the FSRS with all required FFATA data elements included. DMHAS will hire at least one (1) additional staff for the requisite data entry. The new staff member will be situated in the DMHAS Fiscal Unit, and will report directly to, and be under the supervision of the Fiscal Unit Budget Manager. One hundred percent of the new hire’s effort will be dedicated to FFATA reporting and data entry. DMHAS began the new hire process on or about March 22, 2024, and anticipates that the new hire will be on boarded in approximately ninety (90) days. In addition, the DMHAS Fiscal Unit Contract Manager (or the Contract Manager’s designated staff) will work with the Budget Manager and the FFATA new hire to assist with the collection and verification of the requisite Subrecipient data that must be entered into the FSRS portal. DMHAS will require all staff with FFATA reporting duties to complete the available online trainings. Furthermore, designated staff will be required to complete a FFATA Access Request Form that will be reviewed and approved by the DMHAS Chief Financial Officer. Designated staff shall also be subject to fixed Eligibility Criteria (e.g. completion of all IT Security Trainings, FFATA training(s), current DHS Confidentiality and Non-Disclosure Agreement, etc.). Access will be revoked if a Disqualifying Event such as separation of employment or failure to complete training occurs. DMHAS conferred recently with DHS, the designated grant recipient, and secured from DHS the requisite FSRS login credentials. DMHAS Fiscal logged into the reporting system and began work on a process description. DMHAS is committed to FFATA compliance, is prioritizing FFATA policy, procedures and reporting, and is making a good faith effort to comply. DMHAS will ensure that the requisite sub-award data is entered timely (no later than the end of the month following the month of issuance) into the FSRS portal, beginning January 1, 2025. In the event DMHAS cannot complete timely data entry into FSRS because of system issues outside of its control (e.g. the underlying federal award does not appear in FSRS), DMHAS will keep a record of the requisite data and document its efforts.

Reference Number: 2023-026 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 – Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: B08TI083538 (3/15/2021 – 3/14/2023), B08TI084660 (10/1/2020 – 9/30/2023), B08TI083465 (10/1/2020 – 9/30/2022), B08TI085822 (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: Subaward information was not reported to FSRS by the Department of Human Services (Department). Context: Eight of eight subawards selected for testing were not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not establish effective procedures and internal controls over FFATA requirements to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: Undetermined. Recommendation: We recommend that the Department develop procedures and internal controls to ensure that all required subawards are reported to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: The Department of Human Services, Division of Mental Health and Addiction Services (DMHAS) agrees that for fiscal year 2023 there were no Federal Funding Accountability & Transparency Act (FFATA) reporting procedures in place. It is important to note however, that DMHAS provided adequate support for subrecipient payments to each of the selected samples and corresponding dollar amounts. DMHAS was unable to comply with the FFATA reporting requirements due to insufficient staffing levels, the significant volume of data and effort required, and the significant demands and operational challenges precipitated by the Covid-19 Public Health Emergency. DMHAS will develop a formal policy with procedures to comply with FFATA reporting requirements. More specifically, the policy will identify all FFATA reporting requirements consistent with the law, and dictate standard operating procedures, including ongoing monitoring and progress reporting. DMHAS’s policy and practices will rely upon, and comport with, the applicable materials and Awardee User resources available at: https://www.fsrs.gov/ and https://www.fsrs.gov/documents/FSRS_Awardee_User_Guide.pdf. Section III – Federal Award Findings and Questioned Costs (Continued) DMHAS procedures will ensure the reporting of all first-tier subawards of $30,000 or more to the FSRS with all required FFATA data elements included. DMHAS will hire at least one (1) additional staff for the requisite data entry. The new staff member will be situated in the DMHAS Fiscal Unit, and will report directly to, and be under the supervision of the Fiscal Unit Budget Manager. One hundred percent of the new hire’s effort will be dedicated to FFATA reporting and data entry. DMHAS began the new hire process on or about March 22, 2024, and anticipates that the new hire will be on boarded in approximately ninety (90) days. In addition, the DMHAS Fiscal Unit Contract Manager (or the Contract Manager’s designated staff) will work with the Budget Manager and the FFATA new hire to assist with the collection and verification of the requisite Subrecipient data that must be entered into the FSRS portal. DMHAS will require all staff with FFATA reporting duties to complete the available online trainings. Furthermore, designated staff will be required to complete a FFATA Access Request Form that will be reviewed and approved by the DMHAS Chief Financial Officer. Designated staff shall also be subject to fixed Eligibility Criteria (e.g. completion of all IT Security Trainings, FFATA training(s), current DHS Confidentiality and Non-Disclosure Agreement, etc.). Access will be revoked if a Disqualifying Event such as separation of employment or failure to complete training occurs. DMHAS conferred recently with DHS, the designated grant recipient, and secured from DHS the requisite FSRS login credentials. DMHAS Fiscal logged into the reporting system and began work on a process description. DMHAS is committed to FFATA compliance, is prioritizing FFATA policy, procedures and reporting, and is making a good faith effort to comply. DMHAS will ensure that the requisite sub-award data is entered timely (no later than the end of the month following the month of issuance) into the FSRS portal, beginning January 1, 2025. In the event DMHAS cannot complete timely data entry into FSRS because of system issues outside of its control (e.g. the underlying federal award does not appear in FSRS), DMHAS will keep a record of the requisite data and document its efforts.

Reference Number: 2023-027 Prior Year Finding: No Federal Agency: Social Security Administration State Agency: Department of Labor and Workforce Development Federal Program: Disability Insurance/SSI Cluster Assistance Listing Number: 96.001 Award Number and Year: 04-2304NJD100 (10/1/2022 – 9/30/2023), 04-2204NJD100 (10/1/2021 – 9/30/2022) Compliance Requirement: Special Tests and Provisions – Qualified Providers Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – Each state agency is responsible for comprehensive oversight management of its process and for ensuring accuracy, integrity, and economy of its process (20 CFR sections 404.1519g and 416.919g, and POMS DI 39569.300). As part of these duties, Disability Determination Services (DDS) must have, and follow, procedures for performing medical license verifications to ensure that only qualified providers perform DDSs task. By “qualified,” Social Security Administration (SSA) means that the medical source must: Be currently licensed in the state and have the training and experience to perform the type of examination or test the DDS requests; and a. Not be barred from participation in Medicare or Medicaid programs or other federal or federally assisted programs (20 CFR sections 404.1519g and 416.919g). Prior to using the services of any medical provider, the DDS must check the System of Award Management (SAM) website (https://sam.gov/SAM/) to verify medical licenses, credentials, and certifications with state medical boards (POMS DI 39569.300). and ensure medical staff and CE providers are qualified to perform the assigned tasks. Assigned tasks may include, but are not limited to, providing consultative examinations (CE) or final review of disability determinations. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor and Workforce Development (Department) did not perform timely periodic reviews of providers performing Consultative Examination (CE) services. Context: For one of forty CE providers selected for testing, the periodic review was not completed timely during FY2023. Section III – Federal Award Findings and Questioned Costs (Continued) Questioned costs: Undetermined. Cause: The Department’s procedures were not effective to ensure that CE provider reviews were completed timely. Internal controls did not prevent or detect the errors. Effect: Untimely provider periodic reviews could result in ineligible CE providers performing services under the program. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all periodic CE provider reviews are completely timely. Views of responsible officials: The audit finding noted one Consultative Examination (CE) provider where the qualified provider review was not completed timely and this was an oversight on the part of the Department of Labor and Workforce Development’s Division of Disability Services (DDS) due to attrition of staff. Going forward, each DDS Professional Relations Officer will be responsible for reviewing eight to 10 CE provider’s qualifications each month until the yearly review is completed for each vendor. The Chief of Professional Relations will submit a monthly report to the DDS Assistant Director detailing how many sites were visited that month and any findings that may have occurred. Each month, the report will detail how many reports remain outstanding in order to complete the yearly reviews.

Reference Number: 2023-028 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Department of Law and Public Safety Federal Program: COVID-19 - Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: 066124021PA: 8/31/11; 066224614PA: 9/5/21; 066164264PA: 3/14/16; 066214597PA: 4/28/21; 066184368PA: 6/6/18; 066214574PA: 12/11/20; 066204488PA: 3/13/20; 066134086PA: 10/30/12 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Law and Public Safety (Department) did not report subaward information to FSRS during FY 2023. Context: Forty of forty subawards selected for testing were not reported to FSRS. The subawards were issued from 2/18/2022 through 11/22/2023 and were not reported to FSRS until after they were selected for testing by auditors during January and February 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has insufficient procedures and internal controls to ensure that subawards are reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: Unlike other subgrants managed by the Department of Law and Public Safety (DLPS), the subgrants in the Public Assistance program are not issued by the Department but instead are issued by the Federal Emergency Management Agency (FEMA). These FEMA-issued subgrants take the form of Project Worksheets (PWs) and are directly related to a specific disaster. FEMA informs the DLPS of the approved PWs after they are issued. Given the unique nature of the PW issuance, the DLPS is not in a position to report on the FFATA Subaward Reporting System (FSRS) at the time PWs are issued. This contrasts with other grant programs overseen by the DLPS, which do allow for timely subaward reporting in FSRS. The Department will continue to work with our FEMA partners, incorporating any guidance they provide, to develop procedures that ensure subawards are reported in FSRS within the FFATA reporting requirements.

Reference Number: 2023-028 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Department of Law and Public Safety Federal Program: COVID-19 - Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: 066124021PA: 8/31/11; 066224614PA: 9/5/21; 066164264PA: 3/14/16; 066214597PA: 4/28/21; 066184368PA: 6/6/18; 066214574PA: 12/11/20; 066204488PA: 3/13/20; 066134086PA: 10/30/12 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Unique Entity ID (UEI) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Federal Award Findings and Questioned Costs (Continued) Condition: The Department of Law and Public Safety (Department) did not report subaward information to FSRS during FY 2023. Context: Forty of forty subawards selected for testing were not reported to FSRS. The subawards were issued from 2/18/2022 through 11/22/2023 and were not reported to FSRS until after they were selected for testing by auditors during January and February 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has insufficient procedures and internal controls to ensure that subawards are reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: Unlike other subgrants managed by the Department of Law and Public Safety (DLPS), the subgrants in the Public Assistance program are not issued by the Department but instead are issued by the Federal Emergency Management Agency (FEMA). These FEMA-issued subgrants take the form of Project Worksheets (PWs) and are directly related to a specific disaster. FEMA informs the DLPS of the approved PWs after they are issued. Given the unique nature of the PW issuance, the DLPS is not in a position to report on the FFATA Subaward Reporting System (FSRS) at the time PWs are issued. This contrasts with other grant programs overseen by the DLPS, which do allow for timely subaward reporting in FSRS. The Department will continue to work with our FEMA partners, incorporating any guidance they provide, to develop procedures that ensure subawards are reported in FSRS within the FFATA reporting requirements.