Audit 309913

Reference Number: 2021-001 Type of Finding: Material Weakness and Material Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Finance developed the Single Audit Expenditures Reporting Database (Database). Finance developed the Database to include all of the relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Due to the unprecedented impacts from the COVID-19 pandemic, the Employment Development Department (EDD) was unable to timely report to Finance through the Database with accurate and reliable federal cash basis expenditures for its largest federal award programs that it administers, the Unemployment Insurance (ALN 17.225) and Presidential Declared Disaster Assistance to Individuals and Households – Other Needs (ALN 97.050) programs. The delay resulted in Finance being unable to compile and produce a complete and final approved Schedule until December 2022. Although initial estimated expenditure amounts were reported by EDD for both programs, $90.6 billion and $7.5 billion, respectively, the final amounts reported in the Schedule for both programs were ultimately updated to $92.7 billion and $6.5 billion, respectively. Cause Given the substantial increase in claimants seeking assistance under the Unemployment Insurance program resulting from the COVID-19 pandemic, EDD was overwhelmed with the overall administration of the Unemployment Insurance program. Also, EDD was still contending with accounting and control issues from the implementation of the State’s Financial Information System for California (FI$Cal), which replaced the legacy system. Effect The difficulties that EDD encountered from the COVID-19 pandemic and continuing FI$Cal implementation issues, resulted in the late reporting and submission of final federal cash basis expenditures to Finance. The untimely submission limited and constrained Finance from compiling and producing a final complete and accurate Schedule. Questioned Costs Questioned costs were not determinable. Recommendation EDD should continue to evaluate its existing process and controls related to its ability to properly account for, report, and timely submit complete and accurate federal award cash basis expenditures to the Database, which affords Finance the ability to timely compile and produce a final Schedule pursuant to the Uniform Guidance. Views of Responsible Officials and Corrective Action Plan EDD agrees with this finding. The deferred transition to FI$Cal and the difficulties experienced thereafter have continued to cause EDD to be late with submitting year-end financials and its ability to submit timely the cash basis expenditures into the Single Audit Expenditures Reporting Database (Database). In addition, the onset of the COVID-19 pandemic created additional issues which ultimately impacted the EDD’s ability to submit timely year-end financials. However, the EDD is making progress and continues to gain ground in the department’s efforts to follow the State’s deadlines for submitting year-end financials and entering the cash basis expenditures into the Database. By the end of fiscal year 2021-22 and into fiscal year 2022-23, the EDD did a restructuring within the accounting area which realigned workload amongst the units and provided additional resources in critical areas. These changes will have a lasting effect and help the department to be better positioned going forward in processing the accounting workload and ultimately be able to catch up and submit year-end financials and enter the cash basis expenditures into the Database by the State’s deadlines. In addition, the EDD took lessons learned from the fiscal year 2019-20 financial audit to update processes and procedures and applied that knowledge going forward. Also, staff have been participating in various trainings offered by Finance and the Department of FISCal and staff continue to work with the control agencies when issues arise that would impact our accounting functions. While the EDD is still behind, the department is making great progress on catching up. The EDD submitted the last of its fiscal year 2020-21 financials in July 2022 and is targeting to submit the last of its fiscal year 2021-22 financials by the end of March 2023. The EDD’s goal is to submit fiscal year 2022-23 financials by the end of December 2023. Similar to the 2019-20 financial audit, the EDD will take the knowledge learned during the 2020-21 audit season, continue to engage with the control agencies, and continue to train and develop staff in order to keep progressing towards the department’s goal of becoming timely with the submission of the year-end financials and entering of the cash basis expenditures into the Database.

Reference Number: 2021-001 Type of Finding: Material Weakness and Material Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Finance developed the Single Audit Expenditures Reporting Database (Database). Finance developed the Database to include all of the relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Due to the unprecedented impacts from the COVID-19 pandemic, the Employment Development Department (EDD) was unable to timely report to Finance through the Database with accurate and reliable federal cash basis expenditures for its largest federal award programs that it administers, the Unemployment Insurance (ALN 17.225) and Presidential Declared Disaster Assistance to Individuals and Households – Other Needs (ALN 97.050) programs. The delay resulted in Finance being unable to compile and produce a complete and final approved Schedule until December 2022. Although initial estimated expenditure amounts were reported by EDD for both programs, $90.6 billion and $7.5 billion, respectively, the final amounts reported in the Schedule for both programs were ultimately updated to $92.7 billion and $6.5 billion, respectively. Cause Given the substantial increase in claimants seeking assistance under the Unemployment Insurance program resulting from the COVID-19 pandemic, EDD was overwhelmed with the overall administration of the Unemployment Insurance program. Also, EDD was still contending with accounting and control issues from the implementation of the State’s Financial Information System for California (FI$Cal), which replaced the legacy system. Effect The difficulties that EDD encountered from the COVID-19 pandemic and continuing FI$Cal implementation issues, resulted in the late reporting and submission of final federal cash basis expenditures to Finance. The untimely submission limited and constrained Finance from compiling and producing a final complete and accurate Schedule. Questioned Costs Questioned costs were not determinable. Recommendation EDD should continue to evaluate its existing process and controls related to its ability to properly account for, report, and timely submit complete and accurate federal award cash basis expenditures to the Database, which affords Finance the ability to timely compile and produce a final Schedule pursuant to the Uniform Guidance. Views of Responsible Officials and Corrective Action Plan EDD agrees with this finding. The deferred transition to FI$Cal and the difficulties experienced thereafter have continued to cause EDD to be late with submitting year-end financials and its ability to submit timely the cash basis expenditures into the Single Audit Expenditures Reporting Database (Database). In addition, the onset of the COVID-19 pandemic created additional issues which ultimately impacted the EDD’s ability to submit timely year-end financials. However, the EDD is making progress and continues to gain ground in the department’s efforts to follow the State’s deadlines for submitting year-end financials and entering the cash basis expenditures into the Database. By the end of fiscal year 2021-22 and into fiscal year 2022-23, the EDD did a restructuring within the accounting area which realigned workload amongst the units and provided additional resources in critical areas. These changes will have a lasting effect and help the department to be better positioned going forward in processing the accounting workload and ultimately be able to catch up and submit year-end financials and enter the cash basis expenditures into the Database by the State’s deadlines. In addition, the EDD took lessons learned from the fiscal year 2019-20 financial audit to update processes and procedures and applied that knowledge going forward. Also, staff have been participating in various trainings offered by Finance and the Department of FISCal and staff continue to work with the control agencies when issues arise that would impact our accounting functions. While the EDD is still behind, the department is making great progress on catching up. The EDD submitted the last of its fiscal year 2020-21 financials in July 2022 and is targeting to submit the last of its fiscal year 2021-22 financials by the end of March 2023. The EDD’s goal is to submit fiscal year 2022-23 financials by the end of December 2023. Similar to the 2019-20 financial audit, the EDD will take the knowledge learned during the 2020-21 audit season, continue to engage with the control agencies, and continue to train and develop staff in order to keep progressing towards the department’s goal of becoming timely with the submission of the year-end financials and entering of the cash basis expenditures into the Database.

Reference Number: 2021-001 Type of Finding: Material Weakness and Material Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Finance developed the Single Audit Expenditures Reporting Database (Database). Finance developed the Database to include all of the relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Due to the unprecedented impacts from the COVID-19 pandemic, the Employment Development Department (EDD) was unable to timely report to Finance through the Database with accurate and reliable federal cash basis expenditures for its largest federal award programs that it administers, the Unemployment Insurance (ALN 17.225) and Presidential Declared Disaster Assistance to Individuals and Households – Other Needs (ALN 97.050) programs. The delay resulted in Finance being unable to compile and produce a complete and final approved Schedule until December 2022. Although initial estimated expenditure amounts were reported by EDD for both programs, $90.6 billion and $7.5 billion, respectively, the final amounts reported in the Schedule for both programs were ultimately updated to $92.7 billion and $6.5 billion, respectively. Cause Given the substantial increase in claimants seeking assistance under the Unemployment Insurance program resulting from the COVID-19 pandemic, EDD was overwhelmed with the overall administration of the Unemployment Insurance program. Also, EDD was still contending with accounting and control issues from the implementation of the State’s Financial Information System for California (FI$Cal), which replaced the legacy system. Effect The difficulties that EDD encountered from the COVID-19 pandemic and continuing FI$Cal implementation issues, resulted in the late reporting and submission of final federal cash basis expenditures to Finance. The untimely submission limited and constrained Finance from compiling and producing a final complete and accurate Schedule. Questioned Costs Questioned costs were not determinable. Recommendation EDD should continue to evaluate its existing process and controls related to its ability to properly account for, report, and timely submit complete and accurate federal award cash basis expenditures to the Database, which affords Finance the ability to timely compile and produce a final Schedule pursuant to the Uniform Guidance. Views of Responsible Officials and Corrective Action Plan EDD agrees with this finding. The deferred transition to FI$Cal and the difficulties experienced thereafter have continued to cause EDD to be late with submitting year-end financials and its ability to submit timely the cash basis expenditures into the Single Audit Expenditures Reporting Database (Database). In addition, the onset of the COVID-19 pandemic created additional issues which ultimately impacted the EDD’s ability to submit timely year-end financials. However, the EDD is making progress and continues to gain ground in the department’s efforts to follow the State’s deadlines for submitting year-end financials and entering the cash basis expenditures into the Database. By the end of fiscal year 2021-22 and into fiscal year 2022-23, the EDD did a restructuring within the accounting area which realigned workload amongst the units and provided additional resources in critical areas. These changes will have a lasting effect and help the department to be better positioned going forward in processing the accounting workload and ultimately be able to catch up and submit year-end financials and enter the cash basis expenditures into the Database by the State’s deadlines. In addition, the EDD took lessons learned from the fiscal year 2019-20 financial audit to update processes and procedures and applied that knowledge going forward. Also, staff have been participating in various trainings offered by Finance and the Department of FISCal and staff continue to work with the control agencies when issues arise that would impact our accounting functions. While the EDD is still behind, the department is making great progress on catching up. The EDD submitted the last of its fiscal year 2020-21 financials in July 2022 and is targeting to submit the last of its fiscal year 2021-22 financials by the end of March 2023. The EDD’s goal is to submit fiscal year 2022-23 financials by the end of December 2023. Similar to the 2019-20 financial audit, the EDD will take the knowledge learned during the 2020-21 audit season, continue to engage with the control agencies, and continue to train and develop staff in order to keep progressing towards the department’s goal of becoming timely with the submission of the year-end financials and entering of the cash basis expenditures into the Database.

Reference Number: 2021-002 Type of Finding: Material Weakness and Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. (4) Include the total amount provided to subrecipients from each Federal program. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of 2 CFR 200.510, Finance developed the Single Audit Expenditures Reporting Database (Database) to include all relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Departments are given access to the centralized Database by Finance in order to upload and report federal award information for all federal award programs which they administer. The California Department of Public Health (Public Health) failed to include $479,996,082 of federal expenditures and $367,405,431 of subrecipient expenditures for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program (ALN No. 93.323) in the Database, which Finance uses to prepare the State’s annual Schedule. The error resulted in an additional major program that had to be audited in accordance with the Uniform Guidance and the State having to re-issue its federal compliance audit report for the fiscal year ended June 30, 2021. Cause Public Health entered into a Bona Fide Agent Designation arrangement with Public Health Foundation Enterprises, Inc., dba Heluna Health, for the submission of a grant application under the State of California’s eligibility in lieu of a direct State application for the U.S. Department of Health and Human Services (HHS), Centers for Disease Control and Prevention (CDC) funding opportunity: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Cooperative Agreement. Subsequent to the bona fide agent arrangement, Public Health entered into a separate subrecipient agreement with Heluna Health on March 2, 2021, to provide Heluna Health with certain services related to the performance of its obligations under the ELC program grant award received from HHS. Since Public Health is typically not a subrecipient of federal awards and the accounting control for ELC program revenues and expenditures was established within the State’s General Fund rather than the Federal Trust Fund, which is State standard operating procedure, Public Health failed to identify and report the $479,996,082 of federal expenditures in the Schedule. Effect Because of the ELC program’s inclusion in the State’s Schedule for the fiscal year ended June 30, 2021, the ELC program had to be audited as a major program under requirements of the Uniform Guidance and the State’s federal compliance report had to be reissued. Questioned Costs No questioned costs were identified. Recommendation When infrequent and unusual arrangements occur impacting processes and procedures surrounding federal award programs, Public Health should ensure there is sufficient identification and understanding of the administrative and operational changes from standard operating procedures. Public Health should then design appropriate internal controls commensurate with such changes to ensure adherence to applicable laws and regulations. Views of Responsible Officials and Corrective Action Plan Management's response is reported in "Management's Response and Corrective Action Plan" included in a separate section at the end of this report.

Reference Number: 2021-003 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 10.557 Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children COVID-19 Special Supplemental Nutrition Program for Women, Infants, and Children Federal Award Numbers and Years: 202019W100647; 2020 202020W100347, 2020 202020W100647, 2020 202120W600347, 2021 202120W600647, 2021 202121W100347, 2021 202121W100647, 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 7 – Agriculture. Subtitle B - Regulations of the Department of Agriculture. Chapter II – Food and Nutrition Service, Department of Agriculture. Subchapter A – Child Nutrition Programs. Part 246 - Special Supplemental Nutrition Program for Women, Infants and Children. §246.7 - Certification of participants: (c) Eligibility criteria and basic certification procedures. (1) To qualify for the Program, infants, children, and pregnant, postpartum, and breastfeeding women must: (i) Reside within the jurisdiction of the State (except for Indian State agencies). Indian State agencies may establish a similar requirement. All State agencies may determine a service area for any local agency, and may require that an applicant reside within the service area. However, the State agency may not use length of residency as an eligibility requirement. (ii) Meet the income criteria specified in paragraph (d) of this section. (iii) Meet the nutritional risk criteria specified in paragraph (e) of this section. (2) (i) At certification, the State or local agency must require each applicant to present proof of residency (i.e., location or address where the applicant routinely lives or spends the night) and proof of identity. The State or local agency must also check the identity of participants, or in the case of infants or children, the identity of the parent or guardian, or proxies when issuing food, cash-value vouchers or food instruments. The State agency may authorize the certification of applicants when no proof of residency or identity exists (such as when an applicant or an applicant's parent is a victim of theft, loss, or disaster; a homeless individual; or a migrant farmworker). In these cases, the State or local agency must require the applicant to confirm in writing his/her residency or identity. Further, an individual residing in a remote Indian or Native village or an individual served by an Indian tribal organization and residing on a reservation or pueblo may establish proof of residency by providing the State agency their mailing address and the name of the remote Indian or Native village. (e) Nutritional risk. To be certified as eligible for the Program, applicants who meet the Program's eligibility standards specified in paragraph (c) of this section must be determined to be at nutritional risk. … Nutritional risk data shall be documented in the participant's file and shall be used to assess an applicant's nutritional status and risk; tailor the food package to address nutritional needs; design appropriate nutrition education, including breastfeeding promotion and support; and make referrals to health and social services for follow-up, as necessary and appropriate. (1) Determination of nutritional risk. (ii) Timing of nutritional risk data. (A) Weight and height or length. Weight and height or length shall be measured not more than 60 days prior to certification for program participation. (B) Hematological test for anemia. (1) For pregnant, breastfeeding, and postpartum women, and child applicants, the hematological test for anemia shall be performed or obtained from referral sources at the time of certification or within 90 days of the date of certification. The hematological test for anemia may be deferred for up to 90 days from the time of certification for applicants who have at least one qualifying nutritional risk factor present at the time of certification. If no qualifying risk factor is identified, a hematological test for anemia must be performed or obtained from referral sources (with the exception of presumptively eligible pregnant women). (2) Infants nine months of age and older (who have not already had a hematological test performed, between six and nine months of age, by a competent professional authority or obtained from referral sources), shall between nine and twelve months of age have a hematological test performed or obtained from referral sources. Such a test may be performed more than 90 days after the date of certification. (3) For pregnant women, the hematological test for anemia shall be performed during their pregnancy. For persons certified as postpartum or breastfeeding women, the hematological test for anemia shall be performed after the termination of their pregnancy. For breastfeeding women who are 6-12 months postpartum, no additional blood test is necessary if a test was performed after the termination of their pregnancy. The participant or parent/guardian shall be informed of the test results when there is a finding of anemia, and notations reflecting the outcome of the tests shall be made in the participant's file. Nutrition education, food package tailoring, and referral services shall be provided to the participant or parent/guardian, as necessary and appropriate. Condition During the fiscal year ended June 30, 2020, the Special Supplemental Food Program for Women, Infants and Children (WIC) nutrition program implemented phase 1 of a new management information system known as the Women, Infants, and Children Web Information System Exchange (WIC-WISE) in a two-phased approach to replace the WIC Management Information Systems (WIC-MIS). WIC-WISE is programmed such that updates to eligibility information overwrites existing data. As a result, key data and documentation to support the initial participant eligibility is removed during the recertification process. The California Department of Public Health, WIC Division requested a correction to WIC-WISE to retain eligibility history in the “Cert History Report” when subsequent eligibility information is entered. This correction will be included in a future release targeted for May 2023. As such, the system defect still existed during the fiscal year ended June 30, 2021. Accordingly, sample testing was not performed. Identification as a Repeat Finding Finding 2020-002 was reported in the immediate prior year. Cause The phase 1 implementation of WIC-WISE did not include system functionality to retain historical eligibility documentation when subsequent information was entered during the participant recertification process. Effect The system limitation of WIC-WISE does not allow for the retention of proper documentation of eligibility information. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals, which may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable. Context Total food vouchers disbursed to program participants during the fiscal year ended June 30, 2021, totaled $471,612,402. Recommendation WIC-WISE system updates should be promptly implemented and tested to ensure that participant data and eligibility documentation is appropriately retained within the system. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-003 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 10.557 Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children COVID-19 Special Supplemental Nutrition Program for Women, Infants, and Children Federal Award Numbers and Years: 202019W100647; 2020 202020W100347, 2020 202020W100647, 2020 202120W600347, 2021 202120W600647, 2021 202121W100347, 2021 202121W100647, 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 7 – Agriculture. Subtitle B - Regulations of the Department of Agriculture. Chapter II – Food and Nutrition Service, Department of Agriculture. Subchapter A – Child Nutrition Programs. Part 246 - Special Supplemental Nutrition Program for Women, Infants and Children. §246.7 - Certification of participants: (c) Eligibility criteria and basic certification procedures. (1) To qualify for the Program, infants, children, and pregnant, postpartum, and breastfeeding women must: (i) Reside within the jurisdiction of the State (except for Indian State agencies). Indian State agencies may establish a similar requirement. All State agencies may determine a service area for any local agency, and may require that an applicant reside within the service area. However, the State agency may not use length of residency as an eligibility requirement. (ii) Meet the income criteria specified in paragraph (d) of this section. (iii) Meet the nutritional risk criteria specified in paragraph (e) of this section. (2) (i) At certification, the State or local agency must require each applicant to present proof of residency (i.e., location or address where the applicant routinely lives or spends the night) and proof of identity. The State or local agency must also check the identity of participants, or in the case of infants or children, the identity of the parent or guardian, or proxies when issuing food, cash-value vouchers or food instruments. The State agency may authorize the certification of applicants when no proof of residency or identity exists (such as when an applicant or an applicant's parent is a victim of theft, loss, or disaster; a homeless individual; or a migrant farmworker). In these cases, the State or local agency must require the applicant to confirm in writing his/her residency or identity. Further, an individual residing in a remote Indian or Native village or an individual served by an Indian tribal organization and residing on a reservation or pueblo may establish proof of residency by providing the State agency their mailing address and the name of the remote Indian or Native village. (e) Nutritional risk. To be certified as eligible for the Program, applicants who meet the Program's eligibility standards specified in paragraph (c) of this section must be determined to be at nutritional risk. … Nutritional risk data shall be documented in the participant's file and shall be used to assess an applicant's nutritional status and risk; tailor the food package to address nutritional needs; design appropriate nutrition education, including breastfeeding promotion and support; and make referrals to health and social services for follow-up, as necessary and appropriate. (1) Determination of nutritional risk. (ii) Timing of nutritional risk data. (A) Weight and height or length. Weight and height or length shall be measured not more than 60 days prior to certification for program participation. (B) Hematological test for anemia. (1) For pregnant, breastfeeding, and postpartum women, and child applicants, the hematological test for anemia shall be performed or obtained from referral sources at the time of certification or within 90 days of the date of certification. The hematological test for anemia may be deferred for up to 90 days from the time of certification for applicants who have at least one qualifying nutritional risk factor present at the time of certification. If no qualifying risk factor is identified, a hematological test for anemia must be performed or obtained from referral sources (with the exception of presumptively eligible pregnant women). (2) Infants nine months of age and older (who have not already had a hematological test performed, between six and nine months of age, by a competent professional authority or obtained from referral sources), shall between nine and twelve months of age have a hematological test performed or obtained from referral sources. Such a test may be performed more than 90 days after the date of certification. (3) For pregnant women, the hematological test for anemia shall be performed during their pregnancy. For persons certified as postpartum or breastfeeding women, the hematological test for anemia shall be performed after the termination of their pregnancy. For breastfeeding women who are 6-12 months postpartum, no additional blood test is necessary if a test was performed after the termination of their pregnancy. The participant or parent/guardian shall be informed of the test results when there is a finding of anemia, and notations reflecting the outcome of the tests shall be made in the participant's file. Nutrition education, food package tailoring, and referral services shall be provided to the participant or parent/guardian, as necessary and appropriate. Condition During the fiscal year ended June 30, 2020, the Special Supplemental Food Program for Women, Infants and Children (WIC) nutrition program implemented phase 1 of a new management information system known as the Women, Infants, and Children Web Information System Exchange (WIC-WISE) in a two-phased approach to replace the WIC Management Information Systems (WIC-MIS). WIC-WISE is programmed such that updates to eligibility information overwrites existing data. As a result, key data and documentation to support the initial participant eligibility is removed during the recertification process. The California Department of Public Health, WIC Division requested a correction to WIC-WISE to retain eligibility history in the “Cert History Report” when subsequent eligibility information is entered. This correction will be included in a future release targeted for May 2023. As such, the system defect still existed during the fiscal year ended June 30, 2021. Accordingly, sample testing was not performed. Identification as a Repeat Finding Finding 2020-002 was reported in the immediate prior year. Cause The phase 1 implementation of WIC-WISE did not include system functionality to retain historical eligibility documentation when subsequent information was entered during the participant recertification process. Effect The system limitation of WIC-WISE does not allow for the retention of proper documentation of eligibility information. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals, which may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable. Context Total food vouchers disbursed to program participants during the fiscal year ended June 30, 2021, totaled $471,612,402. Recommendation WIC-WISE system updates should be promptly implemented and tested to ensure that participant data and eligibility documentation is appropriately retained within the system. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-004 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance (HR748/2020) Federal Award Numbers and Year: UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary's “Standard for Fraud and Overpayment Detection,” Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Title 15 - Commerce and Trade, Chapter 116, Coronavirus Economic (CARES Act) Subchapter II - Unemployment Insurance Provisions, §9023 Emergency Increase in Unemployment Compensation Benefits (f) Fraud and Overpayments: (1) In General – If an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact, and as a result of such false statement or representation or of such nondisclosure such individual has received an amount of Federal Pandemic Unemployment Compensation or Mixed Earner Unemployment Compensation to which such individual was not entitled, such individual— (A) shall be ineligible for further Federal Pandemic Unemployment Compensation Mixed Earner Unemployment Compensation in accordance with the provisions of the applicable State unemployment compensation law relating to fraud in connection with a claim for unemployment compensation Condition During the fiscal year ended June 30, 2021, EDD continued its administration of the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA benefits were paid additional benefits under the Federal Pandemic Unemployment Compensation program (FPUC). In EDD’s administration of the PUA and FPUC programs, $17,143,006,979 in benefit payments were estimated to be potentially fraudulent payments. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched imposter fraud for identity or eligibility fraud for misrepresented information. Out of 138 PUA benefit payments tested, there were 26 benefit payments to claimants determined to be potentially fraudulent whose identity was not sufficiently verified. Identification as a Repeat Finding Finding 2020-005 was reported in the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of potential fraud for benefit payments for the following reasons. • There was a significant increase in unemployment claims that overwhelmed EDD’s existing fraud detection process. • There were insufficient controls in place to prevent or detect fraud associated with benefit payments related to incarceration, identity, and multiple claims from the same address. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to fraudulent claimants. Accordingly, benefit payments were made to fraudulent claimants who were not eligible. Questioned Costs Likely questioned costs were estimated to be $17,143,006,979 for fiscal year 2020-21. Known questioned costs were $570,802. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $66,108,457,174. The sample was not a statistically valid sample. Recommendation EDD should continue to evaluate and enhance it fraud detection and prevention internal controls, increasing the use of automation features and other analytical tools in an effort to increase efficiency, continue to reduce workload, and enhance detection and timely identification of unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-004 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance (HR748/2020) Federal Award Numbers and Year: UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary's “Standard for Fraud and Overpayment Detection,” Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Title 15 - Commerce and Trade, Chapter 116, Coronavirus Economic (CARES Act) Subchapter II - Unemployment Insurance Provisions, §9023 Emergency Increase in Unemployment Compensation Benefits (f) Fraud and Overpayments: (1) In General – If an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact, and as a result of such false statement or representation or of such nondisclosure such individual has received an amount of Federal Pandemic Unemployment Compensation or Mixed Earner Unemployment Compensation to which such individual was not entitled, such individual— (A) shall be ineligible for further Federal Pandemic Unemployment Compensation Mixed Earner Unemployment Compensation in accordance with the provisions of the applicable State unemployment compensation law relating to fraud in connection with a claim for unemployment compensation Condition During the fiscal year ended June 30, 2021, EDD continued its administration of the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA benefits were paid additional benefits under the Federal Pandemic Unemployment Compensation program (FPUC). In EDD’s administration of the PUA and FPUC programs, $17,143,006,979 in benefit payments were estimated to be potentially fraudulent payments. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched imposter fraud for identity or eligibility fraud for misrepresented information. Out of 138 PUA benefit payments tested, there were 26 benefit payments to claimants determined to be potentially fraudulent whose identity was not sufficiently verified. Identification as a Repeat Finding Finding 2020-005 was reported in the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of potential fraud for benefit payments for the following reasons. • There was a significant increase in unemployment claims that overwhelmed EDD’s existing fraud detection process. • There were insufficient controls in place to prevent or detect fraud associated with benefit payments related to incarceration, identity, and multiple claims from the same address. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to fraudulent claimants. Accordingly, benefit payments were made to fraudulent claimants who were not eligible. Questioned Costs Likely questioned costs were estimated to be $17,143,006,979 for fiscal year 2020-21. Known questioned costs were $570,802. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $66,108,457,174. The sample was not a statistically valid sample. Recommendation EDD should continue to evaluate and enhance it fraud detection and prevention internal controls, increasing the use of automation features and other analytical tools in an effort to increase efficiency, continue to reduce workload, and enhance detection and timely identification of unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-005 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance (HR748/2021) Federal Award Numbers and Years: UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications, (b) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of § 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (e) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual's statement of employment or self-employment preceding the individual's unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based on the individual's statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual's statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately redetermine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Out of 138 PUA benefit payments tested, there were 4 claimants whose wages were not reduced or suspended due to a lack of wage verification and 8 claimants whose self-employment were not verified. Identification as a Repeat Finding Finding 2020-006 was reported in the immediate prior year. Cause EDD did not perform timely wage verifications of the claimants due to the significant increase in claims resulting from the COVID-19 pandemic. Effect EDD did not have adequate oversight controls to ensure that the claimant’s wages were timely and properly reviewed and approved. Accordingly, there was an increased risk for the occurrence of overpayment in benefits being provided to individuals, which was not timely prevented or detected. Questioned Costs Known questioned costs for the 12 claimants were $325,948. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $66,108,457,174. The sample was not a statistically valid sample. Recommendation EDD should continue to look for ways to enhance its capacity to perform timely wage verifications to ensure accurate eligibility determinations and claimant benefit payments. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-005 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance (HR748/2021) Federal Award Numbers and Years: UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications, (b) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of § 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (e) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual's statement of employment or self-employment preceding the individual's unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based on the individual's statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual's statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately redetermine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Out of 138 PUA benefit payments tested, there were 4 claimants whose wages were not reduced or suspended due to a lack of wage verification and 8 claimants whose self-employment were not verified. Identification as a Repeat Finding Finding 2020-006 was reported in the immediate prior year. Cause EDD did not perform timely wage verifications of the claimants due to the significant increase in claims resulting from the COVID-19 pandemic. Effect EDD did not have adequate oversight controls to ensure that the claimant’s wages were timely and properly reviewed and approved. Accordingly, there was an increased risk for the occurrence of overpayment in benefits being provided to individuals, which was not timely prevented or detected. Questioned Costs Known questioned costs for the 12 claimants were $325,948. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $66,108,457,174. The sample was not a statistically valid sample. Recommendation EDD should continue to look for ways to enhance its capacity to perform timely wage verifications to ensure accurate eligibility determinations and claimant benefit payments. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-006 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: Unemployment Insurance COVID-19 Unemployment Insurance Federal Award Numbers and Years: UI-35637-21-55-A-6; 2021 UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 22 - Social Security, Division 1 - Employment Development Department, Subdivision 1 - Director of Employment Development, Division - 1 Unemployment and Disability Compensation, Part 1 - Unemployment Compensation, Chapter 5 Unemployment Compensation Benefits, Article 1 - Eligibility and Disqualifications §1256 and §1257 Eligibility and Disqualifications, §1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Eligibility and Disqualifications, §1257 California Code of Regulations: (a) An individual is also disqualified for unemployment compensation benefits if: He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division. Condition In EDD’s administration of the Unemployment Insurance program, $1,440,071,129 in benefit payments were estimated to be potentially fraudulent payments. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched imposter fraud for identity or eligibility fraud for misrepresented information. The Unemployment Insurance Branch of EDD reviews unemployment insurance claims of claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 138 unemployment insurance benefit payments tested, there were 4 claimants receiving benefits, whose reasons for involuntary separation indicated separation reasons due to voluntary quitting without good cause. Identification as a Repeat Finding Finding 2020-004 was reported in the immediate prior year. Cause The adjudication process for potential eligibility issues, which includes work separation, was not timely reviewed due to the significant increase in claims resulting from the COVID-19 pandemic. Effect By EDD not performing timely review for potential eligibility issues, benefit payments were made to ineligible claimants. Questioned Costs Known questioned costs for the 4 claimants were $13,720 for the Unemployment Insurance program and $16,200 for the Federal Pandemic Unemployment Compensation program of the COVID-19 Unemployment Insurance program. Context Benefits paid to claimants under the Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $25,554,569,761. The sample was not a statistically valid sample. Recommendation EDD should continue its work catching up with the adjudication process to support proper eligibility determinations and decrease improper payments to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-006 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: Unemployment Insurance COVID-19 Unemployment Insurance Federal Award Numbers and Years: UI-35637-21-55-A-6; 2021 UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 22 - Social Security, Division 1 - Employment Development Department, Subdivision 1 - Director of Employment Development, Division - 1 Unemployment and Disability Compensation, Part 1 - Unemployment Compensation, Chapter 5 Unemployment Compensation Benefits, Article 1 - Eligibility and Disqualifications §1256 and §1257 Eligibility and Disqualifications, §1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Eligibility and Disqualifications, §1257 California Code of Regulations: (a) An individual is also disqualified for unemployment compensation benefits if: He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division. Condition In EDD’s administration of the Unemployment Insurance program, $1,440,071,129 in benefit payments were estimated to be potentially fraudulent payments. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched imposter fraud for identity or eligibility fraud for misrepresented information. The Unemployment Insurance Branch of EDD reviews unemployment insurance claims of claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 138 unemployment insurance benefit payments tested, there were 4 claimants receiving benefits, whose reasons for involuntary separation indicated separation reasons due to voluntary quitting without good cause. Identification as a Repeat Finding Finding 2020-004 was reported in the immediate prior year. Cause The adjudication process for potential eligibility issues, which includes work separation, was not timely reviewed due to the significant increase in claims resulting from the COVID-19 pandemic. Effect By EDD not performing timely review for potential eligibility issues, benefit payments were made to ineligible claimants. Questioned Costs Known questioned costs for the 4 claimants were $13,720 for the Unemployment Insurance program and $16,200 for the Federal Pandemic Unemployment Compensation program of the COVID-19 Unemployment Insurance program. Context Benefits paid to claimants under the Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $25,554,569,761. The sample was not a statistically valid sample. Recommendation EDD should continue its work catching up with the adjudication process to support proper eligibility determinations and decrease improper payments to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-007 Category of Finding: Subrecipient Monitoring Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Business, Consumer Services, and Housing Agency California Department of Education California Department of Social Services Federal Program Title: Coronavirus Relief Fund Assistance Listing Number: 21.019 Federal Award Number and Year: N/A; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. §200.332 Requirements for pass-through entities (2 CFR 200.332): All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these date elements change, include the changes in subsequent subaward modification. When some of the information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient’s unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged per §200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; Condition For 2 of 60 subawards tested, the State did not communicate required subaward information to its subrecipients of the Coronavirus Relief Fund (CRF) program at the time of the subaward, or when the State became aware of changes in subaward information, including identification that the subaward funds represented federal funding. Also, for 4 of 60 direct costs tested, the transactions were subsequently determined to be subawards, for which the required subaward information was not properly communicated to the subrecipients. The 4 direct costs transactions were from the Business, Consumer Services and Housing Agency; 1 of the subawards was from the California Department of Education; and 1 of the subawards was from the California Department of Social Services. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The State initially appropriated state General Fund dollars to various departments through an amendment to the 2019 State Budget Act for its coronavirus response. The initial communication to certain subrecipients identified the funding source as State General Fund monies. Subsequently, upon the State allocating its CRF award funds to be administered by various state departments, certain activities and related costs originally funded by the State General Fund, were replaced with CRF funding. Given the change in the source of funding, updated communication was not provided to the subrecipients informing them of the required federal award information. Additionally, the State did not make timely determinations identifying certain activities as subawards versus contracts for goods and/or services. Effect By not properly informing subrecipients that the funding provided represented federal financial assistance associated with the CRF program, there is an increased risk that subrecipients could potentially expend funds on ineligible activities, as well as subrecipients not accounting and reporting expenditures in accordance with the Federal statutes, regulations, and the terms and conditions of the federal award. Questioned Costs No questioned costs were identified. Context Disbursements to subrecipients for the CRF totaled $7,480,270,598, or 79.7% of total reported CRF program expenditures. Subrecipient expenditures for the 6 subawards with exceptions, the related State administering department, and the total department subrecipient expenditures for which the required subaward information was not communicated, is as follows: "See the Notes to the SEFA for the chart/table" The sample was not a statistically valid sample. Recommendation The state administering departments identified above should review all subawards provided which were funded using CRF program funds, provide the subrecipients with subaward information required by 2 CFR 200.332(a), and determine whether the subrecipients properly reported CRF subawards and related expenditures in their respective schedule of expenditures of federal awards pursuant to 2 CFR 200.502.If federal subawards were not reported, the state administering departments should perform appropriate follow-up monitoring procedures. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-008 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year.   §14712: (e) Whenever the department determines that a mental health plan has failed to comply with this chapter or any regulations, contractual requirements, state plan, or waivers adopted pursuant to this chapter, the department shall notify the mental health plan in writing within 30 days of its determination and may impose sanctions, including, but not limited to, fines, penalties, the withholding of payments, special requirements, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Condition Fifteen of 56 contractor counties of Short-Doyle funding were tested and seven had not submitted their cost reports by the December 31 due date. Two of the seven contractor counties had not submitted their cost reports for fiscal year 2019-20 (more than 12 months late) and five of the seven contractor counties have subsequently submitted their cost reports for fiscal year 2020-21. Although the Mental Health Division of Health Care Services did take the required action of notifying the seven contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2020-007 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Medical Assistance Program to the seven noncompliant contractor counties totaled $990,507,492, the 15 tested contractor counties totaled $1,766,996,894, and all 56 contractor counties totaled $2,189,728,183. For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven noncompliant contractor counties totaled $99,333,754, the 15 tested contractor counties totaled $183,713,347, and all 56 contractor counties totaled $215,971,858. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-008 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year.   §14712: (e) Whenever the department determines that a mental health plan has failed to comply with this chapter or any regulations, contractual requirements, state plan, or waivers adopted pursuant to this chapter, the department shall notify the mental health plan in writing within 30 days of its determination and may impose sanctions, including, but not limited to, fines, penalties, the withholding of payments, special requirements, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Condition Fifteen of 56 contractor counties of Short-Doyle funding were tested and seven had not submitted their cost reports by the December 31 due date. Two of the seven contractor counties had not submitted their cost reports for fiscal year 2019-20 (more than 12 months late) and five of the seven contractor counties have subsequently submitted their cost reports for fiscal year 2020-21. Although the Mental Health Division of Health Care Services did take the required action of notifying the seven contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2020-007 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Medical Assistance Program to the seven noncompliant contractor counties totaled $990,507,492, the 15 tested contractor counties totaled $1,766,996,894, and all 56 contractor counties totaled $2,189,728,183. For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven noncompliant contractor counties totaled $99,333,754, the 15 tested contractor counties totaled $183,713,347, and all 56 contractor counties totaled $215,971,858. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-008 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year.   §14712: (e) Whenever the department determines that a mental health plan has failed to comply with this chapter or any regulations, contractual requirements, state plan, or waivers adopted pursuant to this chapter, the department shall notify the mental health plan in writing within 30 days of its determination and may impose sanctions, including, but not limited to, fines, penalties, the withholding of payments, special requirements, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Condition Fifteen of 56 contractor counties of Short-Doyle funding were tested and seven had not submitted their cost reports by the December 31 due date. Two of the seven contractor counties had not submitted their cost reports for fiscal year 2019-20 (more than 12 months late) and five of the seven contractor counties have subsequently submitted their cost reports for fiscal year 2020-21. Although the Mental Health Division of Health Care Services did take the required action of notifying the seven contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2020-007 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Medical Assistance Program to the seven noncompliant contractor counties totaled $990,507,492, the 15 tested contractor counties totaled $1,766,996,894, and all 56 contractor counties totaled $2,189,728,183. For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven noncompliant contractor counties totaled $99,333,754, the 15 tested contractor counties totaled $183,713,347, and all 56 contractor counties totaled $215,971,858. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-008 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year.   §14712: (e) Whenever the department determines that a mental health plan has failed to comply with this chapter or any regulations, contractual requirements, state plan, or waivers adopted pursuant to this chapter, the department shall notify the mental health plan in writing within 30 days of its determination and may impose sanctions, including, but not limited to, fines, penalties, the withholding of payments, special requirements, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Condition Fifteen of 56 contractor counties of Short-Doyle funding were tested and seven had not submitted their cost reports by the December 31 due date. Two of the seven contractor counties had not submitted their cost reports for fiscal year 2019-20 (more than 12 months late) and five of the seven contractor counties have subsequently submitted their cost reports for fiscal year 2020-21. Although the Mental Health Division of Health Care Services did take the required action of notifying the seven contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2020-007 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Medical Assistance Program to the seven noncompliant contractor counties totaled $990,507,492, the 15 tested contractor counties totaled $1,766,996,894, and all 56 contractor counties totaled $2,189,728,183. For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven noncompliant contractor counties totaled $99,333,754, the 15 tested contractor counties totaled $183,713,347, and all 56 contractor counties totaled $215,971,858. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-009 Category of Finding: Cash Management Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.917 Federal Program Title: HIV Care Formula Grants Federal Award Numbers and Years: 2 X08HA28020-06; 2020 2 X08HA28020-07; 2021 5 X07HA12778-12, 2020 5 X07HA12778-13, 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.305 - Payment (2 CFR 200.305): (a) For states, payments are governed by Treasury-State CMIA agreements and default procedures codified at 31 CFR Part 205 “Rules and Procedures for Efficient Federal-State Funds Transfers” and TFM 4A-2000 Overall Disbursing Rules for All Federal Agencies. Title 31 – Money and Finance: Treasury. Subtitle B – Regulations Relating to Money and Finance. Chapter II – Fiscal Service, Department of the Treasury. Subchapter A – Bureau of Fiscal Service. Part 205 – Rules and Procedures for Efficient Federal-State Funds Transfers. Subpart B – Rules Applicable to Federal Assistance Programs Not Included in a Treasury-State Agreement. §205.33 How are funds transfers processed? (31 CFR 205.33): (a) A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102 (For availability, see 5 CFR 1310.3.). Condition Out of 25 cash drawdowns reviewed, one sample did not meet the requirements to minimize the timing between Public Health’s Office of AIDS receipt of Federal funds and disbursement of those funds for program purposes. The funds from this drawdown were designated to pay 33 vendor invoices. However, payments for 23 of these invoices were made between 16 to 175 days after the drawdown occurred. One invoice was paid 598 days after the date of the drawdown. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Public Health’s Office of AIDS redirected staff, including manager level positions, to help with other assignments during the year. Furthermore, there were delays due to the challenges presented by the increased demand of processing payments associated with substantial new COVID-19 funding. Effect When the necessary oversight and monitoring of cash drawdowns is insufficient, Public Health has an increased risk of not disbursing Federal award funds in a timely manner. Questioned Costs No questioned costs were identified. Context Public Health administered 157 Federal fund drawdowns for HIV Care Formula Grants program expenditures during the fiscal year ended June 30, 2021. Our sample of 25 drawdowns totaled $41,615,273. The one drawdown in question was for $1,229,031, which included $1,007,896 in invoices that were paid in 16 or more days after the date of the drawdown. The sample was not a statistically valid sample. Recommendation The Public Heath’s Office of AIDS should continue to monitor compliance with its policies to ensure staff follow established guidelines to minimize the timing between drawdown and disbursement of Federal funds. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-010 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter D - State Children’s Health Insurance Program (SCHIPs), Part 457 - Allotments and Grants to States, Subpart C - State Plan Requirements: Eligibility, Screening, Applications, and Enrollment: § 457.340 Application for and enrollment in CHIP (e) Notice of eligibility determinations: The State must provide each applicant or enrollee with timely and adequate written notice of any decision affecting his or her eligibility, including an approval, denial or termination, or suspension of eligibility, consistent with §§ 457.315, 457.348, and 457.350. The notice must be written in plain language; and accessible to persons who are limited English proficient and individuals with disabilities, consistent with § 435.905(b) of this chapter and § 457.110. 42 CFR § 457.353 - Monitoring and evaluation of screening process States must establish a mechanism and monitor to evaluate the screen and enroll process described at § 457.350 of this subpart to ensure that children who are: (a) Screened as potentially eligible for other insurance affordability programs are enrolled in such programs, if eligible; or (b) Determined ineligible for other insurance affordability programs are enrolled in CHIP, if eligible. Condition Out of 40 Children’s Health Insurance Program (CHIP) beneficiaries tested, there was one beneficiary where the transaction sent to terminate eligibility failed and eligibility continued in error, and one instance where the beneficiary remained in a transitional aid code for an extended period. Through subawards, Health Care Services has delegated performance of eligibility determinations to California county welfare agencies that collect and record this information in their respective eligibility systems (collectively known as the Statewide Automated Welfare System [SAWS]) and the California Healthcare Eligibility, Enrollment, and Retention System (CalHEERS), which transmit eligibility data to the Health Care Services’ Medi-Cal Eligibility Data System (MEDS). Health Care Services then pays: (1) managed care plans monthly to provide eligible services for beneficiaries (Managed Care); (2) medical providers for services provided directly to beneficiaries (Fee for Service), and (3) the U.S. Centers for Medicare and Medicaid Services (CMS) for Medicare premiums (Premiums). Supplemental Information to Provide Additional Perspective on the Condition In addition to the above exceptions noted during this audit, in February 2018, the U.S. Department of Health and Human Services Office of Inspector General (OIG) issued a report titled “California Made Medicaid Payments on Behalf of Newly Eligible Beneficiaries Who Did Not Meet Federal and State Requirements.” The OIG sampled 150 beneficiaries and found California made Medicaid payments on behalf of 112 eligible beneficiaries. However, for the remaining 38 beneficiaries, California made payments on behalf of ineligible and potentially ineligible beneficiaries. On the basis of the OIG’s sample results, they estimated that California made Medi-Cal payments of $738.2 million ($628.8 million Federal share) on behalf of 366,078 ineligible beneficiaries and $416.5 million ($402.4 million Federal share) on behalf of 79,055 potentially ineligible beneficiaries. These deficiencies occurred because, at the time, California’s eligibility systems lacked the necessary system functionality and county welfare agencies’ eligibility caseworkers made errors. In October 2018, the California State Auditor (CSA) issued a report titled “Department of Health Care Services: It Paid Billions in Questionable Medi-Cal Premiums and Claims Because It Failed to Follow Up on Eligibility Discrepancies.” This report presents the results of CSA’s high risk audit concerning $4 billion (includes both Federal and State funding) in questionable Medi-Cal payments that Health Care Services made from 2014 through 2017 because it failed to ensure that counties resolved discrepancies between SAWS/CalHEERS and MEDS. Both of these reports came to the attention of the United States Senate Committee on Homeland Security and Governmental Affairs, which requested CMS’ plans to address the findings noted in these reports. CMS conducted a review of California’s Medicaid beneficiary eligibility system to assess the accuracy of eligibility determinations and Federal Medical Assistance Percentage (FMAP) claiming. One of the primary objectives of this review was to compare review findings to similar reviews conducted in the past by the OIG to ensure the identified findings have been addressed. However, due to the Coronavirus Disease of 2019 (COVID-19), the release of the draft report of the review has been delayed. It should also be noted that due to COVID-19, the Secretary of Health and Human Services declared a Public Health Emergency (PHE) that was effective January 27, 2020. On March 13, 2020, the President of the United States of America declared a National Emergency, retroactive to March 1, 2020, due to COVID-19. As a result of the President’s declaration, CMS issued a federal directive granting states an exception for meeting the periodic renewal requirements for cases that were up for redetermination as of March 1, 2020 through the end of the PHE. This exemption prevents states from denying or terminating eligibility or reducing benefits to Medi-Cal and CHIP beneficiaries during the PHE unless the beneficiary dies, no longer is a state resident, is a non-MAGI Medi-Cal individual moving from a non-Long-Term Care (LTC) aid code into a LTC aid code, or voluntarily discontinues their eligibility. After the month in which the PHE is declared over, states will be given an ample period of time to complete all renewals and redeterminations. As a result of COVID-19, the periodic renewal requirements were not tested for the fiscal year ended June 30, 2021. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of benefits provided to ineligible beneficiaries for the following reasons. • The MEDS alert functionality is used to communicate information to county welfare agencies on changes in beneficiary circumstance, i.e., exceeding the age threshold for the assigned aid category, and discrepancies between eligibility systems, and MEDS. MEDS alerts will be triggered for various reasons that include:  Problems encountered in processing updates submitted by county welfare agencies;  Problems encountered in processing updates generated as a result of a reconciliation of county welfare agencies records with MEDS records;  Updates submitted by other entities that impact beneficiaries’ eligibility or require action by county welfare agencies; and  Upcoming changes in a beneficiaries’ status that will require action by county welfare agencies. Health Care Services did not have an established process for monitoring the county welfare agencies’ progress in addressing these alerts, which created the runaway MEDS issue. • The process to ensure that individuals do not remain in a transitional aid code past the allotted time was not followed. Effect One of the two CHIP beneficiaries with eligibility exceptions was determined to be ineligible and benefits were not discontinued during the fiscal year; therefore, the individual received ineligible benefits from the date the individual should have been discontinued. The second CHIP beneficiary with eligibility exception was not transitioned from a transitional aid code to a regular program code, if eligible, or discontinued. Questioned Costs Benefits paid to the CHIP beneficiary after the beneficiary was determined to be ineligible and the CHIP beneficiary without supporting eligibility documentation totaled $3,752 ($3,208 Managed Care and $544 Fee for Service) for the fiscal year ended June 30, 2021. Context A total of $2,163 ($2,163 Managed Care, $0 Fee for Service, and $0 Premiums) was disbursed during the fiscal year ended June 30, 2021 on behalf of one beneficiary later determined to be ineligible. A total of $1,589 ($1,045 Managed Care and $544 Fee for Service) was disbursed during the fiscal year ended June 30, 2021 on behalf of one beneficiary who did not have any documents supporting the eligibility. Total benefits paid on behalf of the 40 CHIP beneficiaries tested were $45,075 ($36,733 Managed Care and $8,342 Fee for Service). The 40 tested CHIP beneficiaries were selected from ten of California’s 58 counties. The total federal CHIP benefits paid on behalf of approximately 1.5 million beneficiaries for the fiscal year ended June 30, 2021 was $2,550,506,655 ($2,058,210,982 for Managed Care and $492,295,673 Fee for Service). The sample was not a statistically valid sample. Recommendation Health Care Services should continue with the quality control process used to monitor all MEDS alerts to ensure that the system has a process of identifying and alerting caseworkers to the review of beneficiaries that may be still receiving benefits when deemed ineligible. Health Care Services should continue its efforts to utilize focus reviews to assess counties’ risk of delays in renewal activities. Health Care Services should then work directly with those county welfare agencies to implement policies and procedures to improve their compliance status. Health Care Services should ensure there are controls in place to ensure all beneficiaries have the proper supporting documentation to be eligible. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-010 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter D - State Children’s Health Insurance Program (SCHIPs), Part 457 - Allotments and Grants to States, Subpart C - State Plan Requirements: Eligibility, Screening, Applications, and Enrollment: § 457.340 Application for and enrollment in CHIP (e) Notice of eligibility determinations: The State must provide each applicant or enrollee with timely and adequate written notice of any decision affecting his or her eligibility, including an approval, denial or termination, or suspension of eligibility, consistent with §§ 457.315, 457.348, and 457.350. The notice must be written in plain language; and accessible to persons who are limited English proficient and individuals with disabilities, consistent with § 435.905(b) of this chapter and § 457.110. 42 CFR § 457.353 - Monitoring and evaluation of screening process States must establish a mechanism and monitor to evaluate the screen and enroll process described at § 457.350 of this subpart to ensure that children who are: (a) Screened as potentially eligible for other insurance affordability programs are enrolled in such programs, if eligible; or (b) Determined ineligible for other insurance affordability programs are enrolled in CHIP, if eligible. Condition Out of 40 Children’s Health Insurance Program (CHIP) beneficiaries tested, there was one beneficiary where the transaction sent to terminate eligibility failed and eligibility continued in error, and one instance where the beneficiary remained in a transitional aid code for an extended period. Through subawards, Health Care Services has delegated performance of eligibility determinations to California county welfare agencies that collect and record this information in their respective eligibility systems (collectively known as the Statewide Automated Welfare System [SAWS]) and the California Healthcare Eligibility, Enrollment, and Retention System (CalHEERS), which transmit eligibility data to the Health Care Services’ Medi-Cal Eligibility Data System (MEDS). Health Care Services then pays: (1) managed care plans monthly to provide eligible services for beneficiaries (Managed Care); (2) medical providers for services provided directly to beneficiaries (Fee for Service), and (3) the U.S. Centers for Medicare and Medicaid Services (CMS) for Medicare premiums (Premiums). Supplemental Information to Provide Additional Perspective on the Condition In addition to the above exceptions noted during this audit, in February 2018, the U.S. Department of Health and Human Services Office of Inspector General (OIG) issued a report titled “California Made Medicaid Payments on Behalf of Newly Eligible Beneficiaries Who Did Not Meet Federal and State Requirements.” The OIG sampled 150 beneficiaries and found California made Medicaid payments on behalf of 112 eligible beneficiaries. However, for the remaining 38 beneficiaries, California made payments on behalf of ineligible and potentially ineligible beneficiaries. On the basis of the OIG’s sample results, they estimated that California made Medi-Cal payments of $738.2 million ($628.8 million Federal share) on behalf of 366,078 ineligible beneficiaries and $416.5 million ($402.4 million Federal share) on behalf of 79,055 potentially ineligible beneficiaries. These deficiencies occurred because, at the time, California’s eligibility systems lacked the necessary system functionality and county welfare agencies’ eligibility caseworkers made errors. In October 2018, the California State Auditor (CSA) issued a report titled “Department of Health Care Services: It Paid Billions in Questionable Medi-Cal Premiums and Claims Because It Failed to Follow Up on Eligibility Discrepancies.” This report presents the results of CSA’s high risk audit concerning $4 billion (includes both Federal and State funding) in questionable Medi-Cal payments that Health Care Services made from 2014 through 2017 because it failed to ensure that counties resolved discrepancies between SAWS/CalHEERS and MEDS. Both of these reports came to the attention of the United States Senate Committee on Homeland Security and Governmental Affairs, which requested CMS’ plans to address the findings noted in these reports. CMS conducted a review of California’s Medicaid beneficiary eligibility system to assess the accuracy of eligibility determinations and Federal Medical Assistance Percentage (FMAP) claiming. One of the primary objectives of this review was to compare review findings to similar reviews conducted in the past by the OIG to ensure the identified findings have been addressed. However, due to the Coronavirus Disease of 2019 (COVID-19), the release of the draft report of the review has been delayed. It should also be noted that due to COVID-19, the Secretary of Health and Human Services declared a Public Health Emergency (PHE) that was effective January 27, 2020. On March 13, 2020, the President of the United States of America declared a National Emergency, retroactive to March 1, 2020, due to COVID-19. As a result of the President’s declaration, CMS issued a federal directive granting states an exception for meeting the periodic renewal requirements for cases that were up for redetermination as of March 1, 2020 through the end of the PHE. This exemption prevents states from denying or terminating eligibility or reducing benefits to Medi-Cal and CHIP beneficiaries during the PHE unless the beneficiary dies, no longer is a state resident, is a non-MAGI Medi-Cal individual moving from a non-Long-Term Care (LTC) aid code into a LTC aid code, or voluntarily discontinues their eligibility. After the month in which the PHE is declared over, states will be given an ample period of time to complete all renewals and redeterminations. As a result of COVID-19, the periodic renewal requirements were not tested for the fiscal year ended June 30, 2021. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of benefits provided to ineligible beneficiaries for the following reasons. • The MEDS alert functionality is used to communicate information to county welfare agencies on changes in beneficiary circumstance, i.e., exceeding the age threshold for the assigned aid category, and discrepancies between eligibility systems, and MEDS. MEDS alerts will be triggered for various reasons that include:  Problems encountered in processing updates submitted by county welfare agencies;  Problems encountered in processing updates generated as a result of a reconciliation of county welfare agencies records with MEDS records;  Updates submitted by other entities that impact beneficiaries’ eligibility or require action by county welfare agencies; and  Upcoming changes in a beneficiaries’ status that will require action by county welfare agencies. Health Care Services did not have an established process for monitoring the county welfare agencies’ progress in addressing these alerts, which created the runaway MEDS issue. • The process to ensure that individuals do not remain in a transitional aid code past the allotted time was not followed. Effect One of the two CHIP beneficiaries with eligibility exceptions was determined to be ineligible and benefits were not discontinued during the fiscal year; therefore, the individual received ineligible benefits from the date the individual should have been discontinued. The second CHIP beneficiary with eligibility exception was not transitioned from a transitional aid code to a regular program code, if eligible, or discontinued. Questioned Costs Benefits paid to the CHIP beneficiary after the beneficiary was determined to be ineligible and the CHIP beneficiary without supporting eligibility documentation totaled $3,752 ($3,208 Managed Care and $544 Fee for Service) for the fiscal year ended June 30, 2021. Context A total of $2,163 ($2,163 Managed Care, $0 Fee for Service, and $0 Premiums) was disbursed during the fiscal year ended June 30, 2021 on behalf of one beneficiary later determined to be ineligible. A total of $1,589 ($1,045 Managed Care and $544 Fee for Service) was disbursed during the fiscal year ended June 30, 2021 on behalf of one beneficiary who did not have any documents supporting the eligibility. Total benefits paid on behalf of the 40 CHIP beneficiaries tested were $45,075 ($36,733 Managed Care and $8,342 Fee for Service). The 40 tested CHIP beneficiaries were selected from ten of California’s 58 counties. The total federal CHIP benefits paid on behalf of approximately 1.5 million beneficiaries for the fiscal year ended June 30, 2021 was $2,550,506,655 ($2,058,210,982 for Managed Care and $492,295,673 Fee for Service). The sample was not a statistically valid sample. Recommendation Health Care Services should continue with the quality control process used to monitor all MEDS alerts to ensure that the system has a process of identifying and alerting caseworkers to the review of beneficiaries that may be still receiving benefits when deemed ineligible. Health Care Services should continue its efforts to utilize focus reviews to assess counties’ risk of delays in renewal activities. Health Care Services should then work directly with those county welfare agencies to implement policies and procedures to improve their compliance status. Health Care Services should ensure there are controls in place to ensure all beneficiaries have the proper supporting documentation to be eligible. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-011 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.917 Federal Program Title: HIV Care Formula Grants Federal Award Numbers and Years: 5 X07HA12778-12; 2020 5 X07HA12778-13; 2021 2 X09HA28342-06; 2020 2 X09HA28342-07; 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - The Public Health and Welfare. Chapter 6A - Public Health Service. Subchapter XXIV - HIV Health Care Services Program. Part B - Care Grant Program. Subpart I - General Grant Provisions. Section 300ff-26 - Provision of Treatments: (a) In general A State shall use a portion of the amounts provided under a grant awarded under section 300ff–21 of this title to establish a program under section 300ff–22(b)(3)(B) of this title to provide therapeutics to treat HIV/AIDS or prevent the serious deterioration of health arising from HIV/AIDS in eligible individuals, including measures for the prevention and treatment of opportunistic infections. (b) Eligible individual To be eligible to receive assistance from a State under this section an individual shall: (1) Have a medical diagnosis of HIV/AIDS; and (2) Be a low-income individual, as defined by the State.   California State AIDS Drug Assistance Program Guidelines December 2018 and April 2020: (1.1) AIDS Drug Assistance Program (ADAP) Eligibility Criteria: To be eligible for the ADAP program, a client must: • Have a positive HIV/AIDS diagnosis. • Be at least 18 years old. • Be a resident of California. • Have an annual Modified Adjusted Gross Income (MAGI) that does not exceed 500 percent Federal Poverty Level (FPL) based on household size and income. • Not be fully covered by Medi-Cal or any other third-party payers (an entity that reimburses and manages health care expenses such as private insurance or governmental agencies, employers, etc.). Health Resources and Services Administration (HRSA) Policy Clarification Notice (PCN) 13-02 (Revised 5/1/2019): For both initial/annual and six-month recertification procedures, eligibility determinations may be performed simultaneously with testing and treatment. Recipients and subrecipients assume the risk of recouping any HRSA RWHAP funds utilized for clients ultimately determined to be ineligible, and instead charge an alternate payment source, or otherwise ensure that funds are returned to the HRSA RWHAP program. HRSA PCN 15-04 (Revised 1/11/2019): The RWHAP legislation requires that rebates collected on ADAP medication purchases be applied to the RWHAP Part B Program with a priority, but not a requirement, that the rebates be placed back into ADAP. Although ADAP rebates are neither program income nor refunds, they are subject to the same regulatory provision regarding expenditure. These rebates must be used for the statutorily permitted purposes under the RWHAP Part B Program, which are limited to core medical services including ADAP, support services, clinical quality management, and administrative expenses (including planning and evaluation) as part of a comprehensive system of care for low-income individuals living with HIV. HRSA PCN 13-02 (Revised 5/1/2019): To maintain eligibility for HRSA RWHAP services, clients must be recertified at least every six months. The primary purposes of the recertification process are to ensure that an individual’s residency, income, and insurance statuses continue to meet the recipient eligibility requirements and to verify that the HRSA RWHAP is the payor of last resort. The recertification process includes checking for the availability of all other third party payers. Recipients have flexibility with regard to timing and process, especially in consideration of health care coverage enrollment periods, but all recipients across all Parts must engage in eligibility determination and recertification. Condition Our sample of 60 participants from a population of 28,417 participants who received benefits during the fiscal year identified 1 participant’s annual recertification was not conducted in a timely manner and 16 participants who did not submit all required documentation, including proof of HIV/AIDS diagnosis, proof of residency, and income documentation to verify their annual MAGI did not exceed 500 percent Federal Poverty Level based on household size and income. Identification as a Repeat Finding With the exception of the one instance of untimely annual recertification, finding 2020-009 was reported in the immediate prior year pertaining to not submitting all required documentation. Cause Procedures that required the collection of valid supporting documents were not followed. Existing internal controls did not prevent, or detect and correct, the occurrence of benefits being provided to potentially ineligible individuals. Effect Public Health did not have adequate oversight controls to ensure that the applicant’s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals that may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable because benefit costs were not tracked by individual participants. Context Pharmacy benefits management services are provided by a contractor who received administrative fees and reimbursements for prescription drug costs to program participants. Payments to the contractor totaled $109,619,714 for approximately 30,000 program participants for the fiscal year ended June 30, 2021. Based on the budget in the contract, the contractor’s administrative fees and other charges are estimated to be $237,759 annually. As such, net prescription drug costs are approximately $109,381,955 for the fiscal year ended June 30, 2021. The sample was not a statistically valid sample. Recommendation The ADAP Branch should continue to monitor compliance with its policies to ensure enrollment workers and secondary reviews of ADAP applications follow the established guidelines and retain acceptable documentation to support eligibility determinations and timely annual recertification. Applications that have been granted an eligibility exception (i.e., Temporary Access Period, Medi-Cal Eligibility Exception Request, or Eligibility Exception Request) should be reviewed in a timely manner to ensure clients who do not provide the required documentation within the approved extension period are disenrolled in a timely manner. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-012 Category of Finding: Reporting Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department California Department of Aging (Aging) Assistance Listing Number: 93.044 Federal Program Title: Special Programs for the Aging, Title III, Part B, Grants for Supportive Services and Senior Centers Federal Award Number and Year: 2101CAOASS-00; 2020 Assistance Listing Number: 93.045 Federal Program Title: Special Programs for the Aging, Title III, Part C, Nutrition Services Federal Award Numbers and Year: 2101CAOAHD-00; 2020 2101CAOACM-00; 2020 Assistance Listing Number: 93.053 Federal Program Title: Nutrition Services Incentive Program Federal Award Number and Year: 2101CAOANS-00; 2020 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Aging Cluster for the fiscal year ended June 30, 2021, pertaining to 7 subrecipients of federal funds out of a population of 33. The required FFATA reporting submissions pertaining to these subawards were made; however, the submission occurred in July 2022, 21 months after the official submission due date. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Aging had delays in the submission process for its FFATA reporting due primarily to COVID-19 and the need for additional focus and efforts to address the pandemic. Questioned Costs Aging’s FFATA reporting for the 7 subawards examined was accurately completed and there were no identified questioned costs. Context During the fiscal year 2020-21, Aging passed through federal funds totaling $71,894,700 to the 7 subrecipients, with the total passed through to all subrecipients totaling $153,585,190. The sample was not a statistically valid sample. Effect First-tier recipients of federal funds must report subawards greater than $30,000 under the FFATA requirements. These submissions are due by the end of the month following the month in which the subaward obligation is made. By not completing the submission by the applicable due dates, Aging was not in compliance with the provisions of the FFATA reporting requirements. Recommendation We recommend that Aging update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-012 Category of Finding: Reporting Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department California Department of Aging (Aging) Assistance Listing Number: 93.044 Federal Program Title: Special Programs for the Aging, Title III, Part B, Grants for Supportive Services and Senior Centers Federal Award Number and Year: 2101CAOASS-00; 2020 Assistance Listing Number: 93.045 Federal Program Title: Special Programs for the Aging, Title III, Part C, Nutrition Services Federal Award Numbers and Year: 2101CAOAHD-00; 2020 2101CAOACM-00; 2020 Assistance Listing Number: 93.053 Federal Program Title: Nutrition Services Incentive Program Federal Award Number and Year: 2101CAOANS-00; 2020 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Aging Cluster for the fiscal year ended June 30, 2021, pertaining to 7 subrecipients of federal funds out of a population of 33. The required FFATA reporting submissions pertaining to these subawards were made; however, the submission occurred in July 2022, 21 months after the official submission due date. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Aging had delays in the submission process for its FFATA reporting due primarily to COVID-19 and the need for additional focus and efforts to address the pandemic. Questioned Costs Aging’s FFATA reporting for the 7 subawards examined was accurately completed and there were no identified questioned costs. Context During the fiscal year 2020-21, Aging passed through federal funds totaling $71,894,700 to the 7 subrecipients, with the total passed through to all subrecipients totaling $153,585,190. The sample was not a statistically valid sample. Effect First-tier recipients of federal funds must report subawards greater than $30,000 under the FFATA requirements. These submissions are due by the end of the month following the month in which the subaward obligation is made. By not completing the submission by the applicable due dates, Aging was not in compliance with the provisions of the FFATA reporting requirements. Recommendation We recommend that Aging update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-012 Category of Finding: Reporting Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department California Department of Aging (Aging) Assistance Listing Number: 93.044 Federal Program Title: Special Programs for the Aging, Title III, Part B, Grants for Supportive Services and Senior Centers Federal Award Number and Year: 2101CAOASS-00; 2020 Assistance Listing Number: 93.045 Federal Program Title: Special Programs for the Aging, Title III, Part C, Nutrition Services Federal Award Numbers and Year: 2101CAOAHD-00; 2020 2101CAOACM-00; 2020 Assistance Listing Number: 93.053 Federal Program Title: Nutrition Services Incentive Program Federal Award Number and Year: 2101CAOANS-00; 2020 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Aging Cluster for the fiscal year ended June 30, 2021, pertaining to 7 subrecipients of federal funds out of a population of 33. The required FFATA reporting submissions pertaining to these subawards were made; however, the submission occurred in July 2022, 21 months after the official submission due date. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Aging had delays in the submission process for its FFATA reporting due primarily to COVID-19 and the need for additional focus and efforts to address the pandemic. Questioned Costs Aging’s FFATA reporting for the 7 subawards examined was accurately completed and there were no identified questioned costs. Context During the fiscal year 2020-21, Aging passed through federal funds totaling $71,894,700 to the 7 subrecipients, with the total passed through to all subrecipients totaling $153,585,190. The sample was not a statistically valid sample. Effect First-tier recipients of federal funds must report subawards greater than $30,000 under the FFATA requirements. These submissions are due by the end of the month following the month in which the subaward obligation is made. By not completing the submission by the applicable due dates, Aging was not in compliance with the provisions of the FFATA reporting requirements. Recommendation We recommend that Aging update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-013 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. ii. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Medicaid Cluster and Children’s Health Insurance Program for the fiscal year ended June 30, 2021. The required FFATA reporting submissions pertaining to these subawards were not made. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause DHCS did not submit FFATA reporting because they were not aware of the reporting requirements. Questioned Costs No questioned costs were identified. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. Pass through payments to subrecipients subject to FFATA reporting were $2,298,920,285 for Medicaid and $17,339,837 for CHIP. Effect Failure to report subawards greater than $30,000 under FFATA is considered noncompliance with the transparency requirement established by the federal government. Recommendation We recommend that DHCS update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-013 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. ii. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Medicaid Cluster and Children’s Health Insurance Program for the fiscal year ended June 30, 2021. The required FFATA reporting submissions pertaining to these subawards were not made. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause DHCS did not submit FFATA reporting because they were not aware of the reporting requirements. Questioned Costs No questioned costs were identified. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. Pass through payments to subrecipients subject to FFATA reporting were $2,298,920,285 for Medicaid and $17,339,837 for CHIP. Effect Failure to report subawards greater than $30,000 under FFATA is considered noncompliance with the transparency requirement established by the federal government. Recommendation We recommend that DHCS update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-013 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. ii. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Medicaid Cluster and Children’s Health Insurance Program for the fiscal year ended June 30, 2021. The required FFATA reporting submissions pertaining to these subawards were not made. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause DHCS did not submit FFATA reporting because they were not aware of the reporting requirements. Questioned Costs No questioned costs were identified. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. Pass through payments to subrecipients subject to FFATA reporting were $2,298,920,285 for Medicaid and $17,339,837 for CHIP. Effect Failure to report subawards greater than $30,000 under FFATA is considered noncompliance with the transparency requirement established by the federal government. Recommendation We recommend that DHCS update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-013 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. ii. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Medicaid Cluster and Children’s Health Insurance Program for the fiscal year ended June 30, 2021. The required FFATA reporting submissions pertaining to these subawards were not made. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause DHCS did not submit FFATA reporting because they were not aware of the reporting requirements. Questioned Costs No questioned costs were identified. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. Pass through payments to subrecipients subject to FFATA reporting were $2,298,920,285 for Medicaid and $17,339,837 for CHIP. Effect Failure to report subawards greater than $30,000 under FFATA is considered noncompliance with the transparency requirement established by the federal government. Recommendation We recommend that DHCS update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-014 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.323 Federal Program Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Federal Award Number and Year: NU50CK000539; 2021 Criteria: Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (b) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. §200.332 Requirements for pass-through entities (2 CFR 200.332): All pass-through entities must: (c) Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section§200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. (g) Consider whether the results of the subrecipient’s audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. Condition: Public Health did not establish a formal risk assessment process over its subrecipients of federal awards to determine the frequency and extent of subrecipient monitoring to be performed. While Public Health received reimbursement invoices from subrecipients, there did not appear to be other financial or programmatic monitoring to verify subrecipents compliance with applicable requirements. In addition, Public Health did not obtain Single Audit reports from those subrecipients as required. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause: Public Health failed to identify and report its federal expenditures related to its subrecipient agreement with its bona fide agent. Consequently, required subrecipient monitoring procedures were not designed nor implemented by Public Health. Effect: By not properly evaluating the risk of noncompliance, Public Health may inadvertently award grant funds to subrecipients who lack the necessary mechanisms or understanding to adhere to federal statutes. This increases the likelihood of noncompliance arising during the implementation of the grant-funded activities. Furthermore, failure to perform monitoring procedures or obtain Single Audit reports increases the risk for not properly identifying subrecipient program control weaknesses, noncompliance, and performing sufficient follow-up on any subrecipient corrective action. Questioned Costs: No questioned costs were identified. Context: Disbursements to subrecipients for the ELC program totaled $367,405,431, or 76.5% of total reported program expenditures. Recommendation: Public Health should establish and document formal procedures for conducting risk assessments of its subrecipients, including criteria for evaluating organizational capacity, financial stability, compliance history, and programmatic capabilities. Public Health should also develop and implement specific subrecipient monitoring procedures and establish a process for obtaining single audit reports from its subrecipients. Furthermore, a monitoring mechanism should be implemented to track compliance with the single audit mandate among subrecipients, including regular follow-ups and documentation of communication efforts. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report

Reference Number: 2021-015 Category of Finding: Special Tests and Provisions – Refunding of Federal Share of Medicaid/CHIP Overpayments to Providers Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter C - Medical Assistance Programs, Part 433 - State Fiscal Administration, Subpart F - Refunding of Federal Share of Medicaid Overpayments to Providers: §433.300 Basis (42 CFR 433.300). This subpart implements: (a) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. §433.320 Procedures for refunds to CMS (42 CFR 433.320): (a) Basic requirements: (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of – (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with §433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. Subchapter D – State Children’s Health Insurance Programs (SCHIPs), Part 457 - Allotments and Grants to States, Subpart F - Payment to States: §457.628 Other applicable Federal regulations (42 CFR 457.628): Other regulations applicable to CHIP programs include the following: (a) HHS regulations in §§433.312 through 433.322 of this chapter (related to Overpayments) apply to State's CHIP programs in the same manner as they apply to State's Medicaid programs. Note that while for the Medical Assistance Program, the overpayments of the federal share must be refunded to the Centers for Medicare & Medicaid Services (CMS) via Form CMS-64 Summary, Line 9C1 - Fraud, Waste & Abuse Amounts, for the Children’s Health Insurance Program, the overpayments of the federal share must be refunded to CMS via Form CMS-21 Summary, Line 4 - Adjustments Decreasing Claims - Collections. Condition The Medical Assistance Program reporting of overpayments tested did not reflect the correct federal share because Form CMS-64 included all CHIP overpayments (42 CFR 433.320). All 20 CHIP overpayments tested did not reflect the correct federal share (Federal Financial Participation or FFP rate) and were not correctly reported on Form CMS-21 (42 CFR 433.320 via 42 CFR 457.628). Identification as a Repeat Finding Finding 2020-012 was reported in the immediate prior year. Cause The overpayments for the Medical Assistance Program (Medicaid) and CHIP on the CMS-64 and CMS-21, was due to Health Care Services Claims Processing Accounts Receivable (AR) System’s inability to distinguish between CHIP and Medicaid overpayments. When Audits and Investigations (A&I) identifies an overpayment, they do not distinguish between the two programs. A&I then sends an Action Notice (AN) and the findings of overpayments to the Fiscal Intermediary (FI) to establish an AR on the system with a copy to TPLRD for collection purposes. Once the FI establishes an AR for an overpayment, the overpayment is recorded in the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system (a department-developed application) and is automatically assigned the Medicaid FFP rate in effect upon AR creation. Due to system limitations, the COBRA system automatically assigns the Medicaid FFP rate in effect at AR creation for all overpayments and cannot assign a CHIP FFP rate to a CHIP overpayment. As such, all types of overpayments will utilize the Medicaid FFP rate. Therefore, when it is reported on the CMS-64 and CMS-21, they are allocating all refunds to the CMS-64. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments The incorrect FFP rate being applied to the Children’s Health Insurance Program (CHIP) overpayments was due to the same reason outlined above. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments. Effect Reporting of CHIP overpayments in the Medicaid CMS-64 report and utilizing an incorrect CHIP FFP rate resulted in under/over funding and noncompliance with refunding the Federal share of Medicaid and CHIP overpayments. Questioned Costs Overpayments for Medicaid caused by allocating all CHIP overpayments on the CMS-64 resulted in known questioned costs of $27,994 for the 2020-21 fiscal year. Overpayments for CHIP caused by utilizing the incorrect CHIP FFP rate resulted in known questioned costs of $10,112 for the 2020-21 fiscal year. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. The $27,994 known questioned costs for inaccurate reporting of Medicaid overpayments were identified from a total of $38,717,058 for the 40 Medicaid samples tested. The $10,112 known questioned costs for using the incorrect CHIP FFP rate were identified from a total of $27,994 for the twenty CHIP samples tested. The sample was not a statistically valid sample. Recommendation Health Care Services should have a process in place to ensure that the CMS-64 and CMS-21 reports properly report CHIP and Medicaid overpayments. Health Care Services should update the system to assign the appropriate FFP rate for each overpayment. With this implementation, CHIP overpayments can be appropriately identified with the correct FFP rate and reported on the CMS-21. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-015 Category of Finding: Special Tests and Provisions – Refunding of Federal Share of Medicaid/CHIP Overpayments to Providers Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter C - Medical Assistance Programs, Part 433 - State Fiscal Administration, Subpart F - Refunding of Federal Share of Medicaid Overpayments to Providers: §433.300 Basis (42 CFR 433.300). This subpart implements: (a) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. §433.320 Procedures for refunds to CMS (42 CFR 433.320): (a) Basic requirements: (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of – (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with §433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. Subchapter D – State Children’s Health Insurance Programs (SCHIPs), Part 457 - Allotments and Grants to States, Subpart F - Payment to States: §457.628 Other applicable Federal regulations (42 CFR 457.628): Other regulations applicable to CHIP programs include the following: (a) HHS regulations in §§433.312 through 433.322 of this chapter (related to Overpayments) apply to State's CHIP programs in the same manner as they apply to State's Medicaid programs. Note that while for the Medical Assistance Program, the overpayments of the federal share must be refunded to the Centers for Medicare & Medicaid Services (CMS) via Form CMS-64 Summary, Line 9C1 - Fraud, Waste & Abuse Amounts, for the Children’s Health Insurance Program, the overpayments of the federal share must be refunded to CMS via Form CMS-21 Summary, Line 4 - Adjustments Decreasing Claims - Collections. Condition The Medical Assistance Program reporting of overpayments tested did not reflect the correct federal share because Form CMS-64 included all CHIP overpayments (42 CFR 433.320). All 20 CHIP overpayments tested did not reflect the correct federal share (Federal Financial Participation or FFP rate) and were not correctly reported on Form CMS-21 (42 CFR 433.320 via 42 CFR 457.628). Identification as a Repeat Finding Finding 2020-012 was reported in the immediate prior year. Cause The overpayments for the Medical Assistance Program (Medicaid) and CHIP on the CMS-64 and CMS-21, was due to Health Care Services Claims Processing Accounts Receivable (AR) System’s inability to distinguish between CHIP and Medicaid overpayments. When Audits and Investigations (A&I) identifies an overpayment, they do not distinguish between the two programs. A&I then sends an Action Notice (AN) and the findings of overpayments to the Fiscal Intermediary (FI) to establish an AR on the system with a copy to TPLRD for collection purposes. Once the FI establishes an AR for an overpayment, the overpayment is recorded in the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system (a department-developed application) and is automatically assigned the Medicaid FFP rate in effect upon AR creation. Due to system limitations, the COBRA system automatically assigns the Medicaid FFP rate in effect at AR creation for all overpayments and cannot assign a CHIP FFP rate to a CHIP overpayment. As such, all types of overpayments will utilize the Medicaid FFP rate. Therefore, when it is reported on the CMS-64 and CMS-21, they are allocating all refunds to the CMS-64. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments The incorrect FFP rate being applied to the Children’s Health Insurance Program (CHIP) overpayments was due to the same reason outlined above. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments. Effect Reporting of CHIP overpayments in the Medicaid CMS-64 report and utilizing an incorrect CHIP FFP rate resulted in under/over funding and noncompliance with refunding the Federal share of Medicaid and CHIP overpayments. Questioned Costs Overpayments for Medicaid caused by allocating all CHIP overpayments on the CMS-64 resulted in known questioned costs of $27,994 for the 2020-21 fiscal year. Overpayments for CHIP caused by utilizing the incorrect CHIP FFP rate resulted in known questioned costs of $10,112 for the 2020-21 fiscal year. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. The $27,994 known questioned costs for inaccurate reporting of Medicaid overpayments were identified from a total of $38,717,058 for the 40 Medicaid samples tested. The $10,112 known questioned costs for using the incorrect CHIP FFP rate were identified from a total of $27,994 for the twenty CHIP samples tested. The sample was not a statistically valid sample. Recommendation Health Care Services should have a process in place to ensure that the CMS-64 and CMS-21 reports properly report CHIP and Medicaid overpayments. Health Care Services should update the system to assign the appropriate FFP rate for each overpayment. With this implementation, CHIP overpayments can be appropriately identified with the correct FFP rate and reported on the CMS-21. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-015 Category of Finding: Special Tests and Provisions – Refunding of Federal Share of Medicaid/CHIP Overpayments to Providers Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter C - Medical Assistance Programs, Part 433 - State Fiscal Administration, Subpart F - Refunding of Federal Share of Medicaid Overpayments to Providers: §433.300 Basis (42 CFR 433.300). This subpart implements: (a) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. §433.320 Procedures for refunds to CMS (42 CFR 433.320): (a) Basic requirements: (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of – (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with §433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. Subchapter D – State Children’s Health Insurance Programs (SCHIPs), Part 457 - Allotments and Grants to States, Subpart F - Payment to States: §457.628 Other applicable Federal regulations (42 CFR 457.628): Other regulations applicable to CHIP programs include the following: (a) HHS regulations in §§433.312 through 433.322 of this chapter (related to Overpayments) apply to State's CHIP programs in the same manner as they apply to State's Medicaid programs. Note that while for the Medical Assistance Program, the overpayments of the federal share must be refunded to the Centers for Medicare & Medicaid Services (CMS) via Form CMS-64 Summary, Line 9C1 - Fraud, Waste & Abuse Amounts, for the Children’s Health Insurance Program, the overpayments of the federal share must be refunded to CMS via Form CMS-21 Summary, Line 4 - Adjustments Decreasing Claims - Collections. Condition The Medical Assistance Program reporting of overpayments tested did not reflect the correct federal share because Form CMS-64 included all CHIP overpayments (42 CFR 433.320). All 20 CHIP overpayments tested did not reflect the correct federal share (Federal Financial Participation or FFP rate) and were not correctly reported on Form CMS-21 (42 CFR 433.320 via 42 CFR 457.628). Identification as a Repeat Finding Finding 2020-012 was reported in the immediate prior year. Cause The overpayments for the Medical Assistance Program (Medicaid) and CHIP on the CMS-64 and CMS-21, was due to Health Care Services Claims Processing Accounts Receivable (AR) System’s inability to distinguish between CHIP and Medicaid overpayments. When Audits and Investigations (A&I) identifies an overpayment, they do not distinguish between the two programs. A&I then sends an Action Notice (AN) and the findings of overpayments to the Fiscal Intermediary (FI) to establish an AR on the system with a copy to TPLRD for collection purposes. Once the FI establishes an AR for an overpayment, the overpayment is recorded in the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system (a department-developed application) and is automatically assigned the Medicaid FFP rate in effect upon AR creation. Due to system limitations, the COBRA system automatically assigns the Medicaid FFP rate in effect at AR creation for all overpayments and cannot assign a CHIP FFP rate to a CHIP overpayment. As such, all types of overpayments will utilize the Medicaid FFP rate. Therefore, when it is reported on the CMS-64 and CMS-21, they are allocating all refunds to the CMS-64. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments The incorrect FFP rate being applied to the Children’s Health Insurance Program (CHIP) overpayments was due to the same reason outlined above. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments. Effect Reporting of CHIP overpayments in the Medicaid CMS-64 report and utilizing an incorrect CHIP FFP rate resulted in under/over funding and noncompliance with refunding the Federal share of Medicaid and CHIP overpayments. Questioned Costs Overpayments for Medicaid caused by allocating all CHIP overpayments on the CMS-64 resulted in known questioned costs of $27,994 for the 2020-21 fiscal year. Overpayments for CHIP caused by utilizing the incorrect CHIP FFP rate resulted in known questioned costs of $10,112 for the 2020-21 fiscal year. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. The $27,994 known questioned costs for inaccurate reporting of Medicaid overpayments were identified from a total of $38,717,058 for the 40 Medicaid samples tested. The $10,112 known questioned costs for using the incorrect CHIP FFP rate were identified from a total of $27,994 for the twenty CHIP samples tested. The sample was not a statistically valid sample. Recommendation Health Care Services should have a process in place to ensure that the CMS-64 and CMS-21 reports properly report CHIP and Medicaid overpayments. Health Care Services should update the system to assign the appropriate FFP rate for each overpayment. With this implementation, CHIP overpayments can be appropriately identified with the correct FFP rate and reported on the CMS-21. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-015 Category of Finding: Special Tests and Provisions – Refunding of Federal Share of Medicaid/CHIP Overpayments to Providers Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter C - Medical Assistance Programs, Part 433 - State Fiscal Administration, Subpart F - Refunding of Federal Share of Medicaid Overpayments to Providers: §433.300 Basis (42 CFR 433.300). This subpart implements: (a) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. §433.320 Procedures for refunds to CMS (42 CFR 433.320): (a) Basic requirements: (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of – (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with §433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. Subchapter D – State Children’s Health Insurance Programs (SCHIPs), Part 457 - Allotments and Grants to States, Subpart F - Payment to States: §457.628 Other applicable Federal regulations (42 CFR 457.628): Other regulations applicable to CHIP programs include the following: (a) HHS regulations in §§433.312 through 433.322 of this chapter (related to Overpayments) apply to State's CHIP programs in the same manner as they apply to State's Medicaid programs. Note that while for the Medical Assistance Program, the overpayments of the federal share must be refunded to the Centers for Medicare & Medicaid Services (CMS) via Form CMS-64 Summary, Line 9C1 - Fraud, Waste & Abuse Amounts, for the Children’s Health Insurance Program, the overpayments of the federal share must be refunded to CMS via Form CMS-21 Summary, Line 4 - Adjustments Decreasing Claims - Collections. Condition The Medical Assistance Program reporting of overpayments tested did not reflect the correct federal share because Form CMS-64 included all CHIP overpayments (42 CFR 433.320). All 20 CHIP overpayments tested did not reflect the correct federal share (Federal Financial Participation or FFP rate) and were not correctly reported on Form CMS-21 (42 CFR 433.320 via 42 CFR 457.628). Identification as a Repeat Finding Finding 2020-012 was reported in the immediate prior year. Cause The overpayments for the Medical Assistance Program (Medicaid) and CHIP on the CMS-64 and CMS-21, was due to Health Care Services Claims Processing Accounts Receivable (AR) System’s inability to distinguish between CHIP and Medicaid overpayments. When Audits and Investigations (A&I) identifies an overpayment, they do not distinguish between the two programs. A&I then sends an Action Notice (AN) and the findings of overpayments to the Fiscal Intermediary (FI) to establish an AR on the system with a copy to TPLRD for collection purposes. Once the FI establishes an AR for an overpayment, the overpayment is recorded in the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system (a department-developed application) and is automatically assigned the Medicaid FFP rate in effect upon AR creation. Due to system limitations, the COBRA system automatically assigns the Medicaid FFP rate in effect at AR creation for all overpayments and cannot assign a CHIP FFP rate to a CHIP overpayment. As such, all types of overpayments will utilize the Medicaid FFP rate. Therefore, when it is reported on the CMS-64 and CMS-21, they are allocating all refunds to the CMS-64. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments The incorrect FFP rate being applied to the Children’s Health Insurance Program (CHIP) overpayments was due to the same reason outlined above. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments. Effect Reporting of CHIP overpayments in the Medicaid CMS-64 report and utilizing an incorrect CHIP FFP rate resulted in under/over funding and noncompliance with refunding the Federal share of Medicaid and CHIP overpayments. Questioned Costs Overpayments for Medicaid caused by allocating all CHIP overpayments on the CMS-64 resulted in known questioned costs of $27,994 for the 2020-21 fiscal year. Overpayments for CHIP caused by utilizing the incorrect CHIP FFP rate resulted in known questioned costs of $10,112 for the 2020-21 fiscal year. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. The $27,994 known questioned costs for inaccurate reporting of Medicaid overpayments were identified from a total of $38,717,058 for the 40 Medicaid samples tested. The $10,112 known questioned costs for using the incorrect CHIP FFP rate were identified from a total of $27,994 for the twenty CHIP samples tested. The sample was not a statistically valid sample. Recommendation Health Care Services should have a process in place to ensure that the CMS-64 and CMS-21 reports properly report CHIP and Medicaid overpayments. Health Care Services should update the system to assign the appropriate FFP rate for each overpayment. With this implementation, CHIP overpayments can be appropriately identified with the correct FFP rate and reported on the CMS-21. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-016 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 97.050 Federal Program Title: Presidential Declared Disaster Assistance to Individuals and Households - Other Needs Federal Award Number and Year: 4482DRCASPLW; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - The Public Health and Welfare, Chapter 68, Disaster Relief, Subchapter IV, §5174 Federal assistance to individuals and households: (e) Financial Assistance to Address Other Needs (2) Personal Property, Transportation, and Other Expenses: In accordance with this section, the President, in consultation with the Governor of a State, may provide financial assistance, and, if necessary, direct services, to individuals and households in the State who, as a direct result of a major disaster, have necessary expenses and serious needs in cases in which the individuals and households are unable to meet such expenses or needs through other means. (f) State role (3) Requirements: d. Before approving an application submitted under this section, the President, or the designee of the President, shall institute adequate policies, procedures, and internal controls to prevent waste, fraud, abuse, and program mismanagement for this program and for programs under subsections (c)(1)(B), (c)(4), and (e). The President shall monitor and conduct quality assurance activities on a State or Indian tribal government’s implementation of programs under subsections (c)(1)(B), (c)(4), and (e). If, after approving an application of a State or Indian tribal government submitted under this paragraph, the President determines that the State or Indian tribal government is not administering the program established by this section in a manner satisfactory to the President, the President shall withdraw the approval. Condition During the fiscal year ended June 30, 2021, EDD implemented the Lost Wages Assistance (LWA) program, which was funded through the disaster relief funds from the Federal Emergency Management Agency (FEMA) under the Presidential Memorandum on Authorizing the Other Needs Assistance Program for Major Disaster Declarations Related to Coronavirus Disease 2019 (COVID-19). Under the memorandum, the LWA program was to be administered in accordance with the Robert T. Stafford Disaster Relief and Emergency Assistance Act section 408(e)(2) and (f), Title 42 U.S.C §5174(e)(2), (f). In EDD’s administration of the LWA program, $1,013,541,600 in benefit payments were estimated by EDD to represent potentially fraudulent payments. The estimate was based on data parameters to identify claimants that received benefits which matched imposter fraud for identity or eligibility fraud for misrepresented information. Out of 223 LWA benefit payments tested, 20 claimants were determined to be ineligible for LWA benefits. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of fraud for benefit payments for the following reasons. • There was a significant increase in unemployment claims that overwhelmed EDD’s existing fraud detection processes. • There were insufficient controls in place to prevent or detect fraud associated with benefit payments related to incarceration, identity, and multiple claims from the same address. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to fraudulent claimants. Accordingly, benefit payments were made to fraudulent claimants who were not eligible. Questioned Costs Likely questioned costs were estimated to be $1,013,541,600 for fiscal year 2020-21. Known questioned costs for the 20 claimants determined to be ineligible was $30,000. Context Benefits paid to claimants under the Presidential Declared Disaster Assistance to Individuals and Households - Other Needs for the fiscal year ended June 30, 2021, totaled $6,464,467,210. The LWA program ended in December 2020. The sample was not a statistically valid sample. Recommendation EDD should continue to evaluate and enhance its fraud detection and prevention internal controls, increasing the use of automation features and other analytical tools in an effort to increase efficiency, continue to reduce workload, and enhance detection and timely identification of unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-001 Type of Finding: Material Weakness and Material Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Finance developed the Single Audit Expenditures Reporting Database (Database). Finance developed the Database to include all of the relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Due to the unprecedented impacts from the COVID-19 pandemic, the Employment Development Department (EDD) was unable to timely report to Finance through the Database with accurate and reliable federal cash basis expenditures for its largest federal award programs that it administers, the Unemployment Insurance (ALN 17.225) and Presidential Declared Disaster Assistance to Individuals and Households – Other Needs (ALN 97.050) programs. The delay resulted in Finance being unable to compile and produce a complete and final approved Schedule until December 2022. Although initial estimated expenditure amounts were reported by EDD for both programs, $90.6 billion and $7.5 billion, respectively, the final amounts reported in the Schedule for both programs were ultimately updated to $92.7 billion and $6.5 billion, respectively. Cause Given the substantial increase in claimants seeking assistance under the Unemployment Insurance program resulting from the COVID-19 pandemic, EDD was overwhelmed with the overall administration of the Unemployment Insurance program. Also, EDD was still contending with accounting and control issues from the implementation of the State’s Financial Information System for California (FI$Cal), which replaced the legacy system. Effect The difficulties that EDD encountered from the COVID-19 pandemic and continuing FI$Cal implementation issues, resulted in the late reporting and submission of final federal cash basis expenditures to Finance. The untimely submission limited and constrained Finance from compiling and producing a final complete and accurate Schedule. Questioned Costs Questioned costs were not determinable. Recommendation EDD should continue to evaluate its existing process and controls related to its ability to properly account for, report, and timely submit complete and accurate federal award cash basis expenditures to the Database, which affords Finance the ability to timely compile and produce a final Schedule pursuant to the Uniform Guidance. Views of Responsible Officials and Corrective Action Plan EDD agrees with this finding. The deferred transition to FI$Cal and the difficulties experienced thereafter have continued to cause EDD to be late with submitting year-end financials and its ability to submit timely the cash basis expenditures into the Single Audit Expenditures Reporting Database (Database). In addition, the onset of the COVID-19 pandemic created additional issues which ultimately impacted the EDD’s ability to submit timely year-end financials. However, the EDD is making progress and continues to gain ground in the department’s efforts to follow the State’s deadlines for submitting year-end financials and entering the cash basis expenditures into the Database. By the end of fiscal year 2021-22 and into fiscal year 2022-23, the EDD did a restructuring within the accounting area which realigned workload amongst the units and provided additional resources in critical areas. These changes will have a lasting effect and help the department to be better positioned going forward in processing the accounting workload and ultimately be able to catch up and submit year-end financials and enter the cash basis expenditures into the Database by the State’s deadlines. In addition, the EDD took lessons learned from the fiscal year 2019-20 financial audit to update processes and procedures and applied that knowledge going forward. Also, staff have been participating in various trainings offered by Finance and the Department of FISCal and staff continue to work with the control agencies when issues arise that would impact our accounting functions. While the EDD is still behind, the department is making great progress on catching up. The EDD submitted the last of its fiscal year 2020-21 financials in July 2022 and is targeting to submit the last of its fiscal year 2021-22 financials by the end of March 2023. The EDD’s goal is to submit fiscal year 2022-23 financials by the end of December 2023. Similar to the 2019-20 financial audit, the EDD will take the knowledge learned during the 2020-21 audit season, continue to engage with the control agencies, and continue to train and develop staff in order to keep progressing towards the department’s goal of becoming timely with the submission of the year-end financials and entering of the cash basis expenditures into the Database.

Reference Number: 2021-001 Type of Finding: Material Weakness and Material Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Finance developed the Single Audit Expenditures Reporting Database (Database). Finance developed the Database to include all of the relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Due to the unprecedented impacts from the COVID-19 pandemic, the Employment Development Department (EDD) was unable to timely report to Finance through the Database with accurate and reliable federal cash basis expenditures for its largest federal award programs that it administers, the Unemployment Insurance (ALN 17.225) and Presidential Declared Disaster Assistance to Individuals and Households – Other Needs (ALN 97.050) programs. The delay resulted in Finance being unable to compile and produce a complete and final approved Schedule until December 2022. Although initial estimated expenditure amounts were reported by EDD for both programs, $90.6 billion and $7.5 billion, respectively, the final amounts reported in the Schedule for both programs were ultimately updated to $92.7 billion and $6.5 billion, respectively. Cause Given the substantial increase in claimants seeking assistance under the Unemployment Insurance program resulting from the COVID-19 pandemic, EDD was overwhelmed with the overall administration of the Unemployment Insurance program. Also, EDD was still contending with accounting and control issues from the implementation of the State’s Financial Information System for California (FI$Cal), which replaced the legacy system. Effect The difficulties that EDD encountered from the COVID-19 pandemic and continuing FI$Cal implementation issues, resulted in the late reporting and submission of final federal cash basis expenditures to Finance. The untimely submission limited and constrained Finance from compiling and producing a final complete and accurate Schedule. Questioned Costs Questioned costs were not determinable. Recommendation EDD should continue to evaluate its existing process and controls related to its ability to properly account for, report, and timely submit complete and accurate federal award cash basis expenditures to the Database, which affords Finance the ability to timely compile and produce a final Schedule pursuant to the Uniform Guidance. Views of Responsible Officials and Corrective Action Plan EDD agrees with this finding. The deferred transition to FI$Cal and the difficulties experienced thereafter have continued to cause EDD to be late with submitting year-end financials and its ability to submit timely the cash basis expenditures into the Single Audit Expenditures Reporting Database (Database). In addition, the onset of the COVID-19 pandemic created additional issues which ultimately impacted the EDD’s ability to submit timely year-end financials. However, the EDD is making progress and continues to gain ground in the department’s efforts to follow the State’s deadlines for submitting year-end financials and entering the cash basis expenditures into the Database. By the end of fiscal year 2021-22 and into fiscal year 2022-23, the EDD did a restructuring within the accounting area which realigned workload amongst the units and provided additional resources in critical areas. These changes will have a lasting effect and help the department to be better positioned going forward in processing the accounting workload and ultimately be able to catch up and submit year-end financials and enter the cash basis expenditures into the Database by the State’s deadlines. In addition, the EDD took lessons learned from the fiscal year 2019-20 financial audit to update processes and procedures and applied that knowledge going forward. Also, staff have been participating in various trainings offered by Finance and the Department of FISCal and staff continue to work with the control agencies when issues arise that would impact our accounting functions. While the EDD is still behind, the department is making great progress on catching up. The EDD submitted the last of its fiscal year 2020-21 financials in July 2022 and is targeting to submit the last of its fiscal year 2021-22 financials by the end of March 2023. The EDD’s goal is to submit fiscal year 2022-23 financials by the end of December 2023. Similar to the 2019-20 financial audit, the EDD will take the knowledge learned during the 2020-21 audit season, continue to engage with the control agencies, and continue to train and develop staff in order to keep progressing towards the department’s goal of becoming timely with the submission of the year-end financials and entering of the cash basis expenditures into the Database.

Reference Number: 2021-001 Type of Finding: Material Weakness and Material Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Finance developed the Single Audit Expenditures Reporting Database (Database). Finance developed the Database to include all of the relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Due to the unprecedented impacts from the COVID-19 pandemic, the Employment Development Department (EDD) was unable to timely report to Finance through the Database with accurate and reliable federal cash basis expenditures for its largest federal award programs that it administers, the Unemployment Insurance (ALN 17.225) and Presidential Declared Disaster Assistance to Individuals and Households – Other Needs (ALN 97.050) programs. The delay resulted in Finance being unable to compile and produce a complete and final approved Schedule until December 2022. Although initial estimated expenditure amounts were reported by EDD for both programs, $90.6 billion and $7.5 billion, respectively, the final amounts reported in the Schedule for both programs were ultimately updated to $92.7 billion and $6.5 billion, respectively. Cause Given the substantial increase in claimants seeking assistance under the Unemployment Insurance program resulting from the COVID-19 pandemic, EDD was overwhelmed with the overall administration of the Unemployment Insurance program. Also, EDD was still contending with accounting and control issues from the implementation of the State’s Financial Information System for California (FI$Cal), which replaced the legacy system. Effect The difficulties that EDD encountered from the COVID-19 pandemic and continuing FI$Cal implementation issues, resulted in the late reporting and submission of final federal cash basis expenditures to Finance. The untimely submission limited and constrained Finance from compiling and producing a final complete and accurate Schedule. Questioned Costs Questioned costs were not determinable. Recommendation EDD should continue to evaluate its existing process and controls related to its ability to properly account for, report, and timely submit complete and accurate federal award cash basis expenditures to the Database, which affords Finance the ability to timely compile and produce a final Schedule pursuant to the Uniform Guidance. Views of Responsible Officials and Corrective Action Plan EDD agrees with this finding. The deferred transition to FI$Cal and the difficulties experienced thereafter have continued to cause EDD to be late with submitting year-end financials and its ability to submit timely the cash basis expenditures into the Single Audit Expenditures Reporting Database (Database). In addition, the onset of the COVID-19 pandemic created additional issues which ultimately impacted the EDD’s ability to submit timely year-end financials. However, the EDD is making progress and continues to gain ground in the department’s efforts to follow the State’s deadlines for submitting year-end financials and entering the cash basis expenditures into the Database. By the end of fiscal year 2021-22 and into fiscal year 2022-23, the EDD did a restructuring within the accounting area which realigned workload amongst the units and provided additional resources in critical areas. These changes will have a lasting effect and help the department to be better positioned going forward in processing the accounting workload and ultimately be able to catch up and submit year-end financials and enter the cash basis expenditures into the Database by the State’s deadlines. In addition, the EDD took lessons learned from the fiscal year 2019-20 financial audit to update processes and procedures and applied that knowledge going forward. Also, staff have been participating in various trainings offered by Finance and the Department of FISCal and staff continue to work with the control agencies when issues arise that would impact our accounting functions. While the EDD is still behind, the department is making great progress on catching up. The EDD submitted the last of its fiscal year 2020-21 financials in July 2022 and is targeting to submit the last of its fiscal year 2021-22 financials by the end of March 2023. The EDD’s goal is to submit fiscal year 2022-23 financials by the end of December 2023. Similar to the 2019-20 financial audit, the EDD will take the knowledge learned during the 2020-21 audit season, continue to engage with the control agencies, and continue to train and develop staff in order to keep progressing towards the department’s goal of becoming timely with the submission of the year-end financials and entering of the cash basis expenditures into the Database.

Reference Number: 2021-002 Type of Finding: Material Weakness and Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. (4) Include the total amount provided to subrecipients from each Federal program. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of 2 CFR 200.510, Finance developed the Single Audit Expenditures Reporting Database (Database) to include all relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Departments are given access to the centralized Database by Finance in order to upload and report federal award information for all federal award programs which they administer. The California Department of Public Health (Public Health) failed to include $479,996,082 of federal expenditures and $367,405,431 of subrecipient expenditures for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program (ALN No. 93.323) in the Database, which Finance uses to prepare the State’s annual Schedule. The error resulted in an additional major program that had to be audited in accordance with the Uniform Guidance and the State having to re-issue its federal compliance audit report for the fiscal year ended June 30, 2021. Cause Public Health entered into a Bona Fide Agent Designation arrangement with Public Health Foundation Enterprises, Inc., dba Heluna Health, for the submission of a grant application under the State of California’s eligibility in lieu of a direct State application for the U.S. Department of Health and Human Services (HHS), Centers for Disease Control and Prevention (CDC) funding opportunity: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Cooperative Agreement. Subsequent to the bona fide agent arrangement, Public Health entered into a separate subrecipient agreement with Heluna Health on March 2, 2021, to provide Heluna Health with certain services related to the performance of its obligations under the ELC program grant award received from HHS. Since Public Health is typically not a subrecipient of federal awards and the accounting control for ELC program revenues and expenditures was established within the State’s General Fund rather than the Federal Trust Fund, which is State standard operating procedure, Public Health failed to identify and report the $479,996,082 of federal expenditures in the Schedule. Effect Because of the ELC program’s inclusion in the State’s Schedule for the fiscal year ended June 30, 2021, the ELC program had to be audited as a major program under requirements of the Uniform Guidance and the State’s federal compliance report had to be reissued. Questioned Costs No questioned costs were identified. Recommendation When infrequent and unusual arrangements occur impacting processes and procedures surrounding federal award programs, Public Health should ensure there is sufficient identification and understanding of the administrative and operational changes from standard operating procedures. Public Health should then design appropriate internal controls commensurate with such changes to ensure adherence to applicable laws and regulations. Views of Responsible Officials and Corrective Action Plan Management's response is reported in "Management's Response and Corrective Action Plan" included in a separate section at the end of this report.

Reference Number: 2021-003 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 10.557 Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children COVID-19 Special Supplemental Nutrition Program for Women, Infants, and Children Federal Award Numbers and Years: 202019W100647; 2020 202020W100347, 2020 202020W100647, 2020 202120W600347, 2021 202120W600647, 2021 202121W100347, 2021 202121W100647, 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 7 – Agriculture. Subtitle B - Regulations of the Department of Agriculture. Chapter II – Food and Nutrition Service, Department of Agriculture. Subchapter A – Child Nutrition Programs. Part 246 - Special Supplemental Nutrition Program for Women, Infants and Children. §246.7 - Certification of participants: (c) Eligibility criteria and basic certification procedures. (1) To qualify for the Program, infants, children, and pregnant, postpartum, and breastfeeding women must: (i) Reside within the jurisdiction of the State (except for Indian State agencies). Indian State agencies may establish a similar requirement. All State agencies may determine a service area for any local agency, and may require that an applicant reside within the service area. However, the State agency may not use length of residency as an eligibility requirement. (ii) Meet the income criteria specified in paragraph (d) of this section. (iii) Meet the nutritional risk criteria specified in paragraph (e) of this section. (2) (i) At certification, the State or local agency must require each applicant to present proof of residency (i.e., location or address where the applicant routinely lives or spends the night) and proof of identity. The State or local agency must also check the identity of participants, or in the case of infants or children, the identity of the parent or guardian, or proxies when issuing food, cash-value vouchers or food instruments. The State agency may authorize the certification of applicants when no proof of residency or identity exists (such as when an applicant or an applicant's parent is a victim of theft, loss, or disaster; a homeless individual; or a migrant farmworker). In these cases, the State or local agency must require the applicant to confirm in writing his/her residency or identity. Further, an individual residing in a remote Indian or Native village or an individual served by an Indian tribal organization and residing on a reservation or pueblo may establish proof of residency by providing the State agency their mailing address and the name of the remote Indian or Native village. (e) Nutritional risk. To be certified as eligible for the Program, applicants who meet the Program's eligibility standards specified in paragraph (c) of this section must be determined to be at nutritional risk. … Nutritional risk data shall be documented in the participant's file and shall be used to assess an applicant's nutritional status and risk; tailor the food package to address nutritional needs; design appropriate nutrition education, including breastfeeding promotion and support; and make referrals to health and social services for follow-up, as necessary and appropriate. (1) Determination of nutritional risk. (ii) Timing of nutritional risk data. (A) Weight and height or length. Weight and height or length shall be measured not more than 60 days prior to certification for program participation. (B) Hematological test for anemia. (1) For pregnant, breastfeeding, and postpartum women, and child applicants, the hematological test for anemia shall be performed or obtained from referral sources at the time of certification or within 90 days of the date of certification. The hematological test for anemia may be deferred for up to 90 days from the time of certification for applicants who have at least one qualifying nutritional risk factor present at the time of certification. If no qualifying risk factor is identified, a hematological test for anemia must be performed or obtained from referral sources (with the exception of presumptively eligible pregnant women). (2) Infants nine months of age and older (who have not already had a hematological test performed, between six and nine months of age, by a competent professional authority or obtained from referral sources), shall between nine and twelve months of age have a hematological test performed or obtained from referral sources. Such a test may be performed more than 90 days after the date of certification. (3) For pregnant women, the hematological test for anemia shall be performed during their pregnancy. For persons certified as postpartum or breastfeeding women, the hematological test for anemia shall be performed after the termination of their pregnancy. For breastfeeding women who are 6-12 months postpartum, no additional blood test is necessary if a test was performed after the termination of their pregnancy. The participant or parent/guardian shall be informed of the test results when there is a finding of anemia, and notations reflecting the outcome of the tests shall be made in the participant's file. Nutrition education, food package tailoring, and referral services shall be provided to the participant or parent/guardian, as necessary and appropriate. Condition During the fiscal year ended June 30, 2020, the Special Supplemental Food Program for Women, Infants and Children (WIC) nutrition program implemented phase 1 of a new management information system known as the Women, Infants, and Children Web Information System Exchange (WIC-WISE) in a two-phased approach to replace the WIC Management Information Systems (WIC-MIS). WIC-WISE is programmed such that updates to eligibility information overwrites existing data. As a result, key data and documentation to support the initial participant eligibility is removed during the recertification process. The California Department of Public Health, WIC Division requested a correction to WIC-WISE to retain eligibility history in the “Cert History Report” when subsequent eligibility information is entered. This correction will be included in a future release targeted for May 2023. As such, the system defect still existed during the fiscal year ended June 30, 2021. Accordingly, sample testing was not performed. Identification as a Repeat Finding Finding 2020-002 was reported in the immediate prior year. Cause The phase 1 implementation of WIC-WISE did not include system functionality to retain historical eligibility documentation when subsequent information was entered during the participant recertification process. Effect The system limitation of WIC-WISE does not allow for the retention of proper documentation of eligibility information. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals, which may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable. Context Total food vouchers disbursed to program participants during the fiscal year ended June 30, 2021, totaled $471,612,402. Recommendation WIC-WISE system updates should be promptly implemented and tested to ensure that participant data and eligibility documentation is appropriately retained within the system. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-003 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 10.557 Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children COVID-19 Special Supplemental Nutrition Program for Women, Infants, and Children Federal Award Numbers and Years: 202019W100647; 2020 202020W100347, 2020 202020W100647, 2020 202120W600347, 2021 202120W600647, 2021 202121W100347, 2021 202121W100647, 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 7 – Agriculture. Subtitle B - Regulations of the Department of Agriculture. Chapter II – Food and Nutrition Service, Department of Agriculture. Subchapter A – Child Nutrition Programs. Part 246 - Special Supplemental Nutrition Program for Women, Infants and Children. §246.7 - Certification of participants: (c) Eligibility criteria and basic certification procedures. (1) To qualify for the Program, infants, children, and pregnant, postpartum, and breastfeeding women must: (i) Reside within the jurisdiction of the State (except for Indian State agencies). Indian State agencies may establish a similar requirement. All State agencies may determine a service area for any local agency, and may require that an applicant reside within the service area. However, the State agency may not use length of residency as an eligibility requirement. (ii) Meet the income criteria specified in paragraph (d) of this section. (iii) Meet the nutritional risk criteria specified in paragraph (e) of this section. (2) (i) At certification, the State or local agency must require each applicant to present proof of residency (i.e., location or address where the applicant routinely lives or spends the night) and proof of identity. The State or local agency must also check the identity of participants, or in the case of infants or children, the identity of the parent or guardian, or proxies when issuing food, cash-value vouchers or food instruments. The State agency may authorize the certification of applicants when no proof of residency or identity exists (such as when an applicant or an applicant's parent is a victim of theft, loss, or disaster; a homeless individual; or a migrant farmworker). In these cases, the State or local agency must require the applicant to confirm in writing his/her residency or identity. Further, an individual residing in a remote Indian or Native village or an individual served by an Indian tribal organization and residing on a reservation or pueblo may establish proof of residency by providing the State agency their mailing address and the name of the remote Indian or Native village. (e) Nutritional risk. To be certified as eligible for the Program, applicants who meet the Program's eligibility standards specified in paragraph (c) of this section must be determined to be at nutritional risk. … Nutritional risk data shall be documented in the participant's file and shall be used to assess an applicant's nutritional status and risk; tailor the food package to address nutritional needs; design appropriate nutrition education, including breastfeeding promotion and support; and make referrals to health and social services for follow-up, as necessary and appropriate. (1) Determination of nutritional risk. (ii) Timing of nutritional risk data. (A) Weight and height or length. Weight and height or length shall be measured not more than 60 days prior to certification for program participation. (B) Hematological test for anemia. (1) For pregnant, breastfeeding, and postpartum women, and child applicants, the hematological test for anemia shall be performed or obtained from referral sources at the time of certification or within 90 days of the date of certification. The hematological test for anemia may be deferred for up to 90 days from the time of certification for applicants who have at least one qualifying nutritional risk factor present at the time of certification. If no qualifying risk factor is identified, a hematological test for anemia must be performed or obtained from referral sources (with the exception of presumptively eligible pregnant women). (2) Infants nine months of age and older (who have not already had a hematological test performed, between six and nine months of age, by a competent professional authority or obtained from referral sources), shall between nine and twelve months of age have a hematological test performed or obtained from referral sources. Such a test may be performed more than 90 days after the date of certification. (3) For pregnant women, the hematological test for anemia shall be performed during their pregnancy. For persons certified as postpartum or breastfeeding women, the hematological test for anemia shall be performed after the termination of their pregnancy. For breastfeeding women who are 6-12 months postpartum, no additional blood test is necessary if a test was performed after the termination of their pregnancy. The participant or parent/guardian shall be informed of the test results when there is a finding of anemia, and notations reflecting the outcome of the tests shall be made in the participant's file. Nutrition education, food package tailoring, and referral services shall be provided to the participant or parent/guardian, as necessary and appropriate. Condition During the fiscal year ended June 30, 2020, the Special Supplemental Food Program for Women, Infants and Children (WIC) nutrition program implemented phase 1 of a new management information system known as the Women, Infants, and Children Web Information System Exchange (WIC-WISE) in a two-phased approach to replace the WIC Management Information Systems (WIC-MIS). WIC-WISE is programmed such that updates to eligibility information overwrites existing data. As a result, key data and documentation to support the initial participant eligibility is removed during the recertification process. The California Department of Public Health, WIC Division requested a correction to WIC-WISE to retain eligibility history in the “Cert History Report” when subsequent eligibility information is entered. This correction will be included in a future release targeted for May 2023. As such, the system defect still existed during the fiscal year ended June 30, 2021. Accordingly, sample testing was not performed. Identification as a Repeat Finding Finding 2020-002 was reported in the immediate prior year. Cause The phase 1 implementation of WIC-WISE did not include system functionality to retain historical eligibility documentation when subsequent information was entered during the participant recertification process. Effect The system limitation of WIC-WISE does not allow for the retention of proper documentation of eligibility information. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals, which may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable. Context Total food vouchers disbursed to program participants during the fiscal year ended June 30, 2021, totaled $471,612,402. Recommendation WIC-WISE system updates should be promptly implemented and tested to ensure that participant data and eligibility documentation is appropriately retained within the system. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-004 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance (HR748/2020) Federal Award Numbers and Year: UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary's “Standard for Fraud and Overpayment Detection,” Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Title 15 - Commerce and Trade, Chapter 116, Coronavirus Economic (CARES Act) Subchapter II - Unemployment Insurance Provisions, §9023 Emergency Increase in Unemployment Compensation Benefits (f) Fraud and Overpayments: (1) In General – If an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact, and as a result of such false statement or representation or of such nondisclosure such individual has received an amount of Federal Pandemic Unemployment Compensation or Mixed Earner Unemployment Compensation to which such individual was not entitled, such individual— (A) shall be ineligible for further Federal Pandemic Unemployment Compensation Mixed Earner Unemployment Compensation in accordance with the provisions of the applicable State unemployment compensation law relating to fraud in connection with a claim for unemployment compensation Condition During the fiscal year ended June 30, 2021, EDD continued its administration of the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA benefits were paid additional benefits under the Federal Pandemic Unemployment Compensation program (FPUC). In EDD’s administration of the PUA and FPUC programs, $17,143,006,979 in benefit payments were estimated to be potentially fraudulent payments. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched imposter fraud for identity or eligibility fraud for misrepresented information. Out of 138 PUA benefit payments tested, there were 26 benefit payments to claimants determined to be potentially fraudulent whose identity was not sufficiently verified. Identification as a Repeat Finding Finding 2020-005 was reported in the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of potential fraud for benefit payments for the following reasons. • There was a significant increase in unemployment claims that overwhelmed EDD’s existing fraud detection process. • There were insufficient controls in place to prevent or detect fraud associated with benefit payments related to incarceration, identity, and multiple claims from the same address. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to fraudulent claimants. Accordingly, benefit payments were made to fraudulent claimants who were not eligible. Questioned Costs Likely questioned costs were estimated to be $17,143,006,979 for fiscal year 2020-21. Known questioned costs were $570,802. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $66,108,457,174. The sample was not a statistically valid sample. Recommendation EDD should continue to evaluate and enhance it fraud detection and prevention internal controls, increasing the use of automation features and other analytical tools in an effort to increase efficiency, continue to reduce workload, and enhance detection and timely identification of unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-004 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance (HR748/2020) Federal Award Numbers and Year: UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary's “Standard for Fraud and Overpayment Detection,” Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Title 15 - Commerce and Trade, Chapter 116, Coronavirus Economic (CARES Act) Subchapter II - Unemployment Insurance Provisions, §9023 Emergency Increase in Unemployment Compensation Benefits (f) Fraud and Overpayments: (1) In General – If an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact, and as a result of such false statement or representation or of such nondisclosure such individual has received an amount of Federal Pandemic Unemployment Compensation or Mixed Earner Unemployment Compensation to which such individual was not entitled, such individual— (A) shall be ineligible for further Federal Pandemic Unemployment Compensation Mixed Earner Unemployment Compensation in accordance with the provisions of the applicable State unemployment compensation law relating to fraud in connection with a claim for unemployment compensation Condition During the fiscal year ended June 30, 2021, EDD continued its administration of the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA benefits were paid additional benefits under the Federal Pandemic Unemployment Compensation program (FPUC). In EDD’s administration of the PUA and FPUC programs, $17,143,006,979 in benefit payments were estimated to be potentially fraudulent payments. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched imposter fraud for identity or eligibility fraud for misrepresented information. Out of 138 PUA benefit payments tested, there were 26 benefit payments to claimants determined to be potentially fraudulent whose identity was not sufficiently verified. Identification as a Repeat Finding Finding 2020-005 was reported in the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of potential fraud for benefit payments for the following reasons. • There was a significant increase in unemployment claims that overwhelmed EDD’s existing fraud detection process. • There were insufficient controls in place to prevent or detect fraud associated with benefit payments related to incarceration, identity, and multiple claims from the same address. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to fraudulent claimants. Accordingly, benefit payments were made to fraudulent claimants who were not eligible. Questioned Costs Likely questioned costs were estimated to be $17,143,006,979 for fiscal year 2020-21. Known questioned costs were $570,802. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $66,108,457,174. The sample was not a statistically valid sample. Recommendation EDD should continue to evaluate and enhance it fraud detection and prevention internal controls, increasing the use of automation features and other analytical tools in an effort to increase efficiency, continue to reduce workload, and enhance detection and timely identification of unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-005 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance (HR748/2021) Federal Award Numbers and Years: UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications, (b) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of § 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (e) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual's statement of employment or self-employment preceding the individual's unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based on the individual's statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual's statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately redetermine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Out of 138 PUA benefit payments tested, there were 4 claimants whose wages were not reduced or suspended due to a lack of wage verification and 8 claimants whose self-employment were not verified. Identification as a Repeat Finding Finding 2020-006 was reported in the immediate prior year. Cause EDD did not perform timely wage verifications of the claimants due to the significant increase in claims resulting from the COVID-19 pandemic. Effect EDD did not have adequate oversight controls to ensure that the claimant’s wages were timely and properly reviewed and approved. Accordingly, there was an increased risk for the occurrence of overpayment in benefits being provided to individuals, which was not timely prevented or detected. Questioned Costs Known questioned costs for the 12 claimants were $325,948. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $66,108,457,174. The sample was not a statistically valid sample. Recommendation EDD should continue to look for ways to enhance its capacity to perform timely wage verifications to ensure accurate eligibility determinations and claimant benefit payments. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-005 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance (HR748/2021) Federal Award Numbers and Years: UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications, (b) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of § 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (e) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual's statement of employment or self-employment preceding the individual's unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based on the individual's statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual's statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately redetermine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Out of 138 PUA benefit payments tested, there were 4 claimants whose wages were not reduced or suspended due to a lack of wage verification and 8 claimants whose self-employment were not verified. Identification as a Repeat Finding Finding 2020-006 was reported in the immediate prior year. Cause EDD did not perform timely wage verifications of the claimants due to the significant increase in claims resulting from the COVID-19 pandemic. Effect EDD did not have adequate oversight controls to ensure that the claimant’s wages were timely and properly reviewed and approved. Accordingly, there was an increased risk for the occurrence of overpayment in benefits being provided to individuals, which was not timely prevented or detected. Questioned Costs Known questioned costs for the 12 claimants were $325,948. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $66,108,457,174. The sample was not a statistically valid sample. Recommendation EDD should continue to look for ways to enhance its capacity to perform timely wage verifications to ensure accurate eligibility determinations and claimant benefit payments. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-006 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: Unemployment Insurance COVID-19 Unemployment Insurance Federal Award Numbers and Years: UI-35637-21-55-A-6; 2021 UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 22 - Social Security, Division 1 - Employment Development Department, Subdivision 1 - Director of Employment Development, Division - 1 Unemployment and Disability Compensation, Part 1 - Unemployment Compensation, Chapter 5 Unemployment Compensation Benefits, Article 1 - Eligibility and Disqualifications §1256 and §1257 Eligibility and Disqualifications, §1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Eligibility and Disqualifications, §1257 California Code of Regulations: (a) An individual is also disqualified for unemployment compensation benefits if: He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division. Condition In EDD’s administration of the Unemployment Insurance program, $1,440,071,129 in benefit payments were estimated to be potentially fraudulent payments. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched imposter fraud for identity or eligibility fraud for misrepresented information. The Unemployment Insurance Branch of EDD reviews unemployment insurance claims of claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 138 unemployment insurance benefit payments tested, there were 4 claimants receiving benefits, whose reasons for involuntary separation indicated separation reasons due to voluntary quitting without good cause. Identification as a Repeat Finding Finding 2020-004 was reported in the immediate prior year. Cause The adjudication process for potential eligibility issues, which includes work separation, was not timely reviewed due to the significant increase in claims resulting from the COVID-19 pandemic. Effect By EDD not performing timely review for potential eligibility issues, benefit payments were made to ineligible claimants. Questioned Costs Known questioned costs for the 4 claimants were $13,720 for the Unemployment Insurance program and $16,200 for the Federal Pandemic Unemployment Compensation program of the COVID-19 Unemployment Insurance program. Context Benefits paid to claimants under the Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $25,554,569,761. The sample was not a statistically valid sample. Recommendation EDD should continue its work catching up with the adjudication process to support proper eligibility determinations and decrease improper payments to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-006 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: Unemployment Insurance COVID-19 Unemployment Insurance Federal Award Numbers and Years: UI-35637-21-55-A-6; 2021 UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 22 - Social Security, Division 1 - Employment Development Department, Subdivision 1 - Director of Employment Development, Division - 1 Unemployment and Disability Compensation, Part 1 - Unemployment Compensation, Chapter 5 Unemployment Compensation Benefits, Article 1 - Eligibility and Disqualifications §1256 and §1257 Eligibility and Disqualifications, §1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Eligibility and Disqualifications, §1257 California Code of Regulations: (a) An individual is also disqualified for unemployment compensation benefits if: He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division. Condition In EDD’s administration of the Unemployment Insurance program, $1,440,071,129 in benefit payments were estimated to be potentially fraudulent payments. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched imposter fraud for identity or eligibility fraud for misrepresented information. The Unemployment Insurance Branch of EDD reviews unemployment insurance claims of claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 138 unemployment insurance benefit payments tested, there were 4 claimants receiving benefits, whose reasons for involuntary separation indicated separation reasons due to voluntary quitting without good cause. Identification as a Repeat Finding Finding 2020-004 was reported in the immediate prior year. Cause The adjudication process for potential eligibility issues, which includes work separation, was not timely reviewed due to the significant increase in claims resulting from the COVID-19 pandemic. Effect By EDD not performing timely review for potential eligibility issues, benefit payments were made to ineligible claimants. Questioned Costs Known questioned costs for the 4 claimants were $13,720 for the Unemployment Insurance program and $16,200 for the Federal Pandemic Unemployment Compensation program of the COVID-19 Unemployment Insurance program. Context Benefits paid to claimants under the Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $25,554,569,761. The sample was not a statistically valid sample. Recommendation EDD should continue its work catching up with the adjudication process to support proper eligibility determinations and decrease improper payments to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-007 Category of Finding: Subrecipient Monitoring Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Business, Consumer Services, and Housing Agency California Department of Education California Department of Social Services Federal Program Title: Coronavirus Relief Fund Assistance Listing Number: 21.019 Federal Award Number and Year: N/A; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. §200.332 Requirements for pass-through entities (2 CFR 200.332): All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these date elements change, include the changes in subsequent subaward modification. When some of the information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient’s unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged per §200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; Condition For 2 of 60 subawards tested, the State did not communicate required subaward information to its subrecipients of the Coronavirus Relief Fund (CRF) program at the time of the subaward, or when the State became aware of changes in subaward information, including identification that the subaward funds represented federal funding. Also, for 4 of 60 direct costs tested, the transactions were subsequently determined to be subawards, for which the required subaward information was not properly communicated to the subrecipients. The 4 direct costs transactions were from the Business, Consumer Services and Housing Agency; 1 of the subawards was from the California Department of Education; and 1 of the subawards was from the California Department of Social Services. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The State initially appropriated state General Fund dollars to various departments through an amendment to the 2019 State Budget Act for its coronavirus response. The initial communication to certain subrecipients identified the funding source as State General Fund monies. Subsequently, upon the State allocating its CRF award funds to be administered by various state departments, certain activities and related costs originally funded by the State General Fund, were replaced with CRF funding. Given the change in the source of funding, updated communication was not provided to the subrecipients informing them of the required federal award information. Additionally, the State did not make timely determinations identifying certain activities as subawards versus contracts for goods and/or services. Effect By not properly informing subrecipients that the funding provided represented federal financial assistance associated with the CRF program, there is an increased risk that subrecipients could potentially expend funds on ineligible activities, as well as subrecipients not accounting and reporting expenditures in accordance with the Federal statutes, regulations, and the terms and conditions of the federal award. Questioned Costs No questioned costs were identified. Context Disbursements to subrecipients for the CRF totaled $7,480,270,598, or 79.7% of total reported CRF program expenditures. Subrecipient expenditures for the 6 subawards with exceptions, the related State administering department, and the total department subrecipient expenditures for which the required subaward information was not communicated, is as follows: "See the Notes to the SEFA for the chart/table" The sample was not a statistically valid sample. Recommendation The state administering departments identified above should review all subawards provided which were funded using CRF program funds, provide the subrecipients with subaward information required by 2 CFR 200.332(a), and determine whether the subrecipients properly reported CRF subawards and related expenditures in their respective schedule of expenditures of federal awards pursuant to 2 CFR 200.502.If federal subawards were not reported, the state administering departments should perform appropriate follow-up monitoring procedures. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-008 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year.   §14712: (e) Whenever the department determines that a mental health plan has failed to comply with this chapter or any regulations, contractual requirements, state plan, or waivers adopted pursuant to this chapter, the department shall notify the mental health plan in writing within 30 days of its determination and may impose sanctions, including, but not limited to, fines, penalties, the withholding of payments, special requirements, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Condition Fifteen of 56 contractor counties of Short-Doyle funding were tested and seven had not submitted their cost reports by the December 31 due date. Two of the seven contractor counties had not submitted their cost reports for fiscal year 2019-20 (more than 12 months late) and five of the seven contractor counties have subsequently submitted their cost reports for fiscal year 2020-21. Although the Mental Health Division of Health Care Services did take the required action of notifying the seven contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2020-007 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Medical Assistance Program to the seven noncompliant contractor counties totaled $990,507,492, the 15 tested contractor counties totaled $1,766,996,894, and all 56 contractor counties totaled $2,189,728,183. For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven noncompliant contractor counties totaled $99,333,754, the 15 tested contractor counties totaled $183,713,347, and all 56 contractor counties totaled $215,971,858. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-008 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year.   §14712: (e) Whenever the department determines that a mental health plan has failed to comply with this chapter or any regulations, contractual requirements, state plan, or waivers adopted pursuant to this chapter, the department shall notify the mental health plan in writing within 30 days of its determination and may impose sanctions, including, but not limited to, fines, penalties, the withholding of payments, special requirements, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Condition Fifteen of 56 contractor counties of Short-Doyle funding were tested and seven had not submitted their cost reports by the December 31 due date. Two of the seven contractor counties had not submitted their cost reports for fiscal year 2019-20 (more than 12 months late) and five of the seven contractor counties have subsequently submitted their cost reports for fiscal year 2020-21. Although the Mental Health Division of Health Care Services did take the required action of notifying the seven contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2020-007 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Medical Assistance Program to the seven noncompliant contractor counties totaled $990,507,492, the 15 tested contractor counties totaled $1,766,996,894, and all 56 contractor counties totaled $2,189,728,183. For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven noncompliant contractor counties totaled $99,333,754, the 15 tested contractor counties totaled $183,713,347, and all 56 contractor counties totaled $215,971,858. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-008 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year.   §14712: (e) Whenever the department determines that a mental health plan has failed to comply with this chapter or any regulations, contractual requirements, state plan, or waivers adopted pursuant to this chapter, the department shall notify the mental health plan in writing within 30 days of its determination and may impose sanctions, including, but not limited to, fines, penalties, the withholding of payments, special requirements, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Condition Fifteen of 56 contractor counties of Short-Doyle funding were tested and seven had not submitted their cost reports by the December 31 due date. Two of the seven contractor counties had not submitted their cost reports for fiscal year 2019-20 (more than 12 months late) and five of the seven contractor counties have subsequently submitted their cost reports for fiscal year 2020-21. Although the Mental Health Division of Health Care Services did take the required action of notifying the seven contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2020-007 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Medical Assistance Program to the seven noncompliant contractor counties totaled $990,507,492, the 15 tested contractor counties totaled $1,766,996,894, and all 56 contractor counties totaled $2,189,728,183. For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven noncompliant contractor counties totaled $99,333,754, the 15 tested contractor counties totaled $183,713,347, and all 56 contractor counties totaled $215,971,858. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-008 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year.   §14712: (e) Whenever the department determines that a mental health plan has failed to comply with this chapter or any regulations, contractual requirements, state plan, or waivers adopted pursuant to this chapter, the department shall notify the mental health plan in writing within 30 days of its determination and may impose sanctions, including, but not limited to, fines, penalties, the withholding of payments, special requirements, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Condition Fifteen of 56 contractor counties of Short-Doyle funding were tested and seven had not submitted their cost reports by the December 31 due date. Two of the seven contractor counties had not submitted their cost reports for fiscal year 2019-20 (more than 12 months late) and five of the seven contractor counties have subsequently submitted their cost reports for fiscal year 2020-21. Although the Mental Health Division of Health Care Services did take the required action of notifying the seven contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2020-007 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Medical Assistance Program to the seven noncompliant contractor counties totaled $990,507,492, the 15 tested contractor counties totaled $1,766,996,894, and all 56 contractor counties totaled $2,189,728,183. For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven noncompliant contractor counties totaled $99,333,754, the 15 tested contractor counties totaled $183,713,347, and all 56 contractor counties totaled $215,971,858. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-009 Category of Finding: Cash Management Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.917 Federal Program Title: HIV Care Formula Grants Federal Award Numbers and Years: 2 X08HA28020-06; 2020 2 X08HA28020-07; 2021 5 X07HA12778-12, 2020 5 X07HA12778-13, 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.305 - Payment (2 CFR 200.305): (a) For states, payments are governed by Treasury-State CMIA agreements and default procedures codified at 31 CFR Part 205 “Rules and Procedures for Efficient Federal-State Funds Transfers” and TFM 4A-2000 Overall Disbursing Rules for All Federal Agencies. Title 31 – Money and Finance: Treasury. Subtitle B – Regulations Relating to Money and Finance. Chapter II – Fiscal Service, Department of the Treasury. Subchapter A – Bureau of Fiscal Service. Part 205 – Rules and Procedures for Efficient Federal-State Funds Transfers. Subpart B – Rules Applicable to Federal Assistance Programs Not Included in a Treasury-State Agreement. §205.33 How are funds transfers processed? (31 CFR 205.33): (a) A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102 (For availability, see 5 CFR 1310.3.). Condition Out of 25 cash drawdowns reviewed, one sample did not meet the requirements to minimize the timing between Public Health’s Office of AIDS receipt of Federal funds and disbursement of those funds for program purposes. The funds from this drawdown were designated to pay 33 vendor invoices. However, payments for 23 of these invoices were made between 16 to 175 days after the drawdown occurred. One invoice was paid 598 days after the date of the drawdown. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Public Health’s Office of AIDS redirected staff, including manager level positions, to help with other assignments during the year. Furthermore, there were delays due to the challenges presented by the increased demand of processing payments associated with substantial new COVID-19 funding. Effect When the necessary oversight and monitoring of cash drawdowns is insufficient, Public Health has an increased risk of not disbursing Federal award funds in a timely manner. Questioned Costs No questioned costs were identified. Context Public Health administered 157 Federal fund drawdowns for HIV Care Formula Grants program expenditures during the fiscal year ended June 30, 2021. Our sample of 25 drawdowns totaled $41,615,273. The one drawdown in question was for $1,229,031, which included $1,007,896 in invoices that were paid in 16 or more days after the date of the drawdown. The sample was not a statistically valid sample. Recommendation The Public Heath’s Office of AIDS should continue to monitor compliance with its policies to ensure staff follow established guidelines to minimize the timing between drawdown and disbursement of Federal funds. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-010 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter D - State Children’s Health Insurance Program (SCHIPs), Part 457 - Allotments and Grants to States, Subpart C - State Plan Requirements: Eligibility, Screening, Applications, and Enrollment: § 457.340 Application for and enrollment in CHIP (e) Notice of eligibility determinations: The State must provide each applicant or enrollee with timely and adequate written notice of any decision affecting his or her eligibility, including an approval, denial or termination, or suspension of eligibility, consistent with §§ 457.315, 457.348, and 457.350. The notice must be written in plain language; and accessible to persons who are limited English proficient and individuals with disabilities, consistent with § 435.905(b) of this chapter and § 457.110. 42 CFR § 457.353 - Monitoring and evaluation of screening process States must establish a mechanism and monitor to evaluate the screen and enroll process described at § 457.350 of this subpart to ensure that children who are: (a) Screened as potentially eligible for other insurance affordability programs are enrolled in such programs, if eligible; or (b) Determined ineligible for other insurance affordability programs are enrolled in CHIP, if eligible. Condition Out of 40 Children’s Health Insurance Program (CHIP) beneficiaries tested, there was one beneficiary where the transaction sent to terminate eligibility failed and eligibility continued in error, and one instance where the beneficiary remained in a transitional aid code for an extended period. Through subawards, Health Care Services has delegated performance of eligibility determinations to California county welfare agencies that collect and record this information in their respective eligibility systems (collectively known as the Statewide Automated Welfare System [SAWS]) and the California Healthcare Eligibility, Enrollment, and Retention System (CalHEERS), which transmit eligibility data to the Health Care Services’ Medi-Cal Eligibility Data System (MEDS). Health Care Services then pays: (1) managed care plans monthly to provide eligible services for beneficiaries (Managed Care); (2) medical providers for services provided directly to beneficiaries (Fee for Service), and (3) the U.S. Centers for Medicare and Medicaid Services (CMS) for Medicare premiums (Premiums). Supplemental Information to Provide Additional Perspective on the Condition In addition to the above exceptions noted during this audit, in February 2018, the U.S. Department of Health and Human Services Office of Inspector General (OIG) issued a report titled “California Made Medicaid Payments on Behalf of Newly Eligible Beneficiaries Who Did Not Meet Federal and State Requirements.” The OIG sampled 150 beneficiaries and found California made Medicaid payments on behalf of 112 eligible beneficiaries. However, for the remaining 38 beneficiaries, California made payments on behalf of ineligible and potentially ineligible beneficiaries. On the basis of the OIG’s sample results, they estimated that California made Medi-Cal payments of $738.2 million ($628.8 million Federal share) on behalf of 366,078 ineligible beneficiaries and $416.5 million ($402.4 million Federal share) on behalf of 79,055 potentially ineligible beneficiaries. These deficiencies occurred because, at the time, California’s eligibility systems lacked the necessary system functionality and county welfare agencies’ eligibility caseworkers made errors. In October 2018, the California State Auditor (CSA) issued a report titled “Department of Health Care Services: It Paid Billions in Questionable Medi-Cal Premiums and Claims Because It Failed to Follow Up on Eligibility Discrepancies.” This report presents the results of CSA’s high risk audit concerning $4 billion (includes both Federal and State funding) in questionable Medi-Cal payments that Health Care Services made from 2014 through 2017 because it failed to ensure that counties resolved discrepancies between SAWS/CalHEERS and MEDS. Both of these reports came to the attention of the United States Senate Committee on Homeland Security and Governmental Affairs, which requested CMS’ plans to address the findings noted in these reports. CMS conducted a review of California’s Medicaid beneficiary eligibility system to assess the accuracy of eligibility determinations and Federal Medical Assistance Percentage (FMAP) claiming. One of the primary objectives of this review was to compare review findings to similar reviews conducted in the past by the OIG to ensure the identified findings have been addressed. However, due to the Coronavirus Disease of 2019 (COVID-19), the release of the draft report of the review has been delayed. It should also be noted that due to COVID-19, the Secretary of Health and Human Services declared a Public Health Emergency (PHE) that was effective January 27, 2020. On March 13, 2020, the President of the United States of America declared a National Emergency, retroactive to March 1, 2020, due to COVID-19. As a result of the President’s declaration, CMS issued a federal directive granting states an exception for meeting the periodic renewal requirements for cases that were up for redetermination as of March 1, 2020 through the end of the PHE. This exemption prevents states from denying or terminating eligibility or reducing benefits to Medi-Cal and CHIP beneficiaries during the PHE unless the beneficiary dies, no longer is a state resident, is a non-MAGI Medi-Cal individual moving from a non-Long-Term Care (LTC) aid code into a LTC aid code, or voluntarily discontinues their eligibility. After the month in which the PHE is declared over, states will be given an ample period of time to complete all renewals and redeterminations. As a result of COVID-19, the periodic renewal requirements were not tested for the fiscal year ended June 30, 2021. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of benefits provided to ineligible beneficiaries for the following reasons. • The MEDS alert functionality is used to communicate information to county welfare agencies on changes in beneficiary circumstance, i.e., exceeding the age threshold for the assigned aid category, and discrepancies between eligibility systems, and MEDS. MEDS alerts will be triggered for various reasons that include:  Problems encountered in processing updates submitted by county welfare agencies;  Problems encountered in processing updates generated as a result of a reconciliation of county welfare agencies records with MEDS records;  Updates submitted by other entities that impact beneficiaries’ eligibility or require action by county welfare agencies; and  Upcoming changes in a beneficiaries’ status that will require action by county welfare agencies. Health Care Services did not have an established process for monitoring the county welfare agencies’ progress in addressing these alerts, which created the runaway MEDS issue. • The process to ensure that individuals do not remain in a transitional aid code past the allotted time was not followed. Effect One of the two CHIP beneficiaries with eligibility exceptions was determined to be ineligible and benefits were not discontinued during the fiscal year; therefore, the individual received ineligible benefits from the date the individual should have been discontinued. The second CHIP beneficiary with eligibility exception was not transitioned from a transitional aid code to a regular program code, if eligible, or discontinued. Questioned Costs Benefits paid to the CHIP beneficiary after the beneficiary was determined to be ineligible and the CHIP beneficiary without supporting eligibility documentation totaled $3,752 ($3,208 Managed Care and $544 Fee for Service) for the fiscal year ended June 30, 2021. Context A total of $2,163 ($2,163 Managed Care, $0 Fee for Service, and $0 Premiums) was disbursed during the fiscal year ended June 30, 2021 on behalf of one beneficiary later determined to be ineligible. A total of $1,589 ($1,045 Managed Care and $544 Fee for Service) was disbursed during the fiscal year ended June 30, 2021 on behalf of one beneficiary who did not have any documents supporting the eligibility. Total benefits paid on behalf of the 40 CHIP beneficiaries tested were $45,075 ($36,733 Managed Care and $8,342 Fee for Service). The 40 tested CHIP beneficiaries were selected from ten of California’s 58 counties. The total federal CHIP benefits paid on behalf of approximately 1.5 million beneficiaries for the fiscal year ended June 30, 2021 was $2,550,506,655 ($2,058,210,982 for Managed Care and $492,295,673 Fee for Service). The sample was not a statistically valid sample. Recommendation Health Care Services should continue with the quality control process used to monitor all MEDS alerts to ensure that the system has a process of identifying and alerting caseworkers to the review of beneficiaries that may be still receiving benefits when deemed ineligible. Health Care Services should continue its efforts to utilize focus reviews to assess counties’ risk of delays in renewal activities. Health Care Services should then work directly with those county welfare agencies to implement policies and procedures to improve their compliance status. Health Care Services should ensure there are controls in place to ensure all beneficiaries have the proper supporting documentation to be eligible. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-010 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter D - State Children’s Health Insurance Program (SCHIPs), Part 457 - Allotments and Grants to States, Subpart C - State Plan Requirements: Eligibility, Screening, Applications, and Enrollment: § 457.340 Application for and enrollment in CHIP (e) Notice of eligibility determinations: The State must provide each applicant or enrollee with timely and adequate written notice of any decision affecting his or her eligibility, including an approval, denial or termination, or suspension of eligibility, consistent with §§ 457.315, 457.348, and 457.350. The notice must be written in plain language; and accessible to persons who are limited English proficient and individuals with disabilities, consistent with § 435.905(b) of this chapter and § 457.110. 42 CFR § 457.353 - Monitoring and evaluation of screening process States must establish a mechanism and monitor to evaluate the screen and enroll process described at § 457.350 of this subpart to ensure that children who are: (a) Screened as potentially eligible for other insurance affordability programs are enrolled in such programs, if eligible; or (b) Determined ineligible for other insurance affordability programs are enrolled in CHIP, if eligible. Condition Out of 40 Children’s Health Insurance Program (CHIP) beneficiaries tested, there was one beneficiary where the transaction sent to terminate eligibility failed and eligibility continued in error, and one instance where the beneficiary remained in a transitional aid code for an extended period. Through subawards, Health Care Services has delegated performance of eligibility determinations to California county welfare agencies that collect and record this information in their respective eligibility systems (collectively known as the Statewide Automated Welfare System [SAWS]) and the California Healthcare Eligibility, Enrollment, and Retention System (CalHEERS), which transmit eligibility data to the Health Care Services’ Medi-Cal Eligibility Data System (MEDS). Health Care Services then pays: (1) managed care plans monthly to provide eligible services for beneficiaries (Managed Care); (2) medical providers for services provided directly to beneficiaries (Fee for Service), and (3) the U.S. Centers for Medicare and Medicaid Services (CMS) for Medicare premiums (Premiums). Supplemental Information to Provide Additional Perspective on the Condition In addition to the above exceptions noted during this audit, in February 2018, the U.S. Department of Health and Human Services Office of Inspector General (OIG) issued a report titled “California Made Medicaid Payments on Behalf of Newly Eligible Beneficiaries Who Did Not Meet Federal and State Requirements.” The OIG sampled 150 beneficiaries and found California made Medicaid payments on behalf of 112 eligible beneficiaries. However, for the remaining 38 beneficiaries, California made payments on behalf of ineligible and potentially ineligible beneficiaries. On the basis of the OIG’s sample results, they estimated that California made Medi-Cal payments of $738.2 million ($628.8 million Federal share) on behalf of 366,078 ineligible beneficiaries and $416.5 million ($402.4 million Federal share) on behalf of 79,055 potentially ineligible beneficiaries. These deficiencies occurred because, at the time, California’s eligibility systems lacked the necessary system functionality and county welfare agencies’ eligibility caseworkers made errors. In October 2018, the California State Auditor (CSA) issued a report titled “Department of Health Care Services: It Paid Billions in Questionable Medi-Cal Premiums and Claims Because It Failed to Follow Up on Eligibility Discrepancies.” This report presents the results of CSA’s high risk audit concerning $4 billion (includes both Federal and State funding) in questionable Medi-Cal payments that Health Care Services made from 2014 through 2017 because it failed to ensure that counties resolved discrepancies between SAWS/CalHEERS and MEDS. Both of these reports came to the attention of the United States Senate Committee on Homeland Security and Governmental Affairs, which requested CMS’ plans to address the findings noted in these reports. CMS conducted a review of California’s Medicaid beneficiary eligibility system to assess the accuracy of eligibility determinations and Federal Medical Assistance Percentage (FMAP) claiming. One of the primary objectives of this review was to compare review findings to similar reviews conducted in the past by the OIG to ensure the identified findings have been addressed. However, due to the Coronavirus Disease of 2019 (COVID-19), the release of the draft report of the review has been delayed. It should also be noted that due to COVID-19, the Secretary of Health and Human Services declared a Public Health Emergency (PHE) that was effective January 27, 2020. On March 13, 2020, the President of the United States of America declared a National Emergency, retroactive to March 1, 2020, due to COVID-19. As a result of the President’s declaration, CMS issued a federal directive granting states an exception for meeting the periodic renewal requirements for cases that were up for redetermination as of March 1, 2020 through the end of the PHE. This exemption prevents states from denying or terminating eligibility or reducing benefits to Medi-Cal and CHIP beneficiaries during the PHE unless the beneficiary dies, no longer is a state resident, is a non-MAGI Medi-Cal individual moving from a non-Long-Term Care (LTC) aid code into a LTC aid code, or voluntarily discontinues their eligibility. After the month in which the PHE is declared over, states will be given an ample period of time to complete all renewals and redeterminations. As a result of COVID-19, the periodic renewal requirements were not tested for the fiscal year ended June 30, 2021. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of benefits provided to ineligible beneficiaries for the following reasons. • The MEDS alert functionality is used to communicate information to county welfare agencies on changes in beneficiary circumstance, i.e., exceeding the age threshold for the assigned aid category, and discrepancies between eligibility systems, and MEDS. MEDS alerts will be triggered for various reasons that include:  Problems encountered in processing updates submitted by county welfare agencies;  Problems encountered in processing updates generated as a result of a reconciliation of county welfare agencies records with MEDS records;  Updates submitted by other entities that impact beneficiaries’ eligibility or require action by county welfare agencies; and  Upcoming changes in a beneficiaries’ status that will require action by county welfare agencies. Health Care Services did not have an established process for monitoring the county welfare agencies’ progress in addressing these alerts, which created the runaway MEDS issue. • The process to ensure that individuals do not remain in a transitional aid code past the allotted time was not followed. Effect One of the two CHIP beneficiaries with eligibility exceptions was determined to be ineligible and benefits were not discontinued during the fiscal year; therefore, the individual received ineligible benefits from the date the individual should have been discontinued. The second CHIP beneficiary with eligibility exception was not transitioned from a transitional aid code to a regular program code, if eligible, or discontinued. Questioned Costs Benefits paid to the CHIP beneficiary after the beneficiary was determined to be ineligible and the CHIP beneficiary without supporting eligibility documentation totaled $3,752 ($3,208 Managed Care and $544 Fee for Service) for the fiscal year ended June 30, 2021. Context A total of $2,163 ($2,163 Managed Care, $0 Fee for Service, and $0 Premiums) was disbursed during the fiscal year ended June 30, 2021 on behalf of one beneficiary later determined to be ineligible. A total of $1,589 ($1,045 Managed Care and $544 Fee for Service) was disbursed during the fiscal year ended June 30, 2021 on behalf of one beneficiary who did not have any documents supporting the eligibility. Total benefits paid on behalf of the 40 CHIP beneficiaries tested were $45,075 ($36,733 Managed Care and $8,342 Fee for Service). The 40 tested CHIP beneficiaries were selected from ten of California’s 58 counties. The total federal CHIP benefits paid on behalf of approximately 1.5 million beneficiaries for the fiscal year ended June 30, 2021 was $2,550,506,655 ($2,058,210,982 for Managed Care and $492,295,673 Fee for Service). The sample was not a statistically valid sample. Recommendation Health Care Services should continue with the quality control process used to monitor all MEDS alerts to ensure that the system has a process of identifying and alerting caseworkers to the review of beneficiaries that may be still receiving benefits when deemed ineligible. Health Care Services should continue its efforts to utilize focus reviews to assess counties’ risk of delays in renewal activities. Health Care Services should then work directly with those county welfare agencies to implement policies and procedures to improve their compliance status. Health Care Services should ensure there are controls in place to ensure all beneficiaries have the proper supporting documentation to be eligible. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-011 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.917 Federal Program Title: HIV Care Formula Grants Federal Award Numbers and Years: 5 X07HA12778-12; 2020 5 X07HA12778-13; 2021 2 X09HA28342-06; 2020 2 X09HA28342-07; 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - The Public Health and Welfare. Chapter 6A - Public Health Service. Subchapter XXIV - HIV Health Care Services Program. Part B - Care Grant Program. Subpart I - General Grant Provisions. Section 300ff-26 - Provision of Treatments: (a) In general A State shall use a portion of the amounts provided under a grant awarded under section 300ff–21 of this title to establish a program under section 300ff–22(b)(3)(B) of this title to provide therapeutics to treat HIV/AIDS or prevent the serious deterioration of health arising from HIV/AIDS in eligible individuals, including measures for the prevention and treatment of opportunistic infections. (b) Eligible individual To be eligible to receive assistance from a State under this section an individual shall: (1) Have a medical diagnosis of HIV/AIDS; and (2) Be a low-income individual, as defined by the State.   California State AIDS Drug Assistance Program Guidelines December 2018 and April 2020: (1.1) AIDS Drug Assistance Program (ADAP) Eligibility Criteria: To be eligible for the ADAP program, a client must: • Have a positive HIV/AIDS diagnosis. • Be at least 18 years old. • Be a resident of California. • Have an annual Modified Adjusted Gross Income (MAGI) that does not exceed 500 percent Federal Poverty Level (FPL) based on household size and income. • Not be fully covered by Medi-Cal or any other third-party payers (an entity that reimburses and manages health care expenses such as private insurance or governmental agencies, employers, etc.). Health Resources and Services Administration (HRSA) Policy Clarification Notice (PCN) 13-02 (Revised 5/1/2019): For both initial/annual and six-month recertification procedures, eligibility determinations may be performed simultaneously with testing and treatment. Recipients and subrecipients assume the risk of recouping any HRSA RWHAP funds utilized for clients ultimately determined to be ineligible, and instead charge an alternate payment source, or otherwise ensure that funds are returned to the HRSA RWHAP program. HRSA PCN 15-04 (Revised 1/11/2019): The RWHAP legislation requires that rebates collected on ADAP medication purchases be applied to the RWHAP Part B Program with a priority, but not a requirement, that the rebates be placed back into ADAP. Although ADAP rebates are neither program income nor refunds, they are subject to the same regulatory provision regarding expenditure. These rebates must be used for the statutorily permitted purposes under the RWHAP Part B Program, which are limited to core medical services including ADAP, support services, clinical quality management, and administrative expenses (including planning and evaluation) as part of a comprehensive system of care for low-income individuals living with HIV. HRSA PCN 13-02 (Revised 5/1/2019): To maintain eligibility for HRSA RWHAP services, clients must be recertified at least every six months. The primary purposes of the recertification process are to ensure that an individual’s residency, income, and insurance statuses continue to meet the recipient eligibility requirements and to verify that the HRSA RWHAP is the payor of last resort. The recertification process includes checking for the availability of all other third party payers. Recipients have flexibility with regard to timing and process, especially in consideration of health care coverage enrollment periods, but all recipients across all Parts must engage in eligibility determination and recertification. Condition Our sample of 60 participants from a population of 28,417 participants who received benefits during the fiscal year identified 1 participant’s annual recertification was not conducted in a timely manner and 16 participants who did not submit all required documentation, including proof of HIV/AIDS diagnosis, proof of residency, and income documentation to verify their annual MAGI did not exceed 500 percent Federal Poverty Level based on household size and income. Identification as a Repeat Finding With the exception of the one instance of untimely annual recertification, finding 2020-009 was reported in the immediate prior year pertaining to not submitting all required documentation. Cause Procedures that required the collection of valid supporting documents were not followed. Existing internal controls did not prevent, or detect and correct, the occurrence of benefits being provided to potentially ineligible individuals. Effect Public Health did not have adequate oversight controls to ensure that the applicant’s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals that may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable because benefit costs were not tracked by individual participants. Context Pharmacy benefits management services are provided by a contractor who received administrative fees and reimbursements for prescription drug costs to program participants. Payments to the contractor totaled $109,619,714 for approximately 30,000 program participants for the fiscal year ended June 30, 2021. Based on the budget in the contract, the contractor’s administrative fees and other charges are estimated to be $237,759 annually. As such, net prescription drug costs are approximately $109,381,955 for the fiscal year ended June 30, 2021. The sample was not a statistically valid sample. Recommendation The ADAP Branch should continue to monitor compliance with its policies to ensure enrollment workers and secondary reviews of ADAP applications follow the established guidelines and retain acceptable documentation to support eligibility determinations and timely annual recertification. Applications that have been granted an eligibility exception (i.e., Temporary Access Period, Medi-Cal Eligibility Exception Request, or Eligibility Exception Request) should be reviewed in a timely manner to ensure clients who do not provide the required documentation within the approved extension period are disenrolled in a timely manner. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-012 Category of Finding: Reporting Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department California Department of Aging (Aging) Assistance Listing Number: 93.044 Federal Program Title: Special Programs for the Aging, Title III, Part B, Grants for Supportive Services and Senior Centers Federal Award Number and Year: 2101CAOASS-00; 2020 Assistance Listing Number: 93.045 Federal Program Title: Special Programs for the Aging, Title III, Part C, Nutrition Services Federal Award Numbers and Year: 2101CAOAHD-00; 2020 2101CAOACM-00; 2020 Assistance Listing Number: 93.053 Federal Program Title: Nutrition Services Incentive Program Federal Award Number and Year: 2101CAOANS-00; 2020 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Aging Cluster for the fiscal year ended June 30, 2021, pertaining to 7 subrecipients of federal funds out of a population of 33. The required FFATA reporting submissions pertaining to these subawards were made; however, the submission occurred in July 2022, 21 months after the official submission due date. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Aging had delays in the submission process for its FFATA reporting due primarily to COVID-19 and the need for additional focus and efforts to address the pandemic. Questioned Costs Aging’s FFATA reporting for the 7 subawards examined was accurately completed and there were no identified questioned costs. Context During the fiscal year 2020-21, Aging passed through federal funds totaling $71,894,700 to the 7 subrecipients, with the total passed through to all subrecipients totaling $153,585,190. The sample was not a statistically valid sample. Effect First-tier recipients of federal funds must report subawards greater than $30,000 under the FFATA requirements. These submissions are due by the end of the month following the month in which the subaward obligation is made. By not completing the submission by the applicable due dates, Aging was not in compliance with the provisions of the FFATA reporting requirements. Recommendation We recommend that Aging update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-012 Category of Finding: Reporting Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department California Department of Aging (Aging) Assistance Listing Number: 93.044 Federal Program Title: Special Programs for the Aging, Title III, Part B, Grants for Supportive Services and Senior Centers Federal Award Number and Year: 2101CAOASS-00; 2020 Assistance Listing Number: 93.045 Federal Program Title: Special Programs for the Aging, Title III, Part C, Nutrition Services Federal Award Numbers and Year: 2101CAOAHD-00; 2020 2101CAOACM-00; 2020 Assistance Listing Number: 93.053 Federal Program Title: Nutrition Services Incentive Program Federal Award Number and Year: 2101CAOANS-00; 2020 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Aging Cluster for the fiscal year ended June 30, 2021, pertaining to 7 subrecipients of federal funds out of a population of 33. The required FFATA reporting submissions pertaining to these subawards were made; however, the submission occurred in July 2022, 21 months after the official submission due date. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Aging had delays in the submission process for its FFATA reporting due primarily to COVID-19 and the need for additional focus and efforts to address the pandemic. Questioned Costs Aging’s FFATA reporting for the 7 subawards examined was accurately completed and there were no identified questioned costs. Context During the fiscal year 2020-21, Aging passed through federal funds totaling $71,894,700 to the 7 subrecipients, with the total passed through to all subrecipients totaling $153,585,190. The sample was not a statistically valid sample. Effect First-tier recipients of federal funds must report subawards greater than $30,000 under the FFATA requirements. These submissions are due by the end of the month following the month in which the subaward obligation is made. By not completing the submission by the applicable due dates, Aging was not in compliance with the provisions of the FFATA reporting requirements. Recommendation We recommend that Aging update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-012 Category of Finding: Reporting Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department California Department of Aging (Aging) Assistance Listing Number: 93.044 Federal Program Title: Special Programs for the Aging, Title III, Part B, Grants for Supportive Services and Senior Centers Federal Award Number and Year: 2101CAOASS-00; 2020 Assistance Listing Number: 93.045 Federal Program Title: Special Programs for the Aging, Title III, Part C, Nutrition Services Federal Award Numbers and Year: 2101CAOAHD-00; 2020 2101CAOACM-00; 2020 Assistance Listing Number: 93.053 Federal Program Title: Nutrition Services Incentive Program Federal Award Number and Year: 2101CAOANS-00; 2020 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Aging Cluster for the fiscal year ended June 30, 2021, pertaining to 7 subrecipients of federal funds out of a population of 33. The required FFATA reporting submissions pertaining to these subawards were made; however, the submission occurred in July 2022, 21 months after the official submission due date. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Aging had delays in the submission process for its FFATA reporting due primarily to COVID-19 and the need for additional focus and efforts to address the pandemic. Questioned Costs Aging’s FFATA reporting for the 7 subawards examined was accurately completed and there were no identified questioned costs. Context During the fiscal year 2020-21, Aging passed through federal funds totaling $71,894,700 to the 7 subrecipients, with the total passed through to all subrecipients totaling $153,585,190. The sample was not a statistically valid sample. Effect First-tier recipients of federal funds must report subawards greater than $30,000 under the FFATA requirements. These submissions are due by the end of the month following the month in which the subaward obligation is made. By not completing the submission by the applicable due dates, Aging was not in compliance with the provisions of the FFATA reporting requirements. Recommendation We recommend that Aging update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-013 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. ii. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Medicaid Cluster and Children’s Health Insurance Program for the fiscal year ended June 30, 2021. The required FFATA reporting submissions pertaining to these subawards were not made. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause DHCS did not submit FFATA reporting because they were not aware of the reporting requirements. Questioned Costs No questioned costs were identified. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. Pass through payments to subrecipients subject to FFATA reporting were $2,298,920,285 for Medicaid and $17,339,837 for CHIP. Effect Failure to report subawards greater than $30,000 under FFATA is considered noncompliance with the transparency requirement established by the federal government. Recommendation We recommend that DHCS update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-013 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. ii. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Medicaid Cluster and Children’s Health Insurance Program for the fiscal year ended June 30, 2021. The required FFATA reporting submissions pertaining to these subawards were not made. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause DHCS did not submit FFATA reporting because they were not aware of the reporting requirements. Questioned Costs No questioned costs were identified. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. Pass through payments to subrecipients subject to FFATA reporting were $2,298,920,285 for Medicaid and $17,339,837 for CHIP. Effect Failure to report subawards greater than $30,000 under FFATA is considered noncompliance with the transparency requirement established by the federal government. Recommendation We recommend that DHCS update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-013 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. ii. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Medicaid Cluster and Children’s Health Insurance Program for the fiscal year ended June 30, 2021. The required FFATA reporting submissions pertaining to these subawards were not made. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause DHCS did not submit FFATA reporting because they were not aware of the reporting requirements. Questioned Costs No questioned costs were identified. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. Pass through payments to subrecipients subject to FFATA reporting were $2,298,920,285 for Medicaid and $17,339,837 for CHIP. Effect Failure to report subawards greater than $30,000 under FFATA is considered noncompliance with the transparency requirement established by the federal government. Recommendation We recommend that DHCS update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-013 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Governmentwide Guidance for Grants and Agreements. Part 170 – Reporting Subaward and Executive Compensation Information, Appendix A to Part 170, Section I(a) (a) Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. ii. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. Condition We examined the Federal Funding Accountability and Transparency Act (FFATA) reporting for the Medicaid Cluster and Children’s Health Insurance Program for the fiscal year ended June 30, 2021. The required FFATA reporting submissions pertaining to these subawards were not made. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause DHCS did not submit FFATA reporting because they were not aware of the reporting requirements. Questioned Costs No questioned costs were identified. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. Pass through payments to subrecipients subject to FFATA reporting were $2,298,920,285 for Medicaid and $17,339,837 for CHIP. Effect Failure to report subawards greater than $30,000 under FFATA is considered noncompliance with the transparency requirement established by the federal government. Recommendation We recommend that DHCS update its current practices for managing subaward reporting under the FFATA to ensure that applicable subawards are identified and the required submissions are made timely. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-014 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.323 Federal Program Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Federal Award Number and Year: NU50CK000539; 2021 Criteria: Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (b) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. §200.332 Requirements for pass-through entities (2 CFR 200.332): All pass-through entities must: (c) Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section§200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. (g) Consider whether the results of the subrecipient’s audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. Condition: Public Health did not establish a formal risk assessment process over its subrecipients of federal awards to determine the frequency and extent of subrecipient monitoring to be performed. While Public Health received reimbursement invoices from subrecipients, there did not appear to be other financial or programmatic monitoring to verify subrecipents compliance with applicable requirements. In addition, Public Health did not obtain Single Audit reports from those subrecipients as required. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause: Public Health failed to identify and report its federal expenditures related to its subrecipient agreement with its bona fide agent. Consequently, required subrecipient monitoring procedures were not designed nor implemented by Public Health. Effect: By not properly evaluating the risk of noncompliance, Public Health may inadvertently award grant funds to subrecipients who lack the necessary mechanisms or understanding to adhere to federal statutes. This increases the likelihood of noncompliance arising during the implementation of the grant-funded activities. Furthermore, failure to perform monitoring procedures or obtain Single Audit reports increases the risk for not properly identifying subrecipient program control weaknesses, noncompliance, and performing sufficient follow-up on any subrecipient corrective action. Questioned Costs: No questioned costs were identified. Context: Disbursements to subrecipients for the ELC program totaled $367,405,431, or 76.5% of total reported program expenditures. Recommendation: Public Health should establish and document formal procedures for conducting risk assessments of its subrecipients, including criteria for evaluating organizational capacity, financial stability, compliance history, and programmatic capabilities. Public Health should also develop and implement specific subrecipient monitoring procedures and establish a process for obtaining single audit reports from its subrecipients. Furthermore, a monitoring mechanism should be implemented to track compliance with the single audit mandate among subrecipients, including regular follow-ups and documentation of communication efforts. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report

Reference Number: 2021-015 Category of Finding: Special Tests and Provisions – Refunding of Federal Share of Medicaid/CHIP Overpayments to Providers Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter C - Medical Assistance Programs, Part 433 - State Fiscal Administration, Subpart F - Refunding of Federal Share of Medicaid Overpayments to Providers: §433.300 Basis (42 CFR 433.300). This subpart implements: (a) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. §433.320 Procedures for refunds to CMS (42 CFR 433.320): (a) Basic requirements: (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of – (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with §433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. Subchapter D – State Children’s Health Insurance Programs (SCHIPs), Part 457 - Allotments and Grants to States, Subpart F - Payment to States: §457.628 Other applicable Federal regulations (42 CFR 457.628): Other regulations applicable to CHIP programs include the following: (a) HHS regulations in §§433.312 through 433.322 of this chapter (related to Overpayments) apply to State's CHIP programs in the same manner as they apply to State's Medicaid programs. Note that while for the Medical Assistance Program, the overpayments of the federal share must be refunded to the Centers for Medicare & Medicaid Services (CMS) via Form CMS-64 Summary, Line 9C1 - Fraud, Waste & Abuse Amounts, for the Children’s Health Insurance Program, the overpayments of the federal share must be refunded to CMS via Form CMS-21 Summary, Line 4 - Adjustments Decreasing Claims - Collections. Condition The Medical Assistance Program reporting of overpayments tested did not reflect the correct federal share because Form CMS-64 included all CHIP overpayments (42 CFR 433.320). All 20 CHIP overpayments tested did not reflect the correct federal share (Federal Financial Participation or FFP rate) and were not correctly reported on Form CMS-21 (42 CFR 433.320 via 42 CFR 457.628). Identification as a Repeat Finding Finding 2020-012 was reported in the immediate prior year. Cause The overpayments for the Medical Assistance Program (Medicaid) and CHIP on the CMS-64 and CMS-21, was due to Health Care Services Claims Processing Accounts Receivable (AR) System’s inability to distinguish between CHIP and Medicaid overpayments. When Audits and Investigations (A&I) identifies an overpayment, they do not distinguish between the two programs. A&I then sends an Action Notice (AN) and the findings of overpayments to the Fiscal Intermediary (FI) to establish an AR on the system with a copy to TPLRD for collection purposes. Once the FI establishes an AR for an overpayment, the overpayment is recorded in the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system (a department-developed application) and is automatically assigned the Medicaid FFP rate in effect upon AR creation. Due to system limitations, the COBRA system automatically assigns the Medicaid FFP rate in effect at AR creation for all overpayments and cannot assign a CHIP FFP rate to a CHIP overpayment. As such, all types of overpayments will utilize the Medicaid FFP rate. Therefore, when it is reported on the CMS-64 and CMS-21, they are allocating all refunds to the CMS-64. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments The incorrect FFP rate being applied to the Children’s Health Insurance Program (CHIP) overpayments was due to the same reason outlined above. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments. Effect Reporting of CHIP overpayments in the Medicaid CMS-64 report and utilizing an incorrect CHIP FFP rate resulted in under/over funding and noncompliance with refunding the Federal share of Medicaid and CHIP overpayments. Questioned Costs Overpayments for Medicaid caused by allocating all CHIP overpayments on the CMS-64 resulted in known questioned costs of $27,994 for the 2020-21 fiscal year. Overpayments for CHIP caused by utilizing the incorrect CHIP FFP rate resulted in known questioned costs of $10,112 for the 2020-21 fiscal year. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. The $27,994 known questioned costs for inaccurate reporting of Medicaid overpayments were identified from a total of $38,717,058 for the 40 Medicaid samples tested. The $10,112 known questioned costs for using the incorrect CHIP FFP rate were identified from a total of $27,994 for the twenty CHIP samples tested. The sample was not a statistically valid sample. Recommendation Health Care Services should have a process in place to ensure that the CMS-64 and CMS-21 reports properly report CHIP and Medicaid overpayments. Health Care Services should update the system to assign the appropriate FFP rate for each overpayment. With this implementation, CHIP overpayments can be appropriately identified with the correct FFP rate and reported on the CMS-21. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-015 Category of Finding: Special Tests and Provisions – Refunding of Federal Share of Medicaid/CHIP Overpayments to Providers Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter C - Medical Assistance Programs, Part 433 - State Fiscal Administration, Subpart F - Refunding of Federal Share of Medicaid Overpayments to Providers: §433.300 Basis (42 CFR 433.300). This subpart implements: (a) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. §433.320 Procedures for refunds to CMS (42 CFR 433.320): (a) Basic requirements: (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of – (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with §433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. Subchapter D – State Children’s Health Insurance Programs (SCHIPs), Part 457 - Allotments and Grants to States, Subpart F - Payment to States: §457.628 Other applicable Federal regulations (42 CFR 457.628): Other regulations applicable to CHIP programs include the following: (a) HHS regulations in §§433.312 through 433.322 of this chapter (related to Overpayments) apply to State's CHIP programs in the same manner as they apply to State's Medicaid programs. Note that while for the Medical Assistance Program, the overpayments of the federal share must be refunded to the Centers for Medicare & Medicaid Services (CMS) via Form CMS-64 Summary, Line 9C1 - Fraud, Waste & Abuse Amounts, for the Children’s Health Insurance Program, the overpayments of the federal share must be refunded to CMS via Form CMS-21 Summary, Line 4 - Adjustments Decreasing Claims - Collections. Condition The Medical Assistance Program reporting of overpayments tested did not reflect the correct federal share because Form CMS-64 included all CHIP overpayments (42 CFR 433.320). All 20 CHIP overpayments tested did not reflect the correct federal share (Federal Financial Participation or FFP rate) and were not correctly reported on Form CMS-21 (42 CFR 433.320 via 42 CFR 457.628). Identification as a Repeat Finding Finding 2020-012 was reported in the immediate prior year. Cause The overpayments for the Medical Assistance Program (Medicaid) and CHIP on the CMS-64 and CMS-21, was due to Health Care Services Claims Processing Accounts Receivable (AR) System’s inability to distinguish between CHIP and Medicaid overpayments. When Audits and Investigations (A&I) identifies an overpayment, they do not distinguish between the two programs. A&I then sends an Action Notice (AN) and the findings of overpayments to the Fiscal Intermediary (FI) to establish an AR on the system with a copy to TPLRD for collection purposes. Once the FI establishes an AR for an overpayment, the overpayment is recorded in the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system (a department-developed application) and is automatically assigned the Medicaid FFP rate in effect upon AR creation. Due to system limitations, the COBRA system automatically assigns the Medicaid FFP rate in effect at AR creation for all overpayments and cannot assign a CHIP FFP rate to a CHIP overpayment. As such, all types of overpayments will utilize the Medicaid FFP rate. Therefore, when it is reported on the CMS-64 and CMS-21, they are allocating all refunds to the CMS-64. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments The incorrect FFP rate being applied to the Children’s Health Insurance Program (CHIP) overpayments was due to the same reason outlined above. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments. Effect Reporting of CHIP overpayments in the Medicaid CMS-64 report and utilizing an incorrect CHIP FFP rate resulted in under/over funding and noncompliance with refunding the Federal share of Medicaid and CHIP overpayments. Questioned Costs Overpayments for Medicaid caused by allocating all CHIP overpayments on the CMS-64 resulted in known questioned costs of $27,994 for the 2020-21 fiscal year. Overpayments for CHIP caused by utilizing the incorrect CHIP FFP rate resulted in known questioned costs of $10,112 for the 2020-21 fiscal year. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. The $27,994 known questioned costs for inaccurate reporting of Medicaid overpayments were identified from a total of $38,717,058 for the 40 Medicaid samples tested. The $10,112 known questioned costs for using the incorrect CHIP FFP rate were identified from a total of $27,994 for the twenty CHIP samples tested. The sample was not a statistically valid sample. Recommendation Health Care Services should have a process in place to ensure that the CMS-64 and CMS-21 reports properly report CHIP and Medicaid overpayments. Health Care Services should update the system to assign the appropriate FFP rate for each overpayment. With this implementation, CHIP overpayments can be appropriately identified with the correct FFP rate and reported on the CMS-21. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-015 Category of Finding: Special Tests and Provisions – Refunding of Federal Share of Medicaid/CHIP Overpayments to Providers Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter C - Medical Assistance Programs, Part 433 - State Fiscal Administration, Subpart F - Refunding of Federal Share of Medicaid Overpayments to Providers: §433.300 Basis (42 CFR 433.300). This subpart implements: (a) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. §433.320 Procedures for refunds to CMS (42 CFR 433.320): (a) Basic requirements: (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of – (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with §433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. Subchapter D – State Children’s Health Insurance Programs (SCHIPs), Part 457 - Allotments and Grants to States, Subpart F - Payment to States: §457.628 Other applicable Federal regulations (42 CFR 457.628): Other regulations applicable to CHIP programs include the following: (a) HHS regulations in §§433.312 through 433.322 of this chapter (related to Overpayments) apply to State's CHIP programs in the same manner as they apply to State's Medicaid programs. Note that while for the Medical Assistance Program, the overpayments of the federal share must be refunded to the Centers for Medicare & Medicaid Services (CMS) via Form CMS-64 Summary, Line 9C1 - Fraud, Waste & Abuse Amounts, for the Children’s Health Insurance Program, the overpayments of the federal share must be refunded to CMS via Form CMS-21 Summary, Line 4 - Adjustments Decreasing Claims - Collections. Condition The Medical Assistance Program reporting of overpayments tested did not reflect the correct federal share because Form CMS-64 included all CHIP overpayments (42 CFR 433.320). All 20 CHIP overpayments tested did not reflect the correct federal share (Federal Financial Participation or FFP rate) and were not correctly reported on Form CMS-21 (42 CFR 433.320 via 42 CFR 457.628). Identification as a Repeat Finding Finding 2020-012 was reported in the immediate prior year. Cause The overpayments for the Medical Assistance Program (Medicaid) and CHIP on the CMS-64 and CMS-21, was due to Health Care Services Claims Processing Accounts Receivable (AR) System’s inability to distinguish between CHIP and Medicaid overpayments. When Audits and Investigations (A&I) identifies an overpayment, they do not distinguish between the two programs. A&I then sends an Action Notice (AN) and the findings of overpayments to the Fiscal Intermediary (FI) to establish an AR on the system with a copy to TPLRD for collection purposes. Once the FI establishes an AR for an overpayment, the overpayment is recorded in the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system (a department-developed application) and is automatically assigned the Medicaid FFP rate in effect upon AR creation. Due to system limitations, the COBRA system automatically assigns the Medicaid FFP rate in effect at AR creation for all overpayments and cannot assign a CHIP FFP rate to a CHIP overpayment. As such, all types of overpayments will utilize the Medicaid FFP rate. Therefore, when it is reported on the CMS-64 and CMS-21, they are allocating all refunds to the CMS-64. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments The incorrect FFP rate being applied to the Children’s Health Insurance Program (CHIP) overpayments was due to the same reason outlined above. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments. Effect Reporting of CHIP overpayments in the Medicaid CMS-64 report and utilizing an incorrect CHIP FFP rate resulted in under/over funding and noncompliance with refunding the Federal share of Medicaid and CHIP overpayments. Questioned Costs Overpayments for Medicaid caused by allocating all CHIP overpayments on the CMS-64 resulted in known questioned costs of $27,994 for the 2020-21 fiscal year. Overpayments for CHIP caused by utilizing the incorrect CHIP FFP rate resulted in known questioned costs of $10,112 for the 2020-21 fiscal year. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. The $27,994 known questioned costs for inaccurate reporting of Medicaid overpayments were identified from a total of $38,717,058 for the 40 Medicaid samples tested. The $10,112 known questioned costs for using the incorrect CHIP FFP rate were identified from a total of $27,994 for the twenty CHIP samples tested. The sample was not a statistically valid sample. Recommendation Health Care Services should have a process in place to ensure that the CMS-64 and CMS-21 reports properly report CHIP and Medicaid overpayments. Health Care Services should update the system to assign the appropriate FFP rate for each overpayment. With this implementation, CHIP overpayments can be appropriately identified with the correct FFP rate and reported on the CMS-21. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-015 Category of Finding: Special Tests and Provisions – Refunding of Federal Share of Medicaid/CHIP Overpayments to Providers Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter C - Medical Assistance Programs, Part 433 - State Fiscal Administration, Subpart F - Refunding of Federal Share of Medicaid Overpayments to Providers: §433.300 Basis (42 CFR 433.300). This subpart implements: (a) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. §433.320 Procedures for refunds to CMS (42 CFR 433.320): (a) Basic requirements: (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of – (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with §433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. Subchapter D – State Children’s Health Insurance Programs (SCHIPs), Part 457 - Allotments and Grants to States, Subpart F - Payment to States: §457.628 Other applicable Federal regulations (42 CFR 457.628): Other regulations applicable to CHIP programs include the following: (a) HHS regulations in §§433.312 through 433.322 of this chapter (related to Overpayments) apply to State's CHIP programs in the same manner as they apply to State's Medicaid programs. Note that while for the Medical Assistance Program, the overpayments of the federal share must be refunded to the Centers for Medicare & Medicaid Services (CMS) via Form CMS-64 Summary, Line 9C1 - Fraud, Waste & Abuse Amounts, for the Children’s Health Insurance Program, the overpayments of the federal share must be refunded to CMS via Form CMS-21 Summary, Line 4 - Adjustments Decreasing Claims - Collections. Condition The Medical Assistance Program reporting of overpayments tested did not reflect the correct federal share because Form CMS-64 included all CHIP overpayments (42 CFR 433.320). All 20 CHIP overpayments tested did not reflect the correct federal share (Federal Financial Participation or FFP rate) and were not correctly reported on Form CMS-21 (42 CFR 433.320 via 42 CFR 457.628). Identification as a Repeat Finding Finding 2020-012 was reported in the immediate prior year. Cause The overpayments for the Medical Assistance Program (Medicaid) and CHIP on the CMS-64 and CMS-21, was due to Health Care Services Claims Processing Accounts Receivable (AR) System’s inability to distinguish between CHIP and Medicaid overpayments. When Audits and Investigations (A&I) identifies an overpayment, they do not distinguish between the two programs. A&I then sends an Action Notice (AN) and the findings of overpayments to the Fiscal Intermediary (FI) to establish an AR on the system with a copy to TPLRD for collection purposes. Once the FI establishes an AR for an overpayment, the overpayment is recorded in the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system (a department-developed application) and is automatically assigned the Medicaid FFP rate in effect upon AR creation. Due to system limitations, the COBRA system automatically assigns the Medicaid FFP rate in effect at AR creation for all overpayments and cannot assign a CHIP FFP rate to a CHIP overpayment. As such, all types of overpayments will utilize the Medicaid FFP rate. Therefore, when it is reported on the CMS-64 and CMS-21, they are allocating all refunds to the CMS-64. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments The incorrect FFP rate being applied to the Children’s Health Insurance Program (CHIP) overpayments was due to the same reason outlined above. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments. Effect Reporting of CHIP overpayments in the Medicaid CMS-64 report and utilizing an incorrect CHIP FFP rate resulted in under/over funding and noncompliance with refunding the Federal share of Medicaid and CHIP overpayments. Questioned Costs Overpayments for Medicaid caused by allocating all CHIP overpayments on the CMS-64 resulted in known questioned costs of $27,994 for the 2020-21 fiscal year. Overpayments for CHIP caused by utilizing the incorrect CHIP FFP rate resulted in known questioned costs of $10,112 for the 2020-21 fiscal year. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. The $27,994 known questioned costs for inaccurate reporting of Medicaid overpayments were identified from a total of $38,717,058 for the 40 Medicaid samples tested. The $10,112 known questioned costs for using the incorrect CHIP FFP rate were identified from a total of $27,994 for the twenty CHIP samples tested. The sample was not a statistically valid sample. Recommendation Health Care Services should have a process in place to ensure that the CMS-64 and CMS-21 reports properly report CHIP and Medicaid overpayments. Health Care Services should update the system to assign the appropriate FFP rate for each overpayment. With this implementation, CHIP overpayments can be appropriately identified with the correct FFP rate and reported on the CMS-21. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2021-016 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 97.050 Federal Program Title: Presidential Declared Disaster Assistance to Individuals and Households - Other Needs Federal Award Number and Year: 4482DRCASPLW; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - The Public Health and Welfare, Chapter 68, Disaster Relief, Subchapter IV, §5174 Federal assistance to individuals and households: (e) Financial Assistance to Address Other Needs (2) Personal Property, Transportation, and Other Expenses: In accordance with this section, the President, in consultation with the Governor of a State, may provide financial assistance, and, if necessary, direct services, to individuals and households in the State who, as a direct result of a major disaster, have necessary expenses and serious needs in cases in which the individuals and households are unable to meet such expenses or needs through other means. (f) State role (3) Requirements: d. Before approving an application submitted under this section, the President, or the designee of the President, shall institute adequate policies, procedures, and internal controls to prevent waste, fraud, abuse, and program mismanagement for this program and for programs under subsections (c)(1)(B), (c)(4), and (e). The President shall monitor and conduct quality assurance activities on a State or Indian tribal government’s implementation of programs under subsections (c)(1)(B), (c)(4), and (e). If, after approving an application of a State or Indian tribal government submitted under this paragraph, the President determines that the State or Indian tribal government is not administering the program established by this section in a manner satisfactory to the President, the President shall withdraw the approval. Condition During the fiscal year ended June 30, 2021, EDD implemented the Lost Wages Assistance (LWA) program, which was funded through the disaster relief funds from the Federal Emergency Management Agency (FEMA) under the Presidential Memorandum on Authorizing the Other Needs Assistance Program for Major Disaster Declarations Related to Coronavirus Disease 2019 (COVID-19). Under the memorandum, the LWA program was to be administered in accordance with the Robert T. Stafford Disaster Relief and Emergency Assistance Act section 408(e)(2) and (f), Title 42 U.S.C §5174(e)(2), (f). In EDD’s administration of the LWA program, $1,013,541,600 in benefit payments were estimated by EDD to represent potentially fraudulent payments. The estimate was based on data parameters to identify claimants that received benefits which matched imposter fraud for identity or eligibility fraud for misrepresented information. Out of 223 LWA benefit payments tested, 20 claimants were determined to be ineligible for LWA benefits. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of fraud for benefit payments for the following reasons. • There was a significant increase in unemployment claims that overwhelmed EDD’s existing fraud detection processes. • There were insufficient controls in place to prevent or detect fraud associated with benefit payments related to incarceration, identity, and multiple claims from the same address. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to fraudulent claimants. Accordingly, benefit payments were made to fraudulent claimants who were not eligible. Questioned Costs Likely questioned costs were estimated to be $1,013,541,600 for fiscal year 2020-21. Known questioned costs for the 20 claimants determined to be ineligible was $30,000. Context Benefits paid to claimants under the Presidential Declared Disaster Assistance to Individuals and Households - Other Needs for the fiscal year ended June 30, 2021, totaled $6,464,467,210. The LWA program ended in December 2020. The sample was not a statistically valid sample. Recommendation EDD should continue to evaluate and enhance its fraud detection and prevention internal controls, increasing the use of automation features and other analytical tools in an effort to increase efficiency, continue to reduce workload, and enhance detection and timely identification of unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.