Audit 315520

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Department of Public Health Federal Program: WIC Special Supplemental Nutrition Program for Women, Infants, and Children Assistance Listing Number: 10.557 Award Number and Year: 224MA702WI003 (10/1/2021 – 9/30/2022) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) charged costs to the federal grant after the end of the grant’s allowable period of performance. Context: One of forty expenditure transactions selected for testing was incurred after the end of the grant’s period of performance. The period of performance ended on September 30, 2022 and the expenditure was incurred on October 10, 2022. Funds were not encumbered prior to the end of the period of performance. Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures were charged to the correct grant year. The Department had a contract in place with the vendor but did not encumber funds for the transaction prior to September 30, 2022. Therefore, the expenditures should have been charged to the FFY2023 grant period. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended and/or obligated after the allowable period of performance. Questioned costs: None above reportable threshold. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. The Department should ensure that it encumbers funds prior to the end of the period of performance when appropriate. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Department of Public Health Federal Program: WIC Special Supplemental Nutrition Program for Women, Infants, and Children Assistance Listing Number: 10.557 Award Number and Year: 224MA702W1003 (10/1/2021 – 9/30/2022) 234MA702W1003 (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility- Subrecipient Agreements Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The subaward agreements issued to eligible subrecipients was did not contain all of the required data. The subaward agreements did not contain the federal award identification number (FAIN) or federal award date. Context: For 8 of 8 subawards selected for testing, the Federal Award Identification Number (FAIN) and Federal Award Date were not included in the agreement provided to the subrecipient. Questioned costs: None Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: The exclusion of required federal grant award information may cause subrecipients to be uninformed about specific program and regulatory information. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards and that proper subrecipient monitoring is conducted. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-005 Prior Year Finding: 2022-004 Federal Agency: U.S. Department of Agriculture State Agency: Department of Elementary and Secondary Education Federal Program: Child and Adult Care Food Program Assistance Listing Number: 10.558 Award Number and Year: 202222N202044 (10/1/2021 – 9/30/2022), 202323N202044 (10/1/2022 – 9/30/2023), 202323N119944 (1/1/2022 – 9/30/2023), 202323N202044 (10/1/2022 – 9/30/2023), 202323N119944 (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility, Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Eligibility – Per 7 CFR section 226.2, subrecipients must meet the definition of “independent center” or “sponsoring organization”. In addition, all institutions must also meet the eligibility requirements stated in 7 CFR section 226.15 and 42 USC 1766(a)(6) and (d)(l). Definitions include: 1) Independent center means a child care center, at-risk afterschool care center, emergency shelter, outside-school-hours care center or adult day care center which enters into an agreement with the state agency to assume final administrative and financial responsibility for program operations. 2) Sponsoring organization means a public or nonprofit private organization that is entirely responsible for the administration of the food program. 3) For-profit center means a child care center, outside-school-hours care center, or adult day care center providing nonresidential care to adults or children that does not qualify for tax-exempt status under the Internal Revenue Code of 1986. For-profit centers serving adults must meet the criteria described in paragraph (a) of this definition. For-profit centers serving children must meet the criteria described in paragraphs (b )(1) or (b )(2) of this definition, except that children who only participate in the at-risk afterschool snack and/or meal component of the program must not be considered in determining the percentages under paragraphs (b )( 1) or (b)(2) of this definition. Subrecipient Monitoring – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that it issued subawards in compliance with federal regulations. Context: Sixty subawards were selected for testing. The Department documents subrecipient eligibility in a permanent agreement with each subrecipient. The following exceptions were noted: • For one of sixty subawards selected for testing, the Department could not provide documentation that it had obtained the subrecipient’s Unique Entity Identifier prior to the issuance of the subaward. • For six of sixty subrecipients selected for testing, the Department did not have an approved permanent agreement on file prior to the start date of the contract. Therefore, the Department was unable to provide documentation that it had determined subrecipient eligibility prior to the start date of the contract. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were issued in compliance with federal regulations and that subrecipient eligibility was determined prior to issuance of contracts. Effect: Failure to ensure subrecipients are eligible to receive program funding and failure to ensure subrecipients have a registered unique entity identification number could result in unauthorized entities receiving program funding. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all subrecipients are eligible to receive program funds and that required information is obtained prior to entering into a subrecipient agreement. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-005 Prior Year Finding: 2022-004 Federal Agency: U.S. Department of Agriculture State Agency: Department of Elementary and Secondary Education Federal Program: Child and Adult Care Food Program Assistance Listing Number: 10.558 Award Number and Year: 202222N202044 (10/1/2021 – 9/30/2022), 202323N202044 (10/1/2022 – 9/30/2023), 202323N119944 (1/1/2022 – 9/30/2023), 202323N202044 (10/1/2022 – 9/30/2023), 202323N119944 (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility, Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Eligibility – Per 7 CFR section 226.2, subrecipients must meet the definition of “independent center” or “sponsoring organization”. In addition, all institutions must also meet the eligibility requirements stated in 7 CFR section 226.15 and 42 USC 1766(a)(6) and (d)(l). Definitions include: 1) Independent center means a child care center, at-risk afterschool care center, emergency shelter, outside-school-hours care center or adult day care center which enters into an agreement with the state agency to assume final administrative and financial responsibility for program operations. 2) Sponsoring organization means a public or nonprofit private organization that is entirely responsible for the administration of the food program. 3) For-profit center means a child care center, outside-school-hours care center, or adult day care center providing nonresidential care to adults or children that does not qualify for tax-exempt status under the Internal Revenue Code of 1986. For-profit centers serving adults must meet the criteria described in paragraph (a) of this definition. For-profit centers serving children must meet the criteria described in paragraphs (b )(1) or (b )(2) of this definition, except that children who only participate in the at-risk afterschool snack and/or meal component of the program must not be considered in determining the percentages under paragraphs (b )( 1) or (b)(2) of this definition. Subrecipient Monitoring – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that it issued subawards in compliance with federal regulations. Context: Sixty subawards were selected for testing. The Department documents subrecipient eligibility in a permanent agreement with each subrecipient. The following exceptions were noted: • For one of sixty subawards selected for testing, the Department could not provide documentation that it had obtained the subrecipient’s Unique Entity Identifier prior to the issuance of the subaward. • For six of sixty subrecipients selected for testing, the Department did not have an approved permanent agreement on file prior to the start date of the contract. Therefore, the Department was unable to provide documentation that it had determined subrecipient eligibility prior to the start date of the contract. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were issued in compliance with federal regulations and that subrecipient eligibility was determined prior to issuance of contracts. Effect: Failure to ensure subrecipients are eligible to receive program funding and failure to ensure subrecipients have a registered unique entity identification number could result in unauthorized entities receiving program funding. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all subrecipients are eligible to receive program funds and that required information is obtained prior to entering into a subrecipient agreement. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-006 Prior Year Finding: 2022-009 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024), UI356542155A25 (10/1/2020 – 12/31/2023) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). BAM estimates error rates, number of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not complete BAM case investigations within the time limits established in the ET Handbook No. 395. Context: Sixty cases were selected for testing. The Department did not meet the required time limits for closing cases within 60, 90 or 120 days. Specifically, we noted the following exceptions: • 68% of cases tested (41 of 60 cases) were closed within 60 days which is less than the required 70%. • 87% of cases tested (52 of 60 cases) were closed within 90 days which is less than the required 95%. • 93% of cases tested (56 of 60 cases) were closed within 120 days which is less than the required 98%. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met the required BAM investigation time limits for closing cases and to ensure all claim types were part of weekly testing. Effect: Noncompliance with BAM case investigation time limits could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395 and that both paid and denied claims are selected for testing. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-006 Prior Year Finding: 2022-009 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024), UI356542155A25 (10/1/2020 – 12/31/2023) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). BAM estimates error rates, number of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not complete BAM case investigations within the time limits established in the ET Handbook No. 395. Context: Sixty cases were selected for testing. The Department did not meet the required time limits for closing cases within 60, 90 or 120 days. Specifically, we noted the following exceptions: • 68% of cases tested (41 of 60 cases) were closed within 60 days which is less than the required 70%. • 87% of cases tested (52 of 60 cases) were closed within 90 days which is less than the required 95%. • 93% of cases tested (56 of 60 cases) were closed within 120 days which is less than the required 98%. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met the required BAM investigation time limits for closing cases and to ensure all claim types were part of weekly testing. Effect: Noncompliance with BAM case investigation time limits could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395 and that both paid and denied claims are selected for testing. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-007 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Eight subawards were selected for testing. The subawards were modified between one and two times after the initial award, for a total of twelve transactions tested. The following exceptions were noted: • Three of twelve transactions selected for testing were due from 2/28/2022 to 11/30/2022 but were not reported until 2/8/2023, or from 9 to 12 months after they were due. • Nine of twelve subawards were due from between 5/31/2022 to 7/31/2023 but were not reported until after they were tested by auditors in January 2024. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reviewed, approved and submitted timely to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved, and subsequently timely submitted to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-007 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Eight subawards were selected for testing. The subawards were modified between one and two times after the initial award, for a total of twelve transactions tested. The following exceptions were noted: • Three of twelve transactions selected for testing were due from 2/28/2022 to 11/30/2022 but were not reported until 2/8/2023, or from 9 to 12 months after they were due. • Nine of twelve subawards were due from between 5/31/2022 to 7/31/2023 but were not reported until after they were tested by auditors in January 2024. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reviewed, approved and submitted timely to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved, and subsequently timely submitted to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-008 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Earmarking Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) was unable to provide documentation of internal controls used to ensure compliance with the program’s earmarking requirements. Context: The allotment per the State Allotments (WIOA Title I & ES Federal to State Allocations) report supports that the earmarking requirements are met. For the one report selected for testing, the Department was unable to provide evidence that the report was reviewed and approved to demonstrate compliance with the earmarking requirements. Therefore, auditors were unable to test the internal controls over the earmarking requirement. Cause: The Department was unable to provide documentation of the internal controls implemented to ensure it correctly reported compliance with earmarking requirements. Effect: Insufficient controls over earmarking requirements can result in undetected reporting errors and noncompliance with earmarking requirements. Questioned costs: None. Recommendation: We recommend the Department develop and document internal controls over reporting earmarking requirements to ensure that reports are accurate and that earmarking requirements are met. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-008 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Earmarking Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) was unable to provide documentation of internal controls used to ensure compliance with the program’s earmarking requirements. Context: The allotment per the State Allotments (WIOA Title I & ES Federal to State Allocations) report supports that the earmarking requirements are met. For the one report selected for testing, the Department was unable to provide evidence that the report was reviewed and approved to demonstrate compliance with the earmarking requirements. Therefore, auditors were unable to test the internal controls over the earmarking requirement. Cause: The Department was unable to provide documentation of the internal controls implemented to ensure it correctly reported compliance with earmarking requirements. Effect: Insufficient controls over earmarking requirements can result in undetected reporting errors and noncompliance with earmarking requirements. Questioned costs: None. Recommendation: We recommend the Department develop and document internal controls over reporting earmarking requirements to ensure that reports are accurate and that earmarking requirements are met. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-009 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023) Compliance Requirement: Reporting – VETS-402(A/B) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: VETS-402 (A/B), Expenditure Detail Report – This expenditure and staff utilization report separately identifies Jobs for Veterans State Grant-expenditures each quarter and year-to-date as a supplement to the DVOP and LVER SF 425, Federal Financial Reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree with supporting documentation. Context: Four out of four quarterly reports were selected for testing. The following exceptions were noted: • For one report, the Department submitted the original report which was required to be resubmitted by the U.S. Department of Labor due to a reporting error. The Department submitted a revised report but did not maintain documentation for the adjustments made to the specific line items within the revised report. Expenditure amount for both the original and revised reports did not agree to supporting documentation. • For two reports, the expenditure amounts reported did not agree with supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that reports agreed with supporting documentation nor that it maintained supporting documentation for report revisions. Effect: Insufficient procedures and internal controls over the reporting can result in undetected reporting errors. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are accurately supported by documentation and substantiate the report balances. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-009 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023) Compliance Requirement: Reporting – VETS-402(A/B) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: VETS-402 (A/B), Expenditure Detail Report – This expenditure and staff utilization report separately identifies Jobs for Veterans State Grant-expenditures each quarter and year-to-date as a supplement to the DVOP and LVER SF 425, Federal Financial Reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree with supporting documentation. Context: Four out of four quarterly reports were selected for testing. The following exceptions were noted: • For one report, the Department submitted the original report which was required to be resubmitted by the U.S. Department of Labor due to a reporting error. The Department submitted a revised report but did not maintain documentation for the adjustments made to the specific line items within the revised report. Expenditure amount for both the original and revised reports did not agree to supporting documentation. • For two reports, the expenditure amounts reported did not agree with supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that reports agreed with supporting documentation nor that it maintained supporting documentation for report revisions. Effect: Insufficient procedures and internal controls over the reporting can result in undetected reporting errors. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are accurately supported by documentation and substantiate the report balances. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Sixty timesheets were selected for testing for the WIOA Cluster. Two of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. Sixty timesheets were selected for testing for the Employment Service Cluster (ESC). The following exceptions were noted: • Seven of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. • Two of sixty employee timesheets selected for testing charged costs to the program that did not relate to the ESC grant program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Additionally, unallowable costs were charged to the ESC grant program through the use of combination codes not associated with the program. Questioned costs: WIOA: Undetermined amount related to budgeted combination codes. ESC: $5,524, the amount charged to an unallowable combination code. Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Sixty timesheets were selected for testing for the WIOA Cluster. Two of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. Sixty timesheets were selected for testing for the Employment Service Cluster (ESC). The following exceptions were noted: • Seven of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. • Two of sixty employee timesheets selected for testing charged costs to the program that did not relate to the ESC grant program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Additionally, unallowable costs were charged to the ESC grant program through the use of combination codes not associated with the program. Questioned costs: WIOA: Undetermined amount related to budgeted combination codes. ESC: $5,524, the amount charged to an unallowable combination code. Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Sixty timesheets were selected for testing for the WIOA Cluster. Two of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. Sixty timesheets were selected for testing for the Employment Service Cluster (ESC). The following exceptions were noted: • Seven of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. • Two of sixty employee timesheets selected for testing charged costs to the program that did not relate to the ESC grant program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Additionally, unallowable costs were charged to the ESC grant program through the use of combination codes not associated with the program. Questioned costs: WIOA: Undetermined amount related to budgeted combination codes. ESC: $5,524, the amount charged to an unallowable combination code. Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Sixty timesheets were selected for testing for the WIOA Cluster. Two of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. Sixty timesheets were selected for testing for the Employment Service Cluster (ESC). The following exceptions were noted: • Seven of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. • Two of sixty employee timesheets selected for testing charged costs to the program that did not relate to the ESC grant program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Additionally, unallowable costs were charged to the ESC grant program through the use of combination codes not associated with the program. Questioned costs: WIOA: Undetermined amount related to budgeted combination codes. ESC: $5,524, the amount charged to an unallowable combination code. Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Sixty timesheets were selected for testing for the WIOA Cluster. Two of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. Sixty timesheets were selected for testing for the Employment Service Cluster (ESC). The following exceptions were noted: • Seven of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. • Two of sixty employee timesheets selected for testing charged costs to the program that did not relate to the ESC grant program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Additionally, unallowable costs were charged to the ESC grant program through the use of combination codes not associated with the program. Questioned costs: WIOA: Undetermined amount related to budgeted combination codes. ESC: $5,524, the amount charged to an unallowable combination code. Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: 2022-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-36325-21-55-A-25 (7/1/2021 – 6/30/2024) ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree to supporting documentation. Context: WIOA Cluster: Fourteen of ninety-three quarterly reports were selected for testing. Two of fourteen reports selected for testing did not agree to supporting documentation. Employment Service Cluster: Reports for the 9/30/2022 and 6/30/2023 quarters were selected for testing. Individual quarterly reports are submitted for each program and reporting level which resulted in selecting fourteen out of twenty-six individual reports. Five of fourteen reports selected for testing did not agree to supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: 2022-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-36325-21-55-A-25 (7/1/2021 – 6/30/2024) ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree to supporting documentation. Context: WIOA Cluster: Fourteen of ninety-three quarterly reports were selected for testing. Two of fourteen reports selected for testing did not agree to supporting documentation. Employment Service Cluster: Reports for the 9/30/2022 and 6/30/2023 quarters were selected for testing. Individual quarterly reports are submitted for each program and reporting level which resulted in selecting fourteen out of twenty-six individual reports. Five of fourteen reports selected for testing did not agree to supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: 2022-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-36325-21-55-A-25 (7/1/2021 – 6/30/2024) ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree to supporting documentation. Context: WIOA Cluster: Fourteen of ninety-three quarterly reports were selected for testing. Two of fourteen reports selected for testing did not agree to supporting documentation. Employment Service Cluster: Reports for the 9/30/2022 and 6/30/2023 quarters were selected for testing. Individual quarterly reports are submitted for each program and reporting level which resulted in selecting fourteen out of twenty-six individual reports. Five of fourteen reports selected for testing did not agree to supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: 2022-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-36325-21-55-A-25 (7/1/2021 – 6/30/2024) ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree to supporting documentation. Context: WIOA Cluster: Fourteen of ninety-three quarterly reports were selected for testing. Two of fourteen reports selected for testing did not agree to supporting documentation. Employment Service Cluster: Reports for the 9/30/2022 and 6/30/2023 quarters were selected for testing. Individual quarterly reports are submitted for each program and reporting level which resulted in selecting fourteen out of twenty-six individual reports. Five of fourteen reports selected for testing did not agree to supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: 2022-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-36325-21-55-A-25 (7/1/2021 – 6/30/2024) ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree to supporting documentation. Context: WIOA Cluster: Fourteen of ninety-three quarterly reports were selected for testing. Two of fourteen reports selected for testing did not agree to supporting documentation. Employment Service Cluster: Reports for the 9/30/2022 and 6/30/2023 quarters were selected for testing. Individual quarterly reports are submitted for each program and reporting level which resulted in selecting fourteen out of twenty-six individual reports. Five of fourteen reports selected for testing did not agree to supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV-35786-21-55-5-25 (10/1/2020 – 12/31/2022), DV-37859-22-55-5-25 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR section 200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Per 2 CFR section 200.331 - Subrecipient and contractor determinations states, in part, that a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued from the programs and did not adequately monitor subrecipients. Context: WIOA Cluster: Six out of eighteen subrecipients were selected for testing. The following exceptions were noted: • For 6 of 6 subawards issued, the Federal Award Identification Number (FAIN) and Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. • For 1 of 6 subrecipients selected for testing, no subaward monitoring was performed during the audit period. • For 1 of 6 subrecipients selected for testing, subaward monitoring was not completed in accordance with the Department’s policy. • For 1 of 6 subrecipients selected for testing, a determination on whether the entity was a subrecipient was unable to be made based on the documentation provided. • One subrecipient was excluded from subrecipient testing based on auditor analysis that the entity did not meet the definition of a subrecipient. The Schedule of Expenditures of Federal Awards was not adjusted to reflect the classification change. Employment Service Cluster: Five out of sixteen subrecipients were selected for testing. The following exceptions were noted: • For 5 of 5 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: WIOA Cluster: Undetermined Employment Service Cluster: None Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV-35786-21-55-5-25 (10/1/2020 – 12/31/2022), DV-37859-22-55-5-25 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR section 200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Per 2 CFR section 200.331 - Subrecipient and contractor determinations states, in part, that a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued from the programs and did not adequately monitor subrecipients. Context: WIOA Cluster: Six out of eighteen subrecipients were selected for testing. The following exceptions were noted: • For 6 of 6 subawards issued, the Federal Award Identification Number (FAIN) and Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. • For 1 of 6 subrecipients selected for testing, no subaward monitoring was performed during the audit period. • For 1 of 6 subrecipients selected for testing, subaward monitoring was not completed in accordance with the Department’s policy. • For 1 of 6 subrecipients selected for testing, a determination on whether the entity was a subrecipient was unable to be made based on the documentation provided. • One subrecipient was excluded from subrecipient testing based on auditor analysis that the entity did not meet the definition of a subrecipient. The Schedule of Expenditures of Federal Awards was not adjusted to reflect the classification change. Employment Service Cluster: Five out of sixteen subrecipients were selected for testing. The following exceptions were noted: • For 5 of 5 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: WIOA Cluster: Undetermined Employment Service Cluster: None Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV-35786-21-55-5-25 (10/1/2020 – 12/31/2022), DV-37859-22-55-5-25 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR section 200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Per 2 CFR section 200.331 - Subrecipient and contractor determinations states, in part, that a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued from the programs and did not adequately monitor subrecipients. Context: WIOA Cluster: Six out of eighteen subrecipients were selected for testing. The following exceptions were noted: • For 6 of 6 subawards issued, the Federal Award Identification Number (FAIN) and Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. • For 1 of 6 subrecipients selected for testing, no subaward monitoring was performed during the audit period. • For 1 of 6 subrecipients selected for testing, subaward monitoring was not completed in accordance with the Department’s policy. • For 1 of 6 subrecipients selected for testing, a determination on whether the entity was a subrecipient was unable to be made based on the documentation provided. • One subrecipient was excluded from subrecipient testing based on auditor analysis that the entity did not meet the definition of a subrecipient. The Schedule of Expenditures of Federal Awards was not adjusted to reflect the classification change. Employment Service Cluster: Five out of sixteen subrecipients were selected for testing. The following exceptions were noted: • For 5 of 5 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: WIOA Cluster: Undetermined Employment Service Cluster: None Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV-35786-21-55-5-25 (10/1/2020 – 12/31/2022), DV-37859-22-55-5-25 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR section 200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Per 2 CFR section 200.331 - Subrecipient and contractor determinations states, in part, that a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued from the programs and did not adequately monitor subrecipients. Context: WIOA Cluster: Six out of eighteen subrecipients were selected for testing. The following exceptions were noted: • For 6 of 6 subawards issued, the Federal Award Identification Number (FAIN) and Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. • For 1 of 6 subrecipients selected for testing, no subaward monitoring was performed during the audit period. • For 1 of 6 subrecipients selected for testing, subaward monitoring was not completed in accordance with the Department’s policy. • For 1 of 6 subrecipients selected for testing, a determination on whether the entity was a subrecipient was unable to be made based on the documentation provided. • One subrecipient was excluded from subrecipient testing based on auditor analysis that the entity did not meet the definition of a subrecipient. The Schedule of Expenditures of Federal Awards was not adjusted to reflect the classification change. Employment Service Cluster: Five out of sixteen subrecipients were selected for testing. The following exceptions were noted: • For 5 of 5 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: WIOA Cluster: Undetermined Employment Service Cluster: None Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV-35786-21-55-5-25 (10/1/2020 – 12/31/2022), DV-37859-22-55-5-25 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR section 200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Per 2 CFR section 200.331 - Subrecipient and contractor determinations states, in part, that a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued from the programs and did not adequately monitor subrecipients. Context: WIOA Cluster: Six out of eighteen subrecipients were selected for testing. The following exceptions were noted: • For 6 of 6 subawards issued, the Federal Award Identification Number (FAIN) and Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. • For 1 of 6 subrecipients selected for testing, no subaward monitoring was performed during the audit period. • For 1 of 6 subrecipients selected for testing, subaward monitoring was not completed in accordance with the Department’s policy. • For 1 of 6 subrecipients selected for testing, a determination on whether the entity was a subrecipient was unable to be made based on the documentation provided. • One subrecipient was excluded from subrecipient testing based on auditor analysis that the entity did not meet the definition of a subrecipient. The Schedule of Expenditures of Federal Awards was not adjusted to reflect the classification change. Employment Service Cluster: Five out of sixteen subrecipients were selected for testing. The following exceptions were noted: • For 5 of 5 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: WIOA Cluster: Undetermined Employment Service Cluster: None Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: 2022-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS on a timely basis. Context: Six out of seventeen subawards were selected for testing. These six subawards were modified between one and five times after the initial award, for a total of twenty-seven transactions tested. Twenty-six of twenty-seven transactions tested were not submitted timely, ranging from four to eleven months late. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS and were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: 2022-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS on a timely basis. Context: Six out of seventeen subawards were selected for testing. These six subawards were modified between one and five times after the initial award, for a total of twenty-seven transactions tested. Twenty-six of twenty-seven transactions tested were not submitted timely, ranging from four to eleven months late. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS and were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: 2022-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS on a timely basis. Context: Six out of seventeen subawards were selected for testing. These six subawards were modified between one and five times after the initial award, for a total of twenty-seven transactions tested. Twenty-six of twenty-seven transactions tested were not submitted timely, ranging from four to eleven months late. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS and were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exceptions were noted: • Statewide Activities requirement 1: For 1 of 5 reports selected, the amount reported exceeded the allowable 15% cap, however, supporting documentation indicated that the Department did not exceed the 15% allowable amount. The Department corrected the reported amount for this earmark on a subsequent report after the error was identified by auditors. • Statewide Activities requirement 2: For 1 of 5 reports selected, a copy of the certified report was not maintained and available for auditor review. The ETA-9130 reports are prepared by the Department’s budget team and reviewed and certified by the Department’s federal grants director and the Department’s budget director. As part of this review process, earmarking requirements are reviewed to ensure compliance with federal regulations. The Department did not adhere to its standard operating procedures to maintain a copy of the certified report at the time of submission. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained copies of certified reports per its standard operating procedures. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Unable to determine. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, that the Department maintains copies of certified reports, and that reports are readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exceptions were noted: • Statewide Activities requirement 1: For 1 of 5 reports selected, the amount reported exceeded the allowable 15% cap, however, supporting documentation indicated that the Department did not exceed the 15% allowable amount. The Department corrected the reported amount for this earmark on a subsequent report after the error was identified by auditors. • Statewide Activities requirement 2: For 1 of 5 reports selected, a copy of the certified report was not maintained and available for auditor review. The ETA-9130 reports are prepared by the Department’s budget team and reviewed and certified by the Department’s federal grants director and the Department’s budget director. As part of this review process, earmarking requirements are reviewed to ensure compliance with federal regulations. The Department did not adhere to its standard operating procedures to maintain a copy of the certified report at the time of submission. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained copies of certified reports per its standard operating procedures. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Unable to determine. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, that the Department maintains copies of certified reports, and that reports are readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exceptions were noted: • Statewide Activities requirement 1: For 1 of 5 reports selected, the amount reported exceeded the allowable 15% cap, however, supporting documentation indicated that the Department did not exceed the 15% allowable amount. The Department corrected the reported amount for this earmark on a subsequent report after the error was identified by auditors. • Statewide Activities requirement 2: For 1 of 5 reports selected, a copy of the certified report was not maintained and available for auditor review. The ETA-9130 reports are prepared by the Department’s budget team and reviewed and certified by the Department’s federal grants director and the Department’s budget director. As part of this review process, earmarking requirements are reviewed to ensure compliance with federal regulations. The Department did not adhere to its standard operating procedures to maintain a copy of the certified report at the time of submission. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained copies of certified reports per its standard operating procedures. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Unable to determine. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, that the Department maintains copies of certified reports, and that reports are readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-015 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Executive Office of Housing and Livable Communities Federal Program: COVID-19 – Emergency Rental Assistance Program Assistance Listing Number: 21.023 Award Number and Year: ERA-1 (12/27/2020 – 9/30/2022), ERA-2 (5/1/2021 – 9/30/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) omitted required federal award information from subawards it issued from the program. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 8 of 8 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreements. • For 7 of 8 subawards issued, the name of the Federal awarding agency, pass-through entity, and contact information for the awarding official of the pass-through entity were not included on the subaward agreements. • For 3 of 8 subawards issued, the assistance listing number and program title were not included on the subaward agreements. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: The Commonwealth was not in compliance with 2 CFR section 200.332(a). Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-016 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Executive Office of Housing and Livable Communities Federal Program: COVID-19 – Emergency Rental Assistance Program Assistance Listing Number: 21.023 Award Number and Year: ERA-2 (5/1/2021 – 9/30/2025) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per Frequently Asked Questions program guidance provided by the U.S. Department of the Treasury, a grantee may only use the funds provided in the Emergency Rental Assistance (ERA) program to provide financial assistance and housing stability services to eligible households. To be eligible, a household must be obligated to pay rent on a residential dwelling and the grantee must determine that: a. One or more individuals within the household has qualified for unemployment benefits or experienced a reduction in household income, incurred significant costs, or experienced other financial hardship during or due, directly or indirectly, to the coronavirus pandemic; b. One or more individuals within the household can demonstrate a risk of experiencing homelessness or housing instability; and c. The household is a low-income family (as such term is defined in section 3(b) of the United States Housing Act of 1937 (42 U.S.C. 1437a(b))). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) provided program assistance to an ineligible participant of the program. Context: For one of sixty participants tested, the household income was incorrectly calculated. It was subsequently determined that the participant was ineligible to receive assistance under the program. Cause: In this instance, the Department’s procedures for the determination of eligibility were not properly implemented by the vendor to ensure that household income was properly calculated, and that assistance was provided only to eligible participants. Effect: Noncompliance with eligibility requirements occurred as the Department paid benefits to an ineligible participant of the program. Questioned costs: $5,822, the amount paid to an ineligible participant of the program. Recommendation: We recommend the Department work with their vendor who is determining eligibility to ensure procedures and controls are implemented to properly calculate household income and only provide assistance to eligible participants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-017 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: Title I Grants to Local Educational Agencies Assistance Listing Number: 84.010 Award Number and Year: S010A210021 (7/1/2021 – 9/30/2022), S010A220021 (7/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Seventeen of forty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards were reported from 1 to 5 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS during FY 2023. Context: None of the seven subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $23,692,202 and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS during FY 2023. Context: None of the seven subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $23,692,202 and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS during FY 2023. Context: None of the seven subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $23,692,202 and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS during FY 2023. Context: None of the seven subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $23,692,202 and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS during FY 2023. Context: None of the seven subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $23,692,202 and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Earmarking- Administrative Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): A State agency which serves a State with multiple planning and service areas, not listed in (1)(b) below, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)); After a state determines the amount to be applied to state plan administration under 42 USC 3028 (b), the state may: (a) Use up to (and including) 10 percent of that amount available for the administration of area plans where the state calculates the 10 percent based on the amount remaining after deducting the amount to be applied to state plan administration (42 USC 3024(d)(1)(A)); and (b) Use any amounts available to the state for state plan administration which the state determines are not needed for that purpose to supplement the amount available for administration of area plans (42 USC 3028(a)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) calculation to determine the 5% administrative earmark contained grant awards for ALN 93.043, and 93.052 which are not part of the federal aging cluster. This error resulted in the Department over spending administrative costs, for the aging cluster, by $105,694. Context: The 5% threshold for administrative cost is based on current year awards (non- COVID-19), two of five grant awards were incorrectly included in the threshold calculation. Questioned costs: $105,694 reflects the administrative costs over the 5% threshold. Cause: The Department manages and combines the grants supporting the aging program when determining the 5% earmark threshold, two of the federal grants supporting the aging program are not part of the federal cluster. Effect: The Department is not in compliance with the earmark requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the federal requirements are performed for the applicable grants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Earmarking- Administrative Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): A State agency which serves a State with multiple planning and service areas, not listed in (1)(b) below, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)); After a state determines the amount to be applied to state plan administration under 42 USC 3028 (b), the state may: (a) Use up to (and including) 10 percent of that amount available for the administration of area plans where the state calculates the 10 percent based on the amount remaining after deducting the amount to be applied to state plan administration (42 USC 3024(d)(1)(A)); and (b) Use any amounts available to the state for state plan administration which the state determines are not needed for that purpose to supplement the amount available for administration of area plans (42 USC 3028(a)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) calculation to determine the 5% administrative earmark contained grant awards for ALN 93.043, and 93.052 which are not part of the federal aging cluster. This error resulted in the Department over spending administrative costs, for the aging cluster, by $105,694. Context: The 5% threshold for administrative cost is based on current year awards (non- COVID-19), two of five grant awards were incorrectly included in the threshold calculation. Questioned costs: $105,694 reflects the administrative costs over the 5% threshold. Cause: The Department manages and combines the grants supporting the aging program when determining the 5% earmark threshold, two of the federal grants supporting the aging program are not part of the federal cluster. Effect: The Department is not in compliance with the earmark requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the federal requirements are performed for the applicable grants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Earmarking- Administrative Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): A State agency which serves a State with multiple planning and service areas, not listed in (1)(b) below, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)); After a state determines the amount to be applied to state plan administration under 42 USC 3028 (b), the state may: (a) Use up to (and including) 10 percent of that amount available for the administration of area plans where the state calculates the 10 percent based on the amount remaining after deducting the amount to be applied to state plan administration (42 USC 3024(d)(1)(A)); and (b) Use any amounts available to the state for state plan administration which the state determines are not needed for that purpose to supplement the amount available for administration of area plans (42 USC 3028(a)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) calculation to determine the 5% administrative earmark contained grant awards for ALN 93.043, and 93.052 which are not part of the federal aging cluster. This error resulted in the Department over spending administrative costs, for the aging cluster, by $105,694. Context: The 5% threshold for administrative cost is based on current year awards (non- COVID-19), two of five grant awards were incorrectly included in the threshold calculation. Questioned costs: $105,694 reflects the administrative costs over the 5% threshold. Cause: The Department manages and combines the grants supporting the aging program when determining the 5% earmark threshold, two of the federal grants supporting the aging program are not part of the federal cluster. Effect: The Department is not in compliance with the earmark requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the federal requirements are performed for the applicable grants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Earmarking- Administrative Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): A State agency which serves a State with multiple planning and service areas, not listed in (1)(b) below, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)); After a state determines the amount to be applied to state plan administration under 42 USC 3028 (b), the state may: (a) Use up to (and including) 10 percent of that amount available for the administration of area plans where the state calculates the 10 percent based on the amount remaining after deducting the amount to be applied to state plan administration (42 USC 3024(d)(1)(A)); and (b) Use any amounts available to the state for state plan administration which the state determines are not needed for that purpose to supplement the amount available for administration of area plans (42 USC 3028(a)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) calculation to determine the 5% administrative earmark contained grant awards for ALN 93.043, and 93.052 which are not part of the federal aging cluster. This error resulted in the Department over spending administrative costs, for the aging cluster, by $105,694. Context: The 5% threshold for administrative cost is based on current year awards (non- COVID-19), two of five grant awards were incorrectly included in the threshold calculation. Questioned costs: $105,694 reflects the administrative costs over the 5% threshold. Cause: The Department manages and combines the grants supporting the aging program when determining the 5% earmark threshold, two of the federal grants supporting the aging program are not part of the federal cluster. Effect: The Department is not in compliance with the earmark requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the federal requirements are performed for the applicable grants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Earmarking- Administrative Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): A State agency which serves a State with multiple planning and service areas, not listed in (1)(b) below, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)); After a state determines the amount to be applied to state plan administration under 42 USC 3028 (b), the state may: (a) Use up to (and including) 10 percent of that amount available for the administration of area plans where the state calculates the 10 percent based on the amount remaining after deducting the amount to be applied to state plan administration (42 USC 3024(d)(1)(A)); and (b) Use any amounts available to the state for state plan administration which the state determines are not needed for that purpose to supplement the amount available for administration of area plans (42 USC 3028(a)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) calculation to determine the 5% administrative earmark contained grant awards for ALN 93.043, and 93.052 which are not part of the federal aging cluster. This error resulted in the Department over spending administrative costs, for the aging cluster, by $105,694. Context: The 5% threshold for administrative cost is based on current year awards (non- COVID-19), two of five grant awards were incorrectly included in the threshold calculation. Questioned costs: $105,694 reflects the administrative costs over the 5% threshold. Cause: The Department manages and combines the grants supporting the aging program when determining the 5% earmark threshold, two of the federal grants supporting the aging program are not part of the federal cluster. Effect: The Department is not in compliance with the earmark requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the federal requirements are performed for the applicable grants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs’ (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award dates were not provided to the subrecipients. Context: Seven of the seven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None noted. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs’ (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award dates were not provided to the subrecipients. Context: Seven of the seven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None noted. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs’ (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award dates were not provided to the subrecipients. Context: Seven of the seven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None noted. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs’ (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award dates were not provided to the subrecipients. Context: Seven of the seven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None noted. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs’ (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award dates were not provided to the subrecipients. Context: Seven of the seven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None noted. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 5 NH23IP922629-03 and 7/1/2019-6/30/2024 5 NH23IP922629-05 and 7/1/2019-6/30/2024 6 NH23IP922629-01 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-04 and 7/1/2019-6/30/2024 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information to FSRS during FY 2023. Context: None of the eight subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $11,088,762, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 5 NH23IP922629-03 and 7/1/2019-6/30/2024 5 NH23IP922629-05 and 7/1/2019-6/30/2024 6 NH23IP922629-01 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-04 and 7/1/2019-6/30/2024 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information to FSRS during FY 2023. Context: None of the eight subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $11,088,762, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Office for Refugees and Immigrants (ORI) Federal Program: Refugee and Entrant Assistance State Administered Programs Assistance Listing Number: 93.566 Award Number and Year: 2301MARCMA 00-02 and 10/1/2022-9/30/2023 2303MARCSSS 00-04 and 10/1/2022-9/30/2024 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Office for Refugees and Immigrants (ORI) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) was not provided to the subrecipients. Context: Ten of the ten subawards selected for testing did not contain the Federal Award Identification Number (FAIN). Questioned costs: Undetermined. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Refugee and Entrant Assistance State Administered Programs (Refugee) Opioid-STR Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse (SABG) Assistance Listing Number: 93.566, 93.788, 93.959 Award Number and Year: Refugee: ISAORIRHAP0826DPH22D and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23B and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23C and 10/1/2021-6/30/23 ISAORIRHAP0826DPH23D and 12/4/2023-6/30/23 Opioid: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) SABG: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award date were not provided to the subrecipient. Context: Refugee: Five of the five subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Opioid: Twelve of the twelve subawards selected for testing were missing the Federal Award Identification Number (FAIN) and the Federal Award Date. SABG: Eleven of the eleven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Refugee and Entrant Assistance State Administered Programs (Refugee) Opioid-STR Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse (SABG) Assistance Listing Number: 93.566, 93.788, 93.959 Award Number and Year: Refugee: ISAORIRHAP0826DPH22D and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23B and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23C and 10/1/2021-6/30/23 ISAORIRHAP0826DPH23D and 12/4/2023-6/30/23 Opioid: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) SABG: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award date were not provided to the subrecipient. Context: Refugee: Five of the five subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Opioid: Twelve of the twelve subawards selected for testing were missing the Federal Award Identification Number (FAIN) and the Federal Award Date. SABG: Eleven of the eleven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Refugee and Entrant Assistance State Administered Programs (Refugee) Opioid-STR Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse (SABG) Assistance Listing Number: 93.566, 93.788, 93.959 Award Number and Year: Refugee: ISAORIRHAP0826DPH22D and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23B and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23C and 10/1/2021-6/30/23 ISAORIRHAP0826DPH23D and 12/4/2023-6/30/23 Opioid: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) SABG: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award date were not provided to the subrecipient. Context: Refugee: Five of the five subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Opioid: Twelve of the twelve subawards selected for testing were missing the Federal Award Identification Number (FAIN) and the Federal Award Date. SABG: Eleven of the eleven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Refugee and Entrant Assistance State Administered Programs (Refugee) Opioid-STR Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse (SABG) Assistance Listing Number: 93.566, 93.788, 93.959 Award Number and Year: Refugee: ISAORIRHAP0826DPH22D and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23B and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23C and 10/1/2021-6/30/23 ISAORIRHAP0826DPH23D and 12/4/2023-6/30/23 Opioid: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) SABG: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award date were not provided to the subrecipient. Context: Refugee: Five of the five subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Opioid: Twelve of the twelve subawards selected for testing were missing the Federal Award Identification Number (FAIN) and the Federal Award Date. SABG: Eleven of the eleven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-026 Prior Year Finding: 2022-018 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101MAE5C6 (3/11/2021 – 9/30/2022) 2101MALIEA (10/10/2020 – 9/30/2022) 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) did not report subaward information to FSRS during FY 2023. Context: None of the nine subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $78,964,930, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-026 Prior Year Finding: 2022-018 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101MAE5C6 (3/11/2021 – 9/30/2022) 2101MALIEA (10/10/2020 – 9/30/2022) 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) did not report subaward information to FSRS during FY 2023. Context: None of the nine subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $78,964,930, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-027 Prior Year Finding: 2022-019 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101MAE5C6 (3/11/2021 – 9/30/2022) 2101MALIEA (10/10/2020 – 9/30/2022) 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Reporting – Special Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) – As part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. Territories with annual allotments of less than $200,000 and all Native American tribes are required to report only on the number of households served for each program component. Quarterly Performance and Management Report (OMB No. 0970-0589) – Grant recipients must submit data and information about LIHEAP during the current fiscal year (FY) to the Federal LIHEAP Office; including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, and training and technical assistance needs. The quarterly reports are due to the Federal LIHEAP Office one month after the end of each calendar quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Special reports submitted by the Executive Office of Housing and Livable Communities (Department) did not agree to supporting documentation. In addition, the Department did not submit special reports timely. Context: Exceptions were noted for 1 of 1 Annual Report on Households Assisted by LIHEAP and 2 of 2 Quarterly Performance and Management Reports selected for testing. Specifically, we noted the following exceptions: • The Annual Report on Households Assisted by LIHEAP was not submitted timely. The report was due on December 30, 2022 but was not submitted until January 11, 2023, or 12 days late. • Several line items on the Annual Report on Households Assisted by LIHEAP did not agree to supporting documentation. The Nominal Payments were underreported by 7.5% and the Number of Assisted Households by Poverty Interval was understated by 90%. • Two of two Quarterly Performance and Management Reports selected for testing did not agree to supporting documentation. Specific line items that did not agree to supporting documentation are: o Section 1 – Total Households Assisted, Line 1 – Number of assisted households and Line 2 - Number of Assisted Households During the Same Period Last Year for the 9/30/2022 Quarterly Report o Section 2 – Performance Management, Line 1 - Number of Occurrences of households where LIHEAP prevented the loss of home energy and Line 2 - Number of Occurrences of households where LIHEAP restored home energy for the 9/30/2022 and 6/30/2023 Quarterly Reports Questioned costs: None. Cause: The Department’s procedures were not sufficient to ensure that special reports were submitted timely nor that information was submitted accurately and agreed with supporting documentation. Internal controls were not sufficient to prevent or detect the errors prior to submission. Effect: Delays and inaccuracies in submission of special reports could impact the Federal agency’s ability to manage the program, could result in delays in annual awards, and could result in possible penalties or sanctions imposed by the grantor. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that special reports are submitted timely and accurately, and that the information reported agrees to supporting documentation. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-027 Prior Year Finding: 2022-019 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101MAE5C6 (3/11/2021 – 9/30/2022) 2101MALIEA (10/10/2020 – 9/30/2022) 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Reporting – Special Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) – As part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. Territories with annual allotments of less than $200,000 and all Native American tribes are required to report only on the number of households served for each program component. Quarterly Performance and Management Report (OMB No. 0970-0589) – Grant recipients must submit data and information about LIHEAP during the current fiscal year (FY) to the Federal LIHEAP Office; including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, and training and technical assistance needs. The quarterly reports are due to the Federal LIHEAP Office one month after the end of each calendar quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Special reports submitted by the Executive Office of Housing and Livable Communities (Department) did not agree to supporting documentation. In addition, the Department did not submit special reports timely. Context: Exceptions were noted for 1 of 1 Annual Report on Households Assisted by LIHEAP and 2 of 2 Quarterly Performance and Management Reports selected for testing. Specifically, we noted the following exceptions: • The Annual Report on Households Assisted by LIHEAP was not submitted timely. The report was due on December 30, 2022 but was not submitted until January 11, 2023, or 12 days late. • Several line items on the Annual Report on Households Assisted by LIHEAP did not agree to supporting documentation. The Nominal Payments were underreported by 7.5% and the Number of Assisted Households by Poverty Interval was understated by 90%. • Two of two Quarterly Performance and Management Reports selected for testing did not agree to supporting documentation. Specific line items that did not agree to supporting documentation are: o Section 1 – Total Households Assisted, Line 1 – Number of assisted households and Line 2 - Number of Assisted Households During the Same Period Last Year for the 9/30/2022 Quarterly Report o Section 2 – Performance Management, Line 1 - Number of Occurrences of households where LIHEAP prevented the loss of home energy and Line 2 - Number of Occurrences of households where LIHEAP restored home energy for the 9/30/2022 and 6/30/2023 Quarterly Reports Questioned costs: None. Cause: The Department’s procedures were not sufficient to ensure that special reports were submitted timely nor that information was submitted accurately and agreed with supporting documentation. Internal controls were not sufficient to prevent or detect the errors prior to submission. Effect: Delays and inaccuracies in submission of special reports could impact the Federal agency’s ability to manage the program, could result in delays in annual awards, and could result in possible penalties or sanctions imposed by the grantor. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that special reports are submitted timely and accurately, and that the information reported agrees to supporting documentation. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-028 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) omitted required federal award information from subawards it issued from the program. Context: Nine subawards were selected for testing and the following exceptions were noted: • For 9 of 9 subawards issued, the Federal award date of award to the recipient by the Federal agency was not included on the subaward agreement. • For 4 of 9 subawards issued, the Federal Award Identification Number (FAIN) was not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: The Commonwealth was not in compliance with 2 CFR section 200.332(a). Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-028 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) omitted required federal award information from subawards it issued from the program. Context: Nine subawards were selected for testing and the following exceptions were noted: • For 9 of 9 subawards issued, the Federal award date of award to the recipient by the Federal agency was not included on the subaward agreement. • For 4 of 9 subawards issued, the Federal Award Identification Number (FAIN) was not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: The Commonwealth was not in compliance with 2 CFR section 200.332(a). Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Claims were paid to providers whose eligibility was not properly documented. The Executive Office of Health and Human Services (Department) was unable to provide documentation to support that provider eligibility recertifications were performed timely, nor did it terminate a provider that failed to comply with eligibility requirements. Context: Sixty providers were selected for testing and the following exceptions were noted: • For five of sixty providers selected for testing, the Department was unable to provide documentation to support that eligibility recertifications had been performed timely. The revalidations were not completed by the third-party administrator within the required five-year cycle. • For one of sixty providers selected for testing, the provider failed to comply with eligibility requirements and the Department did not terminate the provider’s services. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the timely performance of provider eligibility recertifications nor to ensure that providers out of compliance with eligibility requirements were terminated. Internal controls did not prevent or detect the errors. Effect: Claims were paid to providers whose eligibility was not properly documented. Questioned costs: $11,885, the amount of claims paid to ineligible providers. Recommendation: We recommend that the Department enhance its procedures and controls to ensure it maintains documentation to support the timely performance of provider eligibility recertifications, that providers out of compliance with eligibility requirements are terminated timely, and that claims are not paid to ineligible providers. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Claims were paid to providers whose eligibility was not properly documented. The Executive Office of Health and Human Services (Department) was unable to provide documentation to support that provider eligibility recertifications were performed timely, nor did it terminate a provider that failed to comply with eligibility requirements. Context: Sixty providers were selected for testing and the following exceptions were noted: • For five of sixty providers selected for testing, the Department was unable to provide documentation to support that eligibility recertifications had been performed timely. The revalidations were not completed by the third-party administrator within the required five-year cycle. • For one of sixty providers selected for testing, the provider failed to comply with eligibility requirements and the Department did not terminate the provider’s services. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the timely performance of provider eligibility recertifications nor to ensure that providers out of compliance with eligibility requirements were terminated. Internal controls did not prevent or detect the errors. Effect: Claims were paid to providers whose eligibility was not properly documented. Questioned costs: $11,885, the amount of claims paid to ineligible providers. Recommendation: We recommend that the Department enhance its procedures and controls to ensure it maintains documentation to support the timely performance of provider eligibility recertifications, that providers out of compliance with eligibility requirements are terminated timely, and that claims are not paid to ineligible providers. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Claims were paid to providers whose eligibility was not properly documented. The Executive Office of Health and Human Services (Department) was unable to provide documentation to support that provider eligibility recertifications were performed timely, nor did it terminate a provider that failed to comply with eligibility requirements. Context: Sixty providers were selected for testing and the following exceptions were noted: • For five of sixty providers selected for testing, the Department was unable to provide documentation to support that eligibility recertifications had been performed timely. The revalidations were not completed by the third-party administrator within the required five-year cycle. • For one of sixty providers selected for testing, the provider failed to comply with eligibility requirements and the Department did not terminate the provider’s services. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the timely performance of provider eligibility recertifications nor to ensure that providers out of compliance with eligibility requirements were terminated. Internal controls did not prevent or detect the errors. Effect: Claims were paid to providers whose eligibility was not properly documented. Questioned costs: $11,885, the amount of claims paid to ineligible providers. Recommendation: We recommend that the Department enhance its procedures and controls to ensure it maintains documentation to support the timely performance of provider eligibility recertifications, that providers out of compliance with eligibility requirements are terminated timely, and that claims are not paid to ineligible providers. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Claims were paid to providers whose eligibility was not properly documented. The Executive Office of Health and Human Services (Department) was unable to provide documentation to support that provider eligibility recertifications were performed timely, nor did it terminate a provider that failed to comply with eligibility requirements. Context: Sixty providers were selected for testing and the following exceptions were noted: • For five of sixty providers selected for testing, the Department was unable to provide documentation to support that eligibility recertifications had been performed timely. The revalidations were not completed by the third-party administrator within the required five-year cycle. • For one of sixty providers selected for testing, the provider failed to comply with eligibility requirements and the Department did not terminate the provider’s services. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the timely performance of provider eligibility recertifications nor to ensure that providers out of compliance with eligibility requirements were terminated. Internal controls did not prevent or detect the errors. Effect: Claims were paid to providers whose eligibility was not properly documented. Questioned costs: $11,885, the amount of claims paid to ineligible providers. Recommendation: We recommend that the Department enhance its procedures and controls to ensure it maintains documentation to support the timely performance of provider eligibility recertifications, that providers out of compliance with eligibility requirements are terminated timely, and that claims are not paid to ineligible providers. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Claims were paid to providers whose eligibility was not properly documented. The Executive Office of Health and Human Services (Department) was unable to provide documentation to support that provider eligibility recertifications were performed timely, nor did it terminate a provider that failed to comply with eligibility requirements. Context: Sixty providers were selected for testing and the following exceptions were noted: • For five of sixty providers selected for testing, the Department was unable to provide documentation to support that eligibility recertifications had been performed timely. The revalidations were not completed by the third-party administrator within the required five-year cycle. • For one of sixty providers selected for testing, the provider failed to comply with eligibility requirements and the Department did not terminate the provider’s services. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the timely performance of provider eligibility recertifications nor to ensure that providers out of compliance with eligibility requirements were terminated. Internal controls did not prevent or detect the errors. Effect: Claims were paid to providers whose eligibility was not properly documented. Questioned costs: $11,885, the amount of claims paid to ineligible providers. Recommendation: We recommend that the Department enhance its procedures and controls to ensure it maintains documentation to support the timely performance of provider eligibility recertifications, that providers out of compliance with eligibility requirements are terminated timely, and that claims are not paid to ineligible providers. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation that it had reviewed provider Service Organization Controls (SOC) reports. Context: For three of four ADP systems selected for testing, the Department was unable to provide documentation that the providers’ SOC reports had been reviewed nor that it followed up on findings identified in the reports. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the review of ADP system SOC reports and related follow-up. Effect: Failure to develop and implement procedures to document review of ADP system SOC reports could leave the systems vulnerable to potential security risks. The Department is unable to provide assurance that the systems are adequately controlled nor that they properly safeguard sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that it reviews ADP system SOC reports on a timely basis and that it performs necessary follow-up actions on a timely basis. We further recommend that the Department maintains documentation of SOC report review and follow-up actions taken and that this documentation is readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation that it had reviewed provider Service Organization Controls (SOC) reports. Context: For three of four ADP systems selected for testing, the Department was unable to provide documentation that the providers’ SOC reports had been reviewed nor that it followed up on findings identified in the reports. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the review of ADP system SOC reports and related follow-up. Effect: Failure to develop and implement procedures to document review of ADP system SOC reports could leave the systems vulnerable to potential security risks. The Department is unable to provide assurance that the systems are adequately controlled nor that they properly safeguard sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that it reviews ADP system SOC reports on a timely basis and that it performs necessary follow-up actions on a timely basis. We further recommend that the Department maintains documentation of SOC report review and follow-up actions taken and that this documentation is readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation that it had reviewed provider Service Organization Controls (SOC) reports. Context: For three of four ADP systems selected for testing, the Department was unable to provide documentation that the providers’ SOC reports had been reviewed nor that it followed up on findings identified in the reports. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the review of ADP system SOC reports and related follow-up. Effect: Failure to develop and implement procedures to document review of ADP system SOC reports could leave the systems vulnerable to potential security risks. The Department is unable to provide assurance that the systems are adequately controlled nor that they properly safeguard sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that it reviews ADP system SOC reports on a timely basis and that it performs necessary follow-up actions on a timely basis. We further recommend that the Department maintains documentation of SOC report review and follow-up actions taken and that this documentation is readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation that it had reviewed provider Service Organization Controls (SOC) reports. Context: For three of four ADP systems selected for testing, the Department was unable to provide documentation that the providers’ SOC reports had been reviewed nor that it followed up on findings identified in the reports. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the review of ADP system SOC reports and related follow-up. Effect: Failure to develop and implement procedures to document review of ADP system SOC reports could leave the systems vulnerable to potential security risks. The Department is unable to provide assurance that the systems are adequately controlled nor that they properly safeguard sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that it reviews ADP system SOC reports on a timely basis and that it performs necessary follow-up actions on a timely basis. We further recommend that the Department maintains documentation of SOC report review and follow-up actions taken and that this documentation is readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation that it had reviewed provider Service Organization Controls (SOC) reports. Context: For three of four ADP systems selected for testing, the Department was unable to provide documentation that the providers’ SOC reports had been reviewed nor that it followed up on findings identified in the reports. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the review of ADP system SOC reports and related follow-up. Effect: Failure to develop and implement procedures to document review of ADP system SOC reports could leave the systems vulnerable to potential security risks. The Department is unable to provide assurance that the systems are adequately controlled nor that they properly safeguard sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that it reviews ADP system SOC reports on a timely basis and that it performs necessary follow-up actions on a timely basis. We further recommend that the Department maintains documentation of SOC report review and follow-up actions taken and that this documentation is readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Medical Loss Ratio (MLR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not ensure that all reports contained an attestation of accuracy regarding the calculation of the medical loss ratio. Context: For one of eight managed care organizations selected for testing, the report did not contain an attestation of the accuracy regarding the calculation of the medical loss ratio. The attestation was subsequently received after it was selected for audit. Cause: The Department’s procedures were not sufficient to ensure that reports received from managed care providers were complete and contained an attestation statement of the accuracy of the calculation of the medical loss ratio. Effect: The Department did not obtain assurance from the provider regarding the accuracy of the medical loss ratio calculation. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that reports submitted by its managed care providers include all required elements. If a report is incomplete, the Department should immediately follow-up with the provider to obtain the missing elements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Medical Loss Ratio (MLR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not ensure that all reports contained an attestation of accuracy regarding the calculation of the medical loss ratio. Context: For one of eight managed care organizations selected for testing, the report did not contain an attestation of the accuracy regarding the calculation of the medical loss ratio. The attestation was subsequently received after it was selected for audit. Cause: The Department’s procedures were not sufficient to ensure that reports received from managed care providers were complete and contained an attestation statement of the accuracy of the calculation of the medical loss ratio. Effect: The Department did not obtain assurance from the provider regarding the accuracy of the medical loss ratio calculation. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that reports submitted by its managed care providers include all required elements. If a report is incomplete, the Department should immediately follow-up with the provider to obtain the missing elements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Medical Loss Ratio (MLR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not ensure that all reports contained an attestation of accuracy regarding the calculation of the medical loss ratio. Context: For one of eight managed care organizations selected for testing, the report did not contain an attestation of the accuracy regarding the calculation of the medical loss ratio. The attestation was subsequently received after it was selected for audit. Cause: The Department’s procedures were not sufficient to ensure that reports received from managed care providers were complete and contained an attestation statement of the accuracy of the calculation of the medical loss ratio. Effect: The Department did not obtain assurance from the provider regarding the accuracy of the medical loss ratio calculation. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that reports submitted by its managed care providers include all required elements. If a report is incomplete, the Department should immediately follow-up with the provider to obtain the missing elements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Medical Loss Ratio (MLR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not ensure that all reports contained an attestation of accuracy regarding the calculation of the medical loss ratio. Context: For one of eight managed care organizations selected for testing, the report did not contain an attestation of the accuracy regarding the calculation of the medical loss ratio. The attestation was subsequently received after it was selected for audit. Cause: The Department’s procedures were not sufficient to ensure that reports received from managed care providers were complete and contained an attestation statement of the accuracy of the calculation of the medical loss ratio. Effect: The Department did not obtain assurance from the provider regarding the accuracy of the medical loss ratio calculation. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that reports submitted by its managed care providers include all required elements. If a report is incomplete, the Department should immediately follow-up with the provider to obtain the missing elements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Medical Loss Ratio (MLR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not ensure that all reports contained an attestation of accuracy regarding the calculation of the medical loss ratio. Context: For one of eight managed care organizations selected for testing, the report did not contain an attestation of the accuracy regarding the calculation of the medical loss ratio. The attestation was subsequently received after it was selected for audit. Cause: The Department’s procedures were not sufficient to ensure that reports received from managed care providers were complete and contained an attestation statement of the accuracy of the calculation of the medical loss ratio. Effect: The Department did not obtain assurance from the provider regarding the accuracy of the medical loss ratio calculation. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that reports submitted by its managed care providers include all required elements. If a report is incomplete, the Department should immediately follow-up with the provider to obtain the missing elements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For six of thirty-two overpayments selected for testing, the federal share to be returned for the 6/30/2023, 9/30/2023 and 12/31/2023 quarters were calculated incorrectly due to spreadsheet errors. The amounts reported in Column A - Total Computable on Line 9C1 were understated by $256,221 and the amounts reported in Column E - Total Federal Share on Line 9C1 were understated by $140,922. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The overpayments to be refunded were understated when reported on the CMS-64. Questioned costs: $397,143, which represents the total understatement of the reported federal share of overpayments to be refunded. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For six of thirty-two overpayments selected for testing, the federal share to be returned for the 6/30/2023, 9/30/2023 and 12/31/2023 quarters were calculated incorrectly due to spreadsheet errors. The amounts reported in Column A - Total Computable on Line 9C1 were understated by $256,221 and the amounts reported in Column E - Total Federal Share on Line 9C1 were understated by $140,922. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The overpayments to be refunded were understated when reported on the CMS-64. Questioned costs: $397,143, which represents the total understatement of the reported federal share of overpayments to be refunded. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For six of thirty-two overpayments selected for testing, the federal share to be returned for the 6/30/2023, 9/30/2023 and 12/31/2023 quarters were calculated incorrectly due to spreadsheet errors. The amounts reported in Column A - Total Computable on Line 9C1 were understated by $256,221 and the amounts reported in Column E - Total Federal Share on Line 9C1 were understated by $140,922. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The overpayments to be refunded were understated when reported on the CMS-64. Questioned costs: $397,143, which represents the total understatement of the reported federal share of overpayments to be refunded. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For six of thirty-two overpayments selected for testing, the federal share to be returned for the 6/30/2023, 9/30/2023 and 12/31/2023 quarters were calculated incorrectly due to spreadsheet errors. The amounts reported in Column A - Total Computable on Line 9C1 were understated by $256,221 and the amounts reported in Column E - Total Federal Share on Line 9C1 were understated by $140,922. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The overpayments to be refunded were understated when reported on the CMS-64. Questioned costs: $397,143, which represents the total understatement of the reported federal share of overpayments to be refunded. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For six of thirty-two overpayments selected for testing, the federal share to be returned for the 6/30/2023, 9/30/2023 and 12/31/2023 quarters were calculated incorrectly due to spreadsheet errors. The amounts reported in Column A - Total Computable on Line 9C1 were understated by $256,221 and the amounts reported in Column E - Total Federal Share on Line 9C1 were understated by $140,922. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The overpayments to be refunded were understated when reported on the CMS-64. Questioned costs: $397,143, which represents the total understatement of the reported federal share of overpayments to be refunded. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-033 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information to FSRS within thirty days after issuing the award. Due to documented issues with the process, we noted that the Department did not complete the reporting process prior to the end of the fiscal year. The Department’s first attempt to complete the reporting process was in October 2023, which was fiscal year 2024. Therefore, we did not select a sample for testing. Context: None of the nine subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $60,394,558, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-034 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Department: Dukes County Sheriff’s Office Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) Compliance Requirement: Allowable Cost/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR Section 200.430(I)(1) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass federally-assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Reserved (vii) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Dukes County Sheriff’s Office (Department) was unable to provide supporting documentation for salaries and wages charged to the program and charged salaries and wages to the program that did not agree with supporting documentation. Context: Forty timesheets were selected for testing and the following exceptions were noted: • For 1 of 40 timesheets, the Department was unable to provide documentation that the timesheet had been reviewed and approved by the employee’s supervisor. • For 2 of 40 timesheets, the Department was unable to provide supporting documentation for the time and effort charged to the program. • For 4 of 40 timesheets, 100% of the employees’ time and effort was charged to the program, but supporting documentation indicated that actual time worked on the program was less than 100%. Questioned costs: $7,587, which represents the amount charged to the program for which supporting documentation was unavailable. $5,383, which represents the difference between the supporting documentation and the amounts charged to the program. Cause: Controls were not operating effectively to ensure that time and effort reporting was performed and documented in accordance with federal requirements. Effect: There is an increased risk of charging unallowed payroll costs to the program. Recommendation: We recommend the Department enhance its procedures and internal controls, perform additional training over time and effort reporting, and ensure that documentation is maintained and readily available for audit. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) Compliance Requirement: Reporting – Government Performance and Results (GPRA) Reporting – Programmatic Progress Reports (PPR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: GPRA - All SAMHSA recipients are required to collect and report certain data so that SAMHSA can meet its obligations under the Government Performance and Results (GPRA) Modernization Act of 2010. This information will be gathered using SAMHSA’s Performance Accountability and Reporting System (SPARS). Data is collected via face-to-face interview using this tool at three data collection points: intake to services, six months post intake, and at discharge. Recipients will be expected to do a GPRA interview on all clients in their specified unduplicated target number and are also expected to achieve a six-month follow-up rate of 80 percent. Recipients are also required to report program-level data on a quarterly basis in SPARS. Recipients should enter their data within 1 day—but no later than 7 days—after the GPRA interview is conducted. This guidance applies to recipients who manually enter their data and batch upload their data. Recipients are required to report a series of data elements that will enable SAMHSA to determine the impact of the program on opioid use, and opioid-related morbidity and mortality. Recipients are required to report client-level data on elements including but not limited to: demographic characteristics, substance use, diagnosis(es) services received, types of MOUD received; length of stay in treatment; employment status, criminal justice involvement, and housing. Additional data elements will also be required and will be provided upon award. PPR- Recipients are required to submit Programmatic Progress Reports (PPR) at 6 months and 12 months. The six-month report is due no later than 30 days after the end of the second quarter of the budget period. The annual report is due within 90 days of the end of the budget period. Recipients are required to report on their progress addressing the goals and objectives identified in the Notice of Funding Opportunity, major accomplishments, progress achieved in addressing the needs of diverse populations, barriers encountered, and efforts to overcome these barriers. Recipients are required, with each report, to document Administrative and Data Collection costs to ensure the costs are compliant and do not exceed the cap. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: GPRA- The Department of Public Health (Department) was unable to provide documentation that the GPRA reports were adequately supported and that the Department submitted the report by the grantor’s due date. The reports contain numerous data points which is submitted to the grantor in an electronic format. The Department did not maintain the original data files used to create the report, the original files were changed at the request of the grantor. As a result, CLA was unable to agree some of the reported data to the files provided by the Department. In addition, the Department did not maintain documentation to support the timeliness of the submitted report. PPR- The Department of Public Health (Department) was unable to provide documentation that the PPR reports were reasonably supported by documentation, nor that the Department was in compliance with the report due date. The Department did not maintain the original data files used to compile the report, CLA was unable to agree some of the reported information to the files provided by the Department. In addition, the Department did not maintain documentation to support the timeliness of the submitted report. Context: GPRA- Two of five quarterly reports selected for testing did not agree with supporting documentation, CLA was unable to test key line items. Forty client-level reports were selected for testing, and the following exceptions were noted: • For 14 of 40 client-level reports, the provided supporting documentation was the overwritten version-based edits made by the Department at the instruction of the grantor. • For 6 of 40 client-level reports evidence of timely submission was not provided. PPR- Three Programmatic Progress Reports were due during FY 2023 and were selected for testing. The following exceptions were noted: • For 3 of 3 reports, documentation supporting the timeliness of submission was not provided. Therefore, auditors were unable to verify if the reports were submitted timely. • For 3 of 3 reports, documentation that the reports had been reviewed and approved prior to submission was not provided. • 3 of 3 reports did not agree with supporting documentation. Questioned costs: None for GPRA and PPR, noncompliance did not affect the allowability of program costs or activities. Cause: The Department did not establish effective procedures or internal controls to maintain the original data files and evidence of the date of the submitted report. Effect: The Department was unable to support that the GPRA and PPR reports were filed timely, and that the accuracy of the reported data was adequately supported. Recommendation: We recommend the Department implement controls and procedures to ensure that the GPRA and PPR reports are submitted timely, are supported by adequate documentation, and that supporting documentation is maintained and is readily available for audit. Views of responsible officials: There is no disagreement with the audit finding.

Reference Number: 2023-036 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Department: Hampden County Sheriff’s Office Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) Compliance Requirement: Suspension and Debarment Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. “Covered transactions” include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220. All non-procurement transactions entered into by a pass-through entity (i.e., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR section 180.215. When a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA), (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Hampden County Sheriff’s Office (Department) could not provide support that it ensured subrecipients were not suspended or debarred before issuing subawards to the entities. Context: The suspension and debarment status for 1 of 20 subrecipients selected for testing was not documented. Questioned costs: There are no questioned costs related to this finding as the vendors were not federally suspended or debarred. Cause: The Department did not establish effective internal controls for maintaining sufficient evidence that a suspension and debarment check was completed before issuing subawards. Effect: If the suspension and debarment status of subrecipients is not verified when entering into covered transactions, it is possible that a subaward could be issued to an ineligible entity. Recommendation: We recommend the Department implement controls and procedures to ensure it maintains documentation of suspension and debarments checks and that the documentation is available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-037 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Department of Public Health (Department) did not report subaward information to FSRS within thirty days after issuing the award. Due to documented issues with the process, we noted that the Department did not complete the reporting process prior to the end of the fiscal year. The Department’s first attempt to complete the reporting process was in October 2023, which was fiscal year 2024. Therefore, we did not select a sample for testing. Context: None of the nine subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $18,671,925, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-037 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Department of Public Health (Department) did not report subaward information to FSRS within thirty days after issuing the award. Due to documented issues with the process, we noted that the Department did not complete the reporting process prior to the end of the fiscal year. The Department’s first attempt to complete the reporting process was in October 2023, which was fiscal year 2024. Therefore, we did not select a sample for testing. Context: None of the nine subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $18,671,925, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Department of Public Health Federal Program: WIC Special Supplemental Nutrition Program for Women, Infants, and Children Assistance Listing Number: 10.557 Award Number and Year: 224MA702WI003 (10/1/2021 – 9/30/2022) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) charged costs to the federal grant after the end of the grant’s allowable period of performance. Context: One of forty expenditure transactions selected for testing was incurred after the end of the grant’s period of performance. The period of performance ended on September 30, 2022 and the expenditure was incurred on October 10, 2022. Funds were not encumbered prior to the end of the period of performance. Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures were charged to the correct grant year. The Department had a contract in place with the vendor but did not encumber funds for the transaction prior to September 30, 2022. Therefore, the expenditures should have been charged to the FFY2023 grant period. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended and/or obligated after the allowable period of performance. Questioned costs: None above reportable threshold. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. The Department should ensure that it encumbers funds prior to the end of the period of performance when appropriate. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Department of Public Health Federal Program: WIC Special Supplemental Nutrition Program for Women, Infants, and Children Assistance Listing Number: 10.557 Award Number and Year: 224MA702W1003 (10/1/2021 – 9/30/2022) 234MA702W1003 (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility- Subrecipient Agreements Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The subaward agreements issued to eligible subrecipients was did not contain all of the required data. The subaward agreements did not contain the federal award identification number (FAIN) or federal award date. Context: For 8 of 8 subawards selected for testing, the Federal Award Identification Number (FAIN) and Federal Award Date were not included in the agreement provided to the subrecipient. Questioned costs: None Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: The exclusion of required federal grant award information may cause subrecipients to be uninformed about specific program and regulatory information. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards and that proper subrecipient monitoring is conducted. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-005 Prior Year Finding: 2022-004 Federal Agency: U.S. Department of Agriculture State Agency: Department of Elementary and Secondary Education Federal Program: Child and Adult Care Food Program Assistance Listing Number: 10.558 Award Number and Year: 202222N202044 (10/1/2021 – 9/30/2022), 202323N202044 (10/1/2022 – 9/30/2023), 202323N119944 (1/1/2022 – 9/30/2023), 202323N202044 (10/1/2022 – 9/30/2023), 202323N119944 (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility, Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Eligibility – Per 7 CFR section 226.2, subrecipients must meet the definition of “independent center” or “sponsoring organization”. In addition, all institutions must also meet the eligibility requirements stated in 7 CFR section 226.15 and 42 USC 1766(a)(6) and (d)(l). Definitions include: 1) Independent center means a child care center, at-risk afterschool care center, emergency shelter, outside-school-hours care center or adult day care center which enters into an agreement with the state agency to assume final administrative and financial responsibility for program operations. 2) Sponsoring organization means a public or nonprofit private organization that is entirely responsible for the administration of the food program. 3) For-profit center means a child care center, outside-school-hours care center, or adult day care center providing nonresidential care to adults or children that does not qualify for tax-exempt status under the Internal Revenue Code of 1986. For-profit centers serving adults must meet the criteria described in paragraph (a) of this definition. For-profit centers serving children must meet the criteria described in paragraphs (b )(1) or (b )(2) of this definition, except that children who only participate in the at-risk afterschool snack and/or meal component of the program must not be considered in determining the percentages under paragraphs (b )( 1) or (b)(2) of this definition. Subrecipient Monitoring – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that it issued subawards in compliance with federal regulations. Context: Sixty subawards were selected for testing. The Department documents subrecipient eligibility in a permanent agreement with each subrecipient. The following exceptions were noted: • For one of sixty subawards selected for testing, the Department could not provide documentation that it had obtained the subrecipient’s Unique Entity Identifier prior to the issuance of the subaward. • For six of sixty subrecipients selected for testing, the Department did not have an approved permanent agreement on file prior to the start date of the contract. Therefore, the Department was unable to provide documentation that it had determined subrecipient eligibility prior to the start date of the contract. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were issued in compliance with federal regulations and that subrecipient eligibility was determined prior to issuance of contracts. Effect: Failure to ensure subrecipients are eligible to receive program funding and failure to ensure subrecipients have a registered unique entity identification number could result in unauthorized entities receiving program funding. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all subrecipients are eligible to receive program funds and that required information is obtained prior to entering into a subrecipient agreement. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-005 Prior Year Finding: 2022-004 Federal Agency: U.S. Department of Agriculture State Agency: Department of Elementary and Secondary Education Federal Program: Child and Adult Care Food Program Assistance Listing Number: 10.558 Award Number and Year: 202222N202044 (10/1/2021 – 9/30/2022), 202323N202044 (10/1/2022 – 9/30/2023), 202323N119944 (1/1/2022 – 9/30/2023), 202323N202044 (10/1/2022 – 9/30/2023), 202323N119944 (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility, Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Eligibility – Per 7 CFR section 226.2, subrecipients must meet the definition of “independent center” or “sponsoring organization”. In addition, all institutions must also meet the eligibility requirements stated in 7 CFR section 226.15 and 42 USC 1766(a)(6) and (d)(l). Definitions include: 1) Independent center means a child care center, at-risk afterschool care center, emergency shelter, outside-school-hours care center or adult day care center which enters into an agreement with the state agency to assume final administrative and financial responsibility for program operations. 2) Sponsoring organization means a public or nonprofit private organization that is entirely responsible for the administration of the food program. 3) For-profit center means a child care center, outside-school-hours care center, or adult day care center providing nonresidential care to adults or children that does not qualify for tax-exempt status under the Internal Revenue Code of 1986. For-profit centers serving adults must meet the criteria described in paragraph (a) of this definition. For-profit centers serving children must meet the criteria described in paragraphs (b )(1) or (b )(2) of this definition, except that children who only participate in the at-risk afterschool snack and/or meal component of the program must not be considered in determining the percentages under paragraphs (b )( 1) or (b)(2) of this definition. Subrecipient Monitoring – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that it issued subawards in compliance with federal regulations. Context: Sixty subawards were selected for testing. The Department documents subrecipient eligibility in a permanent agreement with each subrecipient. The following exceptions were noted: • For one of sixty subawards selected for testing, the Department could not provide documentation that it had obtained the subrecipient’s Unique Entity Identifier prior to the issuance of the subaward. • For six of sixty subrecipients selected for testing, the Department did not have an approved permanent agreement on file prior to the start date of the contract. Therefore, the Department was unable to provide documentation that it had determined subrecipient eligibility prior to the start date of the contract. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were issued in compliance with federal regulations and that subrecipient eligibility was determined prior to issuance of contracts. Effect: Failure to ensure subrecipients are eligible to receive program funding and failure to ensure subrecipients have a registered unique entity identification number could result in unauthorized entities receiving program funding. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all subrecipients are eligible to receive program funds and that required information is obtained prior to entering into a subrecipient agreement. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-006 Prior Year Finding: 2022-009 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024), UI356542155A25 (10/1/2020 – 12/31/2023) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). BAM estimates error rates, number of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not complete BAM case investigations within the time limits established in the ET Handbook No. 395. Context: Sixty cases were selected for testing. The Department did not meet the required time limits for closing cases within 60, 90 or 120 days. Specifically, we noted the following exceptions: • 68% of cases tested (41 of 60 cases) were closed within 60 days which is less than the required 70%. • 87% of cases tested (52 of 60 cases) were closed within 90 days which is less than the required 95%. • 93% of cases tested (56 of 60 cases) were closed within 120 days which is less than the required 98%. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met the required BAM investigation time limits for closing cases and to ensure all claim types were part of weekly testing. Effect: Noncompliance with BAM case investigation time limits could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395 and that both paid and denied claims are selected for testing. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-006 Prior Year Finding: 2022-009 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024), UI356542155A25 (10/1/2020 – 12/31/2023) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). BAM estimates error rates, number of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not complete BAM case investigations within the time limits established in the ET Handbook No. 395. Context: Sixty cases were selected for testing. The Department did not meet the required time limits for closing cases within 60, 90 or 120 days. Specifically, we noted the following exceptions: • 68% of cases tested (41 of 60 cases) were closed within 60 days which is less than the required 70%. • 87% of cases tested (52 of 60 cases) were closed within 90 days which is less than the required 95%. • 93% of cases tested (56 of 60 cases) were closed within 120 days which is less than the required 98%. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met the required BAM investigation time limits for closing cases and to ensure all claim types were part of weekly testing. Effect: Noncompliance with BAM case investigation time limits could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395 and that both paid and denied claims are selected for testing. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-007 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Eight subawards were selected for testing. The subawards were modified between one and two times after the initial award, for a total of twelve transactions tested. The following exceptions were noted: • Three of twelve transactions selected for testing were due from 2/28/2022 to 11/30/2022 but were not reported until 2/8/2023, or from 9 to 12 months after they were due. • Nine of twelve subawards were due from between 5/31/2022 to 7/31/2023 but were not reported until after they were tested by auditors in January 2024. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reviewed, approved and submitted timely to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved, and subsequently timely submitted to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-007 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Eight subawards were selected for testing. The subawards were modified between one and two times after the initial award, for a total of twelve transactions tested. The following exceptions were noted: • Three of twelve transactions selected for testing were due from 2/28/2022 to 11/30/2022 but were not reported until 2/8/2023, or from 9 to 12 months after they were due. • Nine of twelve subawards were due from between 5/31/2022 to 7/31/2023 but were not reported until after they were tested by auditors in January 2024. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reviewed, approved and submitted timely to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved, and subsequently timely submitted to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-008 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Earmarking Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) was unable to provide documentation of internal controls used to ensure compliance with the program’s earmarking requirements. Context: The allotment per the State Allotments (WIOA Title I & ES Federal to State Allocations) report supports that the earmarking requirements are met. For the one report selected for testing, the Department was unable to provide evidence that the report was reviewed and approved to demonstrate compliance with the earmarking requirements. Therefore, auditors were unable to test the internal controls over the earmarking requirement. Cause: The Department was unable to provide documentation of the internal controls implemented to ensure it correctly reported compliance with earmarking requirements. Effect: Insufficient controls over earmarking requirements can result in undetected reporting errors and noncompliance with earmarking requirements. Questioned costs: None. Recommendation: We recommend the Department develop and document internal controls over reporting earmarking requirements to ensure that reports are accurate and that earmarking requirements are met. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-008 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Earmarking Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) was unable to provide documentation of internal controls used to ensure compliance with the program’s earmarking requirements. Context: The allotment per the State Allotments (WIOA Title I & ES Federal to State Allocations) report supports that the earmarking requirements are met. For the one report selected for testing, the Department was unable to provide evidence that the report was reviewed and approved to demonstrate compliance with the earmarking requirements. Therefore, auditors were unable to test the internal controls over the earmarking requirement. Cause: The Department was unable to provide documentation of the internal controls implemented to ensure it correctly reported compliance with earmarking requirements. Effect: Insufficient controls over earmarking requirements can result in undetected reporting errors and noncompliance with earmarking requirements. Questioned costs: None. Recommendation: We recommend the Department develop and document internal controls over reporting earmarking requirements to ensure that reports are accurate and that earmarking requirements are met. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-009 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023) Compliance Requirement: Reporting – VETS-402(A/B) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: VETS-402 (A/B), Expenditure Detail Report – This expenditure and staff utilization report separately identifies Jobs for Veterans State Grant-expenditures each quarter and year-to-date as a supplement to the DVOP and LVER SF 425, Federal Financial Reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree with supporting documentation. Context: Four out of four quarterly reports were selected for testing. The following exceptions were noted: • For one report, the Department submitted the original report which was required to be resubmitted by the U.S. Department of Labor due to a reporting error. The Department submitted a revised report but did not maintain documentation for the adjustments made to the specific line items within the revised report. Expenditure amount for both the original and revised reports did not agree to supporting documentation. • For two reports, the expenditure amounts reported did not agree with supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that reports agreed with supporting documentation nor that it maintained supporting documentation for report revisions. Effect: Insufficient procedures and internal controls over the reporting can result in undetected reporting errors. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are accurately supported by documentation and substantiate the report balances. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-009 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023) Compliance Requirement: Reporting – VETS-402(A/B) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: VETS-402 (A/B), Expenditure Detail Report – This expenditure and staff utilization report separately identifies Jobs for Veterans State Grant-expenditures each quarter and year-to-date as a supplement to the DVOP and LVER SF 425, Federal Financial Reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree with supporting documentation. Context: Four out of four quarterly reports were selected for testing. The following exceptions were noted: • For one report, the Department submitted the original report which was required to be resubmitted by the U.S. Department of Labor due to a reporting error. The Department submitted a revised report but did not maintain documentation for the adjustments made to the specific line items within the revised report. Expenditure amount for both the original and revised reports did not agree to supporting documentation. • For two reports, the expenditure amounts reported did not agree with supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that reports agreed with supporting documentation nor that it maintained supporting documentation for report revisions. Effect: Insufficient procedures and internal controls over the reporting can result in undetected reporting errors. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are accurately supported by documentation and substantiate the report balances. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Sixty timesheets were selected for testing for the WIOA Cluster. Two of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. Sixty timesheets were selected for testing for the Employment Service Cluster (ESC). The following exceptions were noted: • Seven of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. • Two of sixty employee timesheets selected for testing charged costs to the program that did not relate to the ESC grant program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Additionally, unallowable costs were charged to the ESC grant program through the use of combination codes not associated with the program. Questioned costs: WIOA: Undetermined amount related to budgeted combination codes. ESC: $5,524, the amount charged to an unallowable combination code. Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Sixty timesheets were selected for testing for the WIOA Cluster. Two of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. Sixty timesheets were selected for testing for the Employment Service Cluster (ESC). The following exceptions were noted: • Seven of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. • Two of sixty employee timesheets selected for testing charged costs to the program that did not relate to the ESC grant program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Additionally, unallowable costs were charged to the ESC grant program through the use of combination codes not associated with the program. Questioned costs: WIOA: Undetermined amount related to budgeted combination codes. ESC: $5,524, the amount charged to an unallowable combination code. Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Sixty timesheets were selected for testing for the WIOA Cluster. Two of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. Sixty timesheets were selected for testing for the Employment Service Cluster (ESC). The following exceptions were noted: • Seven of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. • Two of sixty employee timesheets selected for testing charged costs to the program that did not relate to the ESC grant program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Additionally, unallowable costs were charged to the ESC grant program through the use of combination codes not associated with the program. Questioned costs: WIOA: Undetermined amount related to budgeted combination codes. ESC: $5,524, the amount charged to an unallowable combination code. Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Sixty timesheets were selected for testing for the WIOA Cluster. Two of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. Sixty timesheets were selected for testing for the Employment Service Cluster (ESC). The following exceptions were noted: • Seven of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. • Two of sixty employee timesheets selected for testing charged costs to the program that did not relate to the ESC grant program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Additionally, unallowable costs were charged to the ESC grant program through the use of combination codes not associated with the program. Questioned costs: WIOA: Undetermined amount related to budgeted combination codes. ESC: $5,524, the amount charged to an unallowable combination code. Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV357862155525 (10/1/2020 – 12/31/2022), DV378592255525 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Sixty timesheets were selected for testing for the WIOA Cluster. Two of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. Sixty timesheets were selected for testing for the Employment Service Cluster (ESC). The following exceptions were noted: • Seven of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. Therefore, the amount charged to the program was not based on the employee’s actual time and effort on the program. • Two of sixty employee timesheets selected for testing charged costs to the program that did not relate to the ESC grant program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Additionally, unallowable costs were charged to the ESC grant program through the use of combination codes not associated with the program. Questioned costs: WIOA: Undetermined amount related to budgeted combination codes. ESC: $5,524, the amount charged to an unallowable combination code. Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: 2022-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-36325-21-55-A-25 (7/1/2021 – 6/30/2024) ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree to supporting documentation. Context: WIOA Cluster: Fourteen of ninety-three quarterly reports were selected for testing. Two of fourteen reports selected for testing did not agree to supporting documentation. Employment Service Cluster: Reports for the 9/30/2022 and 6/30/2023 quarters were selected for testing. Individual quarterly reports are submitted for each program and reporting level which resulted in selecting fourteen out of twenty-six individual reports. Five of fourteen reports selected for testing did not agree to supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: 2022-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-36325-21-55-A-25 (7/1/2021 – 6/30/2024) ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree to supporting documentation. Context: WIOA Cluster: Fourteen of ninety-three quarterly reports were selected for testing. Two of fourteen reports selected for testing did not agree to supporting documentation. Employment Service Cluster: Reports for the 9/30/2022 and 6/30/2023 quarters were selected for testing. Individual quarterly reports are submitted for each program and reporting level which resulted in selecting fourteen out of twenty-six individual reports. Five of fourteen reports selected for testing did not agree to supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: 2022-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-36325-21-55-A-25 (7/1/2021 – 6/30/2024) ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree to supporting documentation. Context: WIOA Cluster: Fourteen of ninety-three quarterly reports were selected for testing. Two of fourteen reports selected for testing did not agree to supporting documentation. Employment Service Cluster: Reports for the 9/30/2022 and 6/30/2023 quarters were selected for testing. Individual quarterly reports are submitted for each program and reporting level which resulted in selecting fourteen out of twenty-six individual reports. Five of fourteen reports selected for testing did not agree to supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: 2022-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-36325-21-55-A-25 (7/1/2021 – 6/30/2024) ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree to supporting documentation. Context: WIOA Cluster: Fourteen of ninety-three quarterly reports were selected for testing. Two of fourteen reports selected for testing did not agree to supporting documentation. Employment Service Cluster: Reports for the 9/30/2022 and 6/30/2023 quarters were selected for testing. Individual quarterly reports are submitted for each program and reporting level which resulted in selecting fourteen out of twenty-six individual reports. Five of fourteen reports selected for testing did not agree to supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: 2022-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-36325-21-55-A-25 (7/1/2021 – 6/30/2024) ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree to supporting documentation. Context: WIOA Cluster: Fourteen of ninety-three quarterly reports were selected for testing. Two of fourteen reports selected for testing did not agree to supporting documentation. Employment Service Cluster: Reports for the 9/30/2022 and 6/30/2023 quarters were selected for testing. Individual quarterly reports are submitted for each program and reporting level which resulted in selecting fourteen out of twenty-six individual reports. Five of fourteen reports selected for testing did not agree to supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV-35786-21-55-5-25 (10/1/2020 – 12/31/2022), DV-37859-22-55-5-25 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR section 200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Per 2 CFR section 200.331 - Subrecipient and contractor determinations states, in part, that a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued from the programs and did not adequately monitor subrecipients. Context: WIOA Cluster: Six out of eighteen subrecipients were selected for testing. The following exceptions were noted: • For 6 of 6 subawards issued, the Federal Award Identification Number (FAIN) and Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. • For 1 of 6 subrecipients selected for testing, no subaward monitoring was performed during the audit period. • For 1 of 6 subrecipients selected for testing, subaward monitoring was not completed in accordance with the Department’s policy. • For 1 of 6 subrecipients selected for testing, a determination on whether the entity was a subrecipient was unable to be made based on the documentation provided. • One subrecipient was excluded from subrecipient testing based on auditor analysis that the entity did not meet the definition of a subrecipient. The Schedule of Expenditures of Federal Awards was not adjusted to reflect the classification change. Employment Service Cluster: Five out of sixteen subrecipients were selected for testing. The following exceptions were noted: • For 5 of 5 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: WIOA Cluster: Undetermined Employment Service Cluster: None Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV-35786-21-55-5-25 (10/1/2020 – 12/31/2022), DV-37859-22-55-5-25 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR section 200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Per 2 CFR section 200.331 - Subrecipient and contractor determinations states, in part, that a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued from the programs and did not adequately monitor subrecipients. Context: WIOA Cluster: Six out of eighteen subrecipients were selected for testing. The following exceptions were noted: • For 6 of 6 subawards issued, the Federal Award Identification Number (FAIN) and Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. • For 1 of 6 subrecipients selected for testing, no subaward monitoring was performed during the audit period. • For 1 of 6 subrecipients selected for testing, subaward monitoring was not completed in accordance with the Department’s policy. • For 1 of 6 subrecipients selected for testing, a determination on whether the entity was a subrecipient was unable to be made based on the documentation provided. • One subrecipient was excluded from subrecipient testing based on auditor analysis that the entity did not meet the definition of a subrecipient. The Schedule of Expenditures of Federal Awards was not adjusted to reflect the classification change. Employment Service Cluster: Five out of sixteen subrecipients were selected for testing. The following exceptions were noted: • For 5 of 5 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: WIOA Cluster: Undetermined Employment Service Cluster: None Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV-35786-21-55-5-25 (10/1/2020 – 12/31/2022), DV-37859-22-55-5-25 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR section 200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Per 2 CFR section 200.331 - Subrecipient and contractor determinations states, in part, that a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued from the programs and did not adequately monitor subrecipients. Context: WIOA Cluster: Six out of eighteen subrecipients were selected for testing. The following exceptions were noted: • For 6 of 6 subawards issued, the Federal Award Identification Number (FAIN) and Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. • For 1 of 6 subrecipients selected for testing, no subaward monitoring was performed during the audit period. • For 1 of 6 subrecipients selected for testing, subaward monitoring was not completed in accordance with the Department’s policy. • For 1 of 6 subrecipients selected for testing, a determination on whether the entity was a subrecipient was unable to be made based on the documentation provided. • One subrecipient was excluded from subrecipient testing based on auditor analysis that the entity did not meet the definition of a subrecipient. The Schedule of Expenditures of Federal Awards was not adjusted to reflect the classification change. Employment Service Cluster: Five out of sixteen subrecipients were selected for testing. The following exceptions were noted: • For 5 of 5 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: WIOA Cluster: Undetermined Employment Service Cluster: None Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV-35786-21-55-5-25 (10/1/2020 – 12/31/2022), DV-37859-22-55-5-25 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR section 200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Per 2 CFR section 200.331 - Subrecipient and contractor determinations states, in part, that a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued from the programs and did not adequately monitor subrecipients. Context: WIOA Cluster: Six out of eighteen subrecipients were selected for testing. The following exceptions were noted: • For 6 of 6 subawards issued, the Federal Award Identification Number (FAIN) and Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. • For 1 of 6 subrecipients selected for testing, no subaward monitoring was performed during the audit period. • For 1 of 6 subrecipients selected for testing, subaward monitoring was not completed in accordance with the Department’s policy. • For 1 of 6 subrecipients selected for testing, a determination on whether the entity was a subrecipient was unable to be made based on the documentation provided. • One subrecipient was excluded from subrecipient testing based on auditor analysis that the entity did not meet the definition of a subrecipient. The Schedule of Expenditures of Federal Awards was not adjusted to reflect the classification change. Employment Service Cluster: Five out of sixteen subrecipients were selected for testing. The following exceptions were noted: • For 5 of 5 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: WIOA Cluster: Undetermined Employment Service Cluster: None Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) ES333991955A25 (7/1/2019 – 9/30/2022), ES353492055A25 (7/1/2020 – 9/30/2023), ES367612155A25 (7/1/2021 – 9/30/2024), ES387362255A25 (7/1/2022 – 9/30/2025) DV-35786-21-55-5-25 (10/1/2020 – 12/31/2022), DV-37859-22-55-5-25 (10/1/2021 – 12/31/2023), 23555DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per 2 CFR section 200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Per 2 CFR section 200.331 - Subrecipient and contractor determinations states, in part, that a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued from the programs and did not adequately monitor subrecipients. Context: WIOA Cluster: Six out of eighteen subrecipients were selected for testing. The following exceptions were noted: • For 6 of 6 subawards issued, the Federal Award Identification Number (FAIN) and Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. • For 1 of 6 subrecipients selected for testing, no subaward monitoring was performed during the audit period. • For 1 of 6 subrecipients selected for testing, subaward monitoring was not completed in accordance with the Department’s policy. • For 1 of 6 subrecipients selected for testing, a determination on whether the entity was a subrecipient was unable to be made based on the documentation provided. • One subrecipient was excluded from subrecipient testing based on auditor analysis that the entity did not meet the definition of a subrecipient. The Schedule of Expenditures of Federal Awards was not adjusted to reflect the classification change. Employment Service Cluster: Five out of sixteen subrecipients were selected for testing. The following exceptions were noted: • For 5 of 5 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: WIOA Cluster: Undetermined Employment Service Cluster: None Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: 2022-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS on a timely basis. Context: Six out of seventeen subawards were selected for testing. These six subawards were modified between one and five times after the initial award, for a total of twenty-seven transactions tested. Twenty-six of twenty-seven transactions tested were not submitted timely, ranging from four to eleven months late. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS and were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: 2022-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS on a timely basis. Context: Six out of seventeen subawards were selected for testing. These six subawards were modified between one and five times after the initial award, for a total of twenty-seven transactions tested. Twenty-six of twenty-seven transactions tested were not submitted timely, ranging from four to eleven months late. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS and were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: 2022-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS on a timely basis. Context: Six out of seventeen subawards were selected for testing. These six subawards were modified between one and five times after the initial award, for a total of twenty-seven transactions tested. Twenty-six of twenty-seven transactions tested were not submitted timely, ranging from four to eleven months late. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS and were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exceptions were noted: • Statewide Activities requirement 1: For 1 of 5 reports selected, the amount reported exceeded the allowable 15% cap, however, supporting documentation indicated that the Department did not exceed the 15% allowable amount. The Department corrected the reported amount for this earmark on a subsequent report after the error was identified by auditors. • Statewide Activities requirement 2: For 1 of 5 reports selected, a copy of the certified report was not maintained and available for auditor review. The ETA-9130 reports are prepared by the Department’s budget team and reviewed and certified by the Department’s federal grants director and the Department’s budget director. As part of this review process, earmarking requirements are reviewed to ensure compliance with federal regulations. The Department did not adhere to its standard operating procedures to maintain a copy of the certified report at the time of submission. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained copies of certified reports per its standard operating procedures. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Unable to determine. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, that the Department maintains copies of certified reports, and that reports are readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exceptions were noted: • Statewide Activities requirement 1: For 1 of 5 reports selected, the amount reported exceeded the allowable 15% cap, however, supporting documentation indicated that the Department did not exceed the 15% allowable amount. The Department corrected the reported amount for this earmark on a subsequent report after the error was identified by auditors. • Statewide Activities requirement 2: For 1 of 5 reports selected, a copy of the certified report was not maintained and available for auditor review. The ETA-9130 reports are prepared by the Department’s budget team and reviewed and certified by the Department’s federal grants director and the Department’s budget director. As part of this review process, earmarking requirements are reviewed to ensure compliance with federal regulations. The Department did not adhere to its standard operating procedures to maintain a copy of the certified report at the time of submission. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained copies of certified reports per its standard operating procedures. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Unable to determine. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, that the Department maintains copies of certified reports, and that reports are readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024), AA-34774-20-55-A-25 (4/1/2020 – 6/30/2023) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exceptions were noted: • Statewide Activities requirement 1: For 1 of 5 reports selected, the amount reported exceeded the allowable 15% cap, however, supporting documentation indicated that the Department did not exceed the 15% allowable amount. The Department corrected the reported amount for this earmark on a subsequent report after the error was identified by auditors. • Statewide Activities requirement 2: For 1 of 5 reports selected, a copy of the certified report was not maintained and available for auditor review. The ETA-9130 reports are prepared by the Department’s budget team and reviewed and certified by the Department’s federal grants director and the Department’s budget director. As part of this review process, earmarking requirements are reviewed to ensure compliance with federal regulations. The Department did not adhere to its standard operating procedures to maintain a copy of the certified report at the time of submission. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained copies of certified reports per its standard operating procedures. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Unable to determine. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, that the Department maintains copies of certified reports, and that reports are readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-015 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Executive Office of Housing and Livable Communities Federal Program: COVID-19 – Emergency Rental Assistance Program Assistance Listing Number: 21.023 Award Number and Year: ERA-1 (12/27/2020 – 9/30/2022), ERA-2 (5/1/2021 – 9/30/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) omitted required federal award information from subawards it issued from the program. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 8 of 8 subawards issued, the Federal Award Identification Number (FAIN) and the Federal award date of award to the recipient by the Federal agency were not included on the subaward agreements. • For 7 of 8 subawards issued, the name of the Federal awarding agency, pass-through entity, and contact information for the awarding official of the pass-through entity were not included on the subaward agreements. • For 3 of 8 subawards issued, the assistance listing number and program title were not included on the subaward agreements. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: The Commonwealth was not in compliance with 2 CFR section 200.332(a). Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-016 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Executive Office of Housing and Livable Communities Federal Program: COVID-19 – Emergency Rental Assistance Program Assistance Listing Number: 21.023 Award Number and Year: ERA-2 (5/1/2021 – 9/30/2025) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per Frequently Asked Questions program guidance provided by the U.S. Department of the Treasury, a grantee may only use the funds provided in the Emergency Rental Assistance (ERA) program to provide financial assistance and housing stability services to eligible households. To be eligible, a household must be obligated to pay rent on a residential dwelling and the grantee must determine that: a. One or more individuals within the household has qualified for unemployment benefits or experienced a reduction in household income, incurred significant costs, or experienced other financial hardship during or due, directly or indirectly, to the coronavirus pandemic; b. One or more individuals within the household can demonstrate a risk of experiencing homelessness or housing instability; and c. The household is a low-income family (as such term is defined in section 3(b) of the United States Housing Act of 1937 (42 U.S.C. 1437a(b))). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) provided program assistance to an ineligible participant of the program. Context: For one of sixty participants tested, the household income was incorrectly calculated. It was subsequently determined that the participant was ineligible to receive assistance under the program. Cause: In this instance, the Department’s procedures for the determination of eligibility were not properly implemented by the vendor to ensure that household income was properly calculated, and that assistance was provided only to eligible participants. Effect: Noncompliance with eligibility requirements occurred as the Department paid benefits to an ineligible participant of the program. Questioned costs: $5,822, the amount paid to an ineligible participant of the program. Recommendation: We recommend the Department work with their vendor who is determining eligibility to ensure procedures and controls are implemented to properly calculate household income and only provide assistance to eligible participants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-017 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: Title I Grants to Local Educational Agencies Assistance Listing Number: 84.010 Award Number and Year: S010A210021 (7/1/2021 – 9/30/2022), S010A220021 (7/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Seventeen of forty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards were reported from 1 to 5 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/5/2021 – 9/30/2022) 8425D200025 (5/4/2020 – 9/30/2021) S425U210025 (3/4/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information to FSRS timely during FY 2023. Context: Twelve of sixty subawards selected for testing were not reported timely to FSRS during FY 2023. Subawards, which include subaward amendments, were reported from 1 to 242 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Massachusetts Executive Office of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief (GEER) Fund Assistance Listing Number: 84.425C Award Number and Year: S425C200005 (5/4/2020 – 9/30/2021) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that subawards it issued contained all required federal information. Context: One of sixty subawards selected for testing did not include the following required information: • Federal Award Identification Number (FAIN), • Federal Award Date of award to the recipient by the Federal agency, • Subaward Period of Performance Start and End Date, • Subaward Budget Period Start and End Date, • Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity, • Assistance Listing number and Title. Cause: The Department’s procedures and controls were not sufficient to ensure that it issued subawards in compliance with federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None noted. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS during FY 2023. Context: None of the seven subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $23,692,202 and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS during FY 2023. Context: None of the seven subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $23,692,202 and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS during FY 2023. Context: None of the seven subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $23,692,202 and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS during FY 2023. Context: None of the seven subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $23,692,202 and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS during FY 2023. Context: None of the seven subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $23,692,202 and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Earmarking- Administrative Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): A State agency which serves a State with multiple planning and service areas, not listed in (1)(b) below, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)); After a state determines the amount to be applied to state plan administration under 42 USC 3028 (b), the state may: (a) Use up to (and including) 10 percent of that amount available for the administration of area plans where the state calculates the 10 percent based on the amount remaining after deducting the amount to be applied to state plan administration (42 USC 3024(d)(1)(A)); and (b) Use any amounts available to the state for state plan administration which the state determines are not needed for that purpose to supplement the amount available for administration of area plans (42 USC 3028(a)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) calculation to determine the 5% administrative earmark contained grant awards for ALN 93.043, and 93.052 which are not part of the federal aging cluster. This error resulted in the Department over spending administrative costs, for the aging cluster, by $105,694. Context: The 5% threshold for administrative cost is based on current year awards (non- COVID-19), two of five grant awards were incorrectly included in the threshold calculation. Questioned costs: $105,694 reflects the administrative costs over the 5% threshold. Cause: The Department manages and combines the grants supporting the aging program when determining the 5% earmark threshold, two of the federal grants supporting the aging program are not part of the federal cluster. Effect: The Department is not in compliance with the earmark requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the federal requirements are performed for the applicable grants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Earmarking- Administrative Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): A State agency which serves a State with multiple planning and service areas, not listed in (1)(b) below, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)); After a state determines the amount to be applied to state plan administration under 42 USC 3028 (b), the state may: (a) Use up to (and including) 10 percent of that amount available for the administration of area plans where the state calculates the 10 percent based on the amount remaining after deducting the amount to be applied to state plan administration (42 USC 3024(d)(1)(A)); and (b) Use any amounts available to the state for state plan administration which the state determines are not needed for that purpose to supplement the amount available for administration of area plans (42 USC 3028(a)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) calculation to determine the 5% administrative earmark contained grant awards for ALN 93.043, and 93.052 which are not part of the federal aging cluster. This error resulted in the Department over spending administrative costs, for the aging cluster, by $105,694. Context: The 5% threshold for administrative cost is based on current year awards (non- COVID-19), two of five grant awards were incorrectly included in the threshold calculation. Questioned costs: $105,694 reflects the administrative costs over the 5% threshold. Cause: The Department manages and combines the grants supporting the aging program when determining the 5% earmark threshold, two of the federal grants supporting the aging program are not part of the federal cluster. Effect: The Department is not in compliance with the earmark requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the federal requirements are performed for the applicable grants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Earmarking- Administrative Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): A State agency which serves a State with multiple planning and service areas, not listed in (1)(b) below, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)); After a state determines the amount to be applied to state plan administration under 42 USC 3028 (b), the state may: (a) Use up to (and including) 10 percent of that amount available for the administration of area plans where the state calculates the 10 percent based on the amount remaining after deducting the amount to be applied to state plan administration (42 USC 3024(d)(1)(A)); and (b) Use any amounts available to the state for state plan administration which the state determines are not needed for that purpose to supplement the amount available for administration of area plans (42 USC 3028(a)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) calculation to determine the 5% administrative earmark contained grant awards for ALN 93.043, and 93.052 which are not part of the federal aging cluster. This error resulted in the Department over spending administrative costs, for the aging cluster, by $105,694. Context: The 5% threshold for administrative cost is based on current year awards (non- COVID-19), two of five grant awards were incorrectly included in the threshold calculation. Questioned costs: $105,694 reflects the administrative costs over the 5% threshold. Cause: The Department manages and combines the grants supporting the aging program when determining the 5% earmark threshold, two of the federal grants supporting the aging program are not part of the federal cluster. Effect: The Department is not in compliance with the earmark requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the federal requirements are performed for the applicable grants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Earmarking- Administrative Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): A State agency which serves a State with multiple planning and service areas, not listed in (1)(b) below, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)); After a state determines the amount to be applied to state plan administration under 42 USC 3028 (b), the state may: (a) Use up to (and including) 10 percent of that amount available for the administration of area plans where the state calculates the 10 percent based on the amount remaining after deducting the amount to be applied to state plan administration (42 USC 3024(d)(1)(A)); and (b) Use any amounts available to the state for state plan administration which the state determines are not needed for that purpose to supplement the amount available for administration of area plans (42 USC 3028(a)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) calculation to determine the 5% administrative earmark contained grant awards for ALN 93.043, and 93.052 which are not part of the federal aging cluster. This error resulted in the Department over spending administrative costs, for the aging cluster, by $105,694. Context: The 5% threshold for administrative cost is based on current year awards (non- COVID-19), two of five grant awards were incorrectly included in the threshold calculation. Questioned costs: $105,694 reflects the administrative costs over the 5% threshold. Cause: The Department manages and combines the grants supporting the aging program when determining the 5% earmark threshold, two of the federal grants supporting the aging program are not part of the federal cluster. Effect: The Department is not in compliance with the earmark requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the federal requirements are performed for the applicable grants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Earmarking- Administrative Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): A State agency which serves a State with multiple planning and service areas, not listed in (1)(b) below, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)); After a state determines the amount to be applied to state plan administration under 42 USC 3028 (b), the state may: (a) Use up to (and including) 10 percent of that amount available for the administration of area plans where the state calculates the 10 percent based on the amount remaining after deducting the amount to be applied to state plan administration (42 USC 3024(d)(1)(A)); and (b) Use any amounts available to the state for state plan administration which the state determines are not needed for that purpose to supplement the amount available for administration of area plans (42 USC 3028(a)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) calculation to determine the 5% administrative earmark contained grant awards for ALN 93.043, and 93.052 which are not part of the federal aging cluster. This error resulted in the Department over spending administrative costs, for the aging cluster, by $105,694. Context: The 5% threshold for administrative cost is based on current year awards (non- COVID-19), two of five grant awards were incorrectly included in the threshold calculation. Questioned costs: $105,694 reflects the administrative costs over the 5% threshold. Cause: The Department manages and combines the grants supporting the aging program when determining the 5% earmark threshold, two of the federal grants supporting the aging program are not part of the federal cluster. Effect: The Department is not in compliance with the earmark requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the federal requirements are performed for the applicable grants. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs’ (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award dates were not provided to the subrecipients. Context: Seven of the seven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None noted. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs’ (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award dates were not provided to the subrecipients. Context: Seven of the seven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None noted. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs’ (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award dates were not provided to the subrecipients. Context: Seven of the seven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None noted. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs’ (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award dates were not provided to the subrecipients. Context: Seven of the seven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None noted. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6, 2101MACMC6, 2101MAHDC6 and 2021 (COVID-19) 2001MAHDC3, 2001MASSC3 and 2020 (COVID-19) 2201MAOANS-03 and 2022 2301MAOANS-03 and 2023 2201MAOASS and 2022 2301MAOASS and 2023 2201MAOACM and 2022 2301MAOACM and 2023 2201MAOAHD and 2022 2301MAOAHD and 2023 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs’ (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award dates were not provided to the subrecipients. Context: Seven of the seven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None noted. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 5 NH23IP922629-03 and 7/1/2019-6/30/2024 5 NH23IP922629-05 and 7/1/2019-6/30/2024 6 NH23IP922629-01 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-04 and 7/1/2019-6/30/2024 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information to FSRS during FY 2023. Context: None of the eight subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $11,088,762, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 5 NH23IP922629-03 and 7/1/2019-6/30/2024 5 NH23IP922629-05 and 7/1/2019-6/30/2024 6 NH23IP922629-01 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-02 and 7/1/2019-6/30/2024 6 NH23IP922629-04 and 7/1/2019-6/30/2024 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information to FSRS during FY 2023. Context: None of the eight subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $11,088,762, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Office for Refugees and Immigrants (ORI) Federal Program: Refugee and Entrant Assistance State Administered Programs Assistance Listing Number: 93.566 Award Number and Year: 2301MARCMA 00-02 and 10/1/2022-9/30/2023 2303MARCSSS 00-04 and 10/1/2022-9/30/2024 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Office for Refugees and Immigrants (ORI) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) was not provided to the subrecipients. Context: Ten of the ten subawards selected for testing did not contain the Federal Award Identification Number (FAIN). Questioned costs: Undetermined. Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Refugee and Entrant Assistance State Administered Programs (Refugee) Opioid-STR Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse (SABG) Assistance Listing Number: 93.566, 93.788, 93.959 Award Number and Year: Refugee: ISAORIRHAP0826DPH22D and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23B and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23C and 10/1/2021-6/30/23 ISAORIRHAP0826DPH23D and 12/4/2023-6/30/23 Opioid: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) SABG: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award date were not provided to the subrecipient. Context: Refugee: Five of the five subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Opioid: Twelve of the twelve subawards selected for testing were missing the Federal Award Identification Number (FAIN) and the Federal Award Date. SABG: Eleven of the eleven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Refugee and Entrant Assistance State Administered Programs (Refugee) Opioid-STR Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse (SABG) Assistance Listing Number: 93.566, 93.788, 93.959 Award Number and Year: Refugee: ISAORIRHAP0826DPH22D and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23B and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23C and 10/1/2021-6/30/23 ISAORIRHAP0826DPH23D and 12/4/2023-6/30/23 Opioid: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) SABG: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award date were not provided to the subrecipient. Context: Refugee: Five of the five subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Opioid: Twelve of the twelve subawards selected for testing were missing the Federal Award Identification Number (FAIN) and the Federal Award Date. SABG: Eleven of the eleven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Refugee and Entrant Assistance State Administered Programs (Refugee) Opioid-STR Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse (SABG) Assistance Listing Number: 93.566, 93.788, 93.959 Award Number and Year: Refugee: ISAORIRHAP0826DPH22D and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23B and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23C and 10/1/2021-6/30/23 ISAORIRHAP0826DPH23D and 12/4/2023-6/30/23 Opioid: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) SABG: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award date were not provided to the subrecipient. Context: Refugee: Five of the five subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Opioid: Twelve of the twelve subawards selected for testing were missing the Federal Award Identification Number (FAIN) and the Federal Award Date. SABG: Eleven of the eleven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Refugee and Entrant Assistance State Administered Programs (Refugee) Opioid-STR Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse (SABG) Assistance Listing Number: 93.566, 93.788, 93.959 Award Number and Year: Refugee: ISAORIRHAP0826DPH22D and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23B and 10/1/2021-9/30/22 ISAORIRHAP0826DPH23C and 10/1/2021-6/30/23 ISAORIRHAP0826DPH23D and 12/4/2023-6/30/23 Opioid: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) SABG: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Subrecipient Monitoring- Subaward Agreement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332-Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) subawards did not contain all required federal information. We noted that the Federal Award Identification Number (FAIN) and federal award date were not provided to the subrecipient. Context: Refugee: Five of the five subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Opioid: Twelve of the twelve subawards selected for testing were missing the Federal Award Identification Number (FAIN) and the Federal Award Date. SABG: Eleven of the eleven subawards selected for testing did not contain the Federal Award Identification Number (FAIN) and Federal Award Date. Questioned costs: None Cause: The Department utilizes a standard subaward that was not updated to include all federal subaward requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in all subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-026 Prior Year Finding: 2022-018 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101MAE5C6 (3/11/2021 – 9/30/2022) 2101MALIEA (10/10/2020 – 9/30/2022) 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) did not report subaward information to FSRS during FY 2023. Context: None of the nine subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $78,964,930, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-026 Prior Year Finding: 2022-018 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101MAE5C6 (3/11/2021 – 9/30/2022) 2101MALIEA (10/10/2020 – 9/30/2022) 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) did not report subaward information to FSRS during FY 2023. Context: None of the nine subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $78,964,930, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-027 Prior Year Finding: 2022-019 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101MAE5C6 (3/11/2021 – 9/30/2022) 2101MALIEA (10/10/2020 – 9/30/2022) 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Reporting – Special Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) – As part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. Territories with annual allotments of less than $200,000 and all Native American tribes are required to report only on the number of households served for each program component. Quarterly Performance and Management Report (OMB No. 0970-0589) – Grant recipients must submit data and information about LIHEAP during the current fiscal year (FY) to the Federal LIHEAP Office; including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, and training and technical assistance needs. The quarterly reports are due to the Federal LIHEAP Office one month after the end of each calendar quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Special reports submitted by the Executive Office of Housing and Livable Communities (Department) did not agree to supporting documentation. In addition, the Department did not submit special reports timely. Context: Exceptions were noted for 1 of 1 Annual Report on Households Assisted by LIHEAP and 2 of 2 Quarterly Performance and Management Reports selected for testing. Specifically, we noted the following exceptions: • The Annual Report on Households Assisted by LIHEAP was not submitted timely. The report was due on December 30, 2022 but was not submitted until January 11, 2023, or 12 days late. • Several line items on the Annual Report on Households Assisted by LIHEAP did not agree to supporting documentation. The Nominal Payments were underreported by 7.5% and the Number of Assisted Households by Poverty Interval was understated by 90%. • Two of two Quarterly Performance and Management Reports selected for testing did not agree to supporting documentation. Specific line items that did not agree to supporting documentation are: o Section 1 – Total Households Assisted, Line 1 – Number of assisted households and Line 2 - Number of Assisted Households During the Same Period Last Year for the 9/30/2022 Quarterly Report o Section 2 – Performance Management, Line 1 - Number of Occurrences of households where LIHEAP prevented the loss of home energy and Line 2 - Number of Occurrences of households where LIHEAP restored home energy for the 9/30/2022 and 6/30/2023 Quarterly Reports Questioned costs: None. Cause: The Department’s procedures were not sufficient to ensure that special reports were submitted timely nor that information was submitted accurately and agreed with supporting documentation. Internal controls were not sufficient to prevent or detect the errors prior to submission. Effect: Delays and inaccuracies in submission of special reports could impact the Federal agency’s ability to manage the program, could result in delays in annual awards, and could result in possible penalties or sanctions imposed by the grantor. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that special reports are submitted timely and accurately, and that the information reported agrees to supporting documentation. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-027 Prior Year Finding: 2022-019 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101MAE5C6 (3/11/2021 – 9/30/2022) 2101MALIEA (10/10/2020 – 9/30/2022) 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Reporting – Special Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) – As part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. Territories with annual allotments of less than $200,000 and all Native American tribes are required to report only on the number of households served for each program component. Quarterly Performance and Management Report (OMB No. 0970-0589) – Grant recipients must submit data and information about LIHEAP during the current fiscal year (FY) to the Federal LIHEAP Office; including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, and training and technical assistance needs. The quarterly reports are due to the Federal LIHEAP Office one month after the end of each calendar quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Special reports submitted by the Executive Office of Housing and Livable Communities (Department) did not agree to supporting documentation. In addition, the Department did not submit special reports timely. Context: Exceptions were noted for 1 of 1 Annual Report on Households Assisted by LIHEAP and 2 of 2 Quarterly Performance and Management Reports selected for testing. Specifically, we noted the following exceptions: • The Annual Report on Households Assisted by LIHEAP was not submitted timely. The report was due on December 30, 2022 but was not submitted until January 11, 2023, or 12 days late. • Several line items on the Annual Report on Households Assisted by LIHEAP did not agree to supporting documentation. The Nominal Payments were underreported by 7.5% and the Number of Assisted Households by Poverty Interval was understated by 90%. • Two of two Quarterly Performance and Management Reports selected for testing did not agree to supporting documentation. Specific line items that did not agree to supporting documentation are: o Section 1 – Total Households Assisted, Line 1 – Number of assisted households and Line 2 - Number of Assisted Households During the Same Period Last Year for the 9/30/2022 Quarterly Report o Section 2 – Performance Management, Line 1 - Number of Occurrences of households where LIHEAP prevented the loss of home energy and Line 2 - Number of Occurrences of households where LIHEAP restored home energy for the 9/30/2022 and 6/30/2023 Quarterly Reports Questioned costs: None. Cause: The Department’s procedures were not sufficient to ensure that special reports were submitted timely nor that information was submitted accurately and agreed with supporting documentation. Internal controls were not sufficient to prevent or detect the errors prior to submission. Effect: Delays and inaccuracies in submission of special reports could impact the Federal agency’s ability to manage the program, could result in delays in annual awards, and could result in possible penalties or sanctions imposed by the grantor. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that special reports are submitted timely and accurately, and that the information reported agrees to supporting documentation. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-028 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) omitted required federal award information from subawards it issued from the program. Context: Nine subawards were selected for testing and the following exceptions were noted: • For 9 of 9 subawards issued, the Federal award date of award to the recipient by the Federal agency was not included on the subaward agreement. • For 4 of 9 subawards issued, the Federal Award Identification Number (FAIN) was not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: The Commonwealth was not in compliance with 2 CFR section 200.332(a). Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-028 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) omitted required federal award information from subawards it issued from the program. Context: Nine subawards were selected for testing and the following exceptions were noted: • For 9 of 9 subawards issued, the Federal award date of award to the recipient by the Federal agency was not included on the subaward agreement. • For 4 of 9 subawards issued, the Federal Award Identification Number (FAIN) was not included on the subaward agreement. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: The Commonwealth was not in compliance with 2 CFR section 200.332(a). Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Claims were paid to providers whose eligibility was not properly documented. The Executive Office of Health and Human Services (Department) was unable to provide documentation to support that provider eligibility recertifications were performed timely, nor did it terminate a provider that failed to comply with eligibility requirements. Context: Sixty providers were selected for testing and the following exceptions were noted: • For five of sixty providers selected for testing, the Department was unable to provide documentation to support that eligibility recertifications had been performed timely. The revalidations were not completed by the third-party administrator within the required five-year cycle. • For one of sixty providers selected for testing, the provider failed to comply with eligibility requirements and the Department did not terminate the provider’s services. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the timely performance of provider eligibility recertifications nor to ensure that providers out of compliance with eligibility requirements were terminated. Internal controls did not prevent or detect the errors. Effect: Claims were paid to providers whose eligibility was not properly documented. Questioned costs: $11,885, the amount of claims paid to ineligible providers. Recommendation: We recommend that the Department enhance its procedures and controls to ensure it maintains documentation to support the timely performance of provider eligibility recertifications, that providers out of compliance with eligibility requirements are terminated timely, and that claims are not paid to ineligible providers. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Claims were paid to providers whose eligibility was not properly documented. The Executive Office of Health and Human Services (Department) was unable to provide documentation to support that provider eligibility recertifications were performed timely, nor did it terminate a provider that failed to comply with eligibility requirements. Context: Sixty providers were selected for testing and the following exceptions were noted: • For five of sixty providers selected for testing, the Department was unable to provide documentation to support that eligibility recertifications had been performed timely. The revalidations were not completed by the third-party administrator within the required five-year cycle. • For one of sixty providers selected for testing, the provider failed to comply with eligibility requirements and the Department did not terminate the provider’s services. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the timely performance of provider eligibility recertifications nor to ensure that providers out of compliance with eligibility requirements were terminated. Internal controls did not prevent or detect the errors. Effect: Claims were paid to providers whose eligibility was not properly documented. Questioned costs: $11,885, the amount of claims paid to ineligible providers. Recommendation: We recommend that the Department enhance its procedures and controls to ensure it maintains documentation to support the timely performance of provider eligibility recertifications, that providers out of compliance with eligibility requirements are terminated timely, and that claims are not paid to ineligible providers. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Claims were paid to providers whose eligibility was not properly documented. The Executive Office of Health and Human Services (Department) was unable to provide documentation to support that provider eligibility recertifications were performed timely, nor did it terminate a provider that failed to comply with eligibility requirements. Context: Sixty providers were selected for testing and the following exceptions were noted: • For five of sixty providers selected for testing, the Department was unable to provide documentation to support that eligibility recertifications had been performed timely. The revalidations were not completed by the third-party administrator within the required five-year cycle. • For one of sixty providers selected for testing, the provider failed to comply with eligibility requirements and the Department did not terminate the provider’s services. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the timely performance of provider eligibility recertifications nor to ensure that providers out of compliance with eligibility requirements were terminated. Internal controls did not prevent or detect the errors. Effect: Claims were paid to providers whose eligibility was not properly documented. Questioned costs: $11,885, the amount of claims paid to ineligible providers. Recommendation: We recommend that the Department enhance its procedures and controls to ensure it maintains documentation to support the timely performance of provider eligibility recertifications, that providers out of compliance with eligibility requirements are terminated timely, and that claims are not paid to ineligible providers. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Claims were paid to providers whose eligibility was not properly documented. The Executive Office of Health and Human Services (Department) was unable to provide documentation to support that provider eligibility recertifications were performed timely, nor did it terminate a provider that failed to comply with eligibility requirements. Context: Sixty providers were selected for testing and the following exceptions were noted: • For five of sixty providers selected for testing, the Department was unable to provide documentation to support that eligibility recertifications had been performed timely. The revalidations were not completed by the third-party administrator within the required five-year cycle. • For one of sixty providers selected for testing, the provider failed to comply with eligibility requirements and the Department did not terminate the provider’s services. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the timely performance of provider eligibility recertifications nor to ensure that providers out of compliance with eligibility requirements were terminated. Internal controls did not prevent or detect the errors. Effect: Claims were paid to providers whose eligibility was not properly documented. Questioned costs: $11,885, the amount of claims paid to ineligible providers. Recommendation: We recommend that the Department enhance its procedures and controls to ensure it maintains documentation to support the timely performance of provider eligibility recertifications, that providers out of compliance with eligibility requirements are terminated timely, and that claims are not paid to ineligible providers. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: 2022-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Claims were paid to providers whose eligibility was not properly documented. The Executive Office of Health and Human Services (Department) was unable to provide documentation to support that provider eligibility recertifications were performed timely, nor did it terminate a provider that failed to comply with eligibility requirements. Context: Sixty providers were selected for testing and the following exceptions were noted: • For five of sixty providers selected for testing, the Department was unable to provide documentation to support that eligibility recertifications had been performed timely. The revalidations were not completed by the third-party administrator within the required five-year cycle. • For one of sixty providers selected for testing, the provider failed to comply with eligibility requirements and the Department did not terminate the provider’s services. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the timely performance of provider eligibility recertifications nor to ensure that providers out of compliance with eligibility requirements were terminated. Internal controls did not prevent or detect the errors. Effect: Claims were paid to providers whose eligibility was not properly documented. Questioned costs: $11,885, the amount of claims paid to ineligible providers. Recommendation: We recommend that the Department enhance its procedures and controls to ensure it maintains documentation to support the timely performance of provider eligibility recertifications, that providers out of compliance with eligibility requirements are terminated timely, and that claims are not paid to ineligible providers. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation that it had reviewed provider Service Organization Controls (SOC) reports. Context: For three of four ADP systems selected for testing, the Department was unable to provide documentation that the providers’ SOC reports had been reviewed nor that it followed up on findings identified in the reports. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the review of ADP system SOC reports and related follow-up. Effect: Failure to develop and implement procedures to document review of ADP system SOC reports could leave the systems vulnerable to potential security risks. The Department is unable to provide assurance that the systems are adequately controlled nor that they properly safeguard sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that it reviews ADP system SOC reports on a timely basis and that it performs necessary follow-up actions on a timely basis. We further recommend that the Department maintains documentation of SOC report review and follow-up actions taken and that this documentation is readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation that it had reviewed provider Service Organization Controls (SOC) reports. Context: For three of four ADP systems selected for testing, the Department was unable to provide documentation that the providers’ SOC reports had been reviewed nor that it followed up on findings identified in the reports. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the review of ADP system SOC reports and related follow-up. Effect: Failure to develop and implement procedures to document review of ADP system SOC reports could leave the systems vulnerable to potential security risks. The Department is unable to provide assurance that the systems are adequately controlled nor that they properly safeguard sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that it reviews ADP system SOC reports on a timely basis and that it performs necessary follow-up actions on a timely basis. We further recommend that the Department maintains documentation of SOC report review and follow-up actions taken and that this documentation is readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation that it had reviewed provider Service Organization Controls (SOC) reports. Context: For three of four ADP systems selected for testing, the Department was unable to provide documentation that the providers’ SOC reports had been reviewed nor that it followed up on findings identified in the reports. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the review of ADP system SOC reports and related follow-up. Effect: Failure to develop and implement procedures to document review of ADP system SOC reports could leave the systems vulnerable to potential security risks. The Department is unable to provide assurance that the systems are adequately controlled nor that they properly safeguard sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that it reviews ADP system SOC reports on a timely basis and that it performs necessary follow-up actions on a timely basis. We further recommend that the Department maintains documentation of SOC report review and follow-up actions taken and that this documentation is readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation that it had reviewed provider Service Organization Controls (SOC) reports. Context: For three of four ADP systems selected for testing, the Department was unable to provide documentation that the providers’ SOC reports had been reviewed nor that it followed up on findings identified in the reports. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the review of ADP system SOC reports and related follow-up. Effect: Failure to develop and implement procedures to document review of ADP system SOC reports could leave the systems vulnerable to potential security risks. The Department is unable to provide assurance that the systems are adequately controlled nor that they properly safeguard sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that it reviews ADP system SOC reports on a timely basis and that it performs necessary follow-up actions on a timely basis. We further recommend that the Department maintains documentation of SOC report review and follow-up actions taken and that this documentation is readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation that it had reviewed provider Service Organization Controls (SOC) reports. Context: For three of four ADP systems selected for testing, the Department was unable to provide documentation that the providers’ SOC reports had been reviewed nor that it followed up on findings identified in the reports. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation to support the review of ADP system SOC reports and related follow-up. Effect: Failure to develop and implement procedures to document review of ADP system SOC reports could leave the systems vulnerable to potential security risks. The Department is unable to provide assurance that the systems are adequately controlled nor that they properly safeguard sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that it reviews ADP system SOC reports on a timely basis and that it performs necessary follow-up actions on a timely basis. We further recommend that the Department maintains documentation of SOC report review and follow-up actions taken and that this documentation is readily available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Medical Loss Ratio (MLR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not ensure that all reports contained an attestation of accuracy regarding the calculation of the medical loss ratio. Context: For one of eight managed care organizations selected for testing, the report did not contain an attestation of the accuracy regarding the calculation of the medical loss ratio. The attestation was subsequently received after it was selected for audit. Cause: The Department’s procedures were not sufficient to ensure that reports received from managed care providers were complete and contained an attestation statement of the accuracy of the calculation of the medical loss ratio. Effect: The Department did not obtain assurance from the provider regarding the accuracy of the medical loss ratio calculation. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that reports submitted by its managed care providers include all required elements. If a report is incomplete, the Department should immediately follow-up with the provider to obtain the missing elements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Medical Loss Ratio (MLR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not ensure that all reports contained an attestation of accuracy regarding the calculation of the medical loss ratio. Context: For one of eight managed care organizations selected for testing, the report did not contain an attestation of the accuracy regarding the calculation of the medical loss ratio. The attestation was subsequently received after it was selected for audit. Cause: The Department’s procedures were not sufficient to ensure that reports received from managed care providers were complete and contained an attestation statement of the accuracy of the calculation of the medical loss ratio. Effect: The Department did not obtain assurance from the provider regarding the accuracy of the medical loss ratio calculation. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that reports submitted by its managed care providers include all required elements. If a report is incomplete, the Department should immediately follow-up with the provider to obtain the missing elements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Medical Loss Ratio (MLR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not ensure that all reports contained an attestation of accuracy regarding the calculation of the medical loss ratio. Context: For one of eight managed care organizations selected for testing, the report did not contain an attestation of the accuracy regarding the calculation of the medical loss ratio. The attestation was subsequently received after it was selected for audit. Cause: The Department’s procedures were not sufficient to ensure that reports received from managed care providers were complete and contained an attestation statement of the accuracy of the calculation of the medical loss ratio. Effect: The Department did not obtain assurance from the provider regarding the accuracy of the medical loss ratio calculation. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that reports submitted by its managed care providers include all required elements. If a report is incomplete, the Department should immediately follow-up with the provider to obtain the missing elements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Medical Loss Ratio (MLR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not ensure that all reports contained an attestation of accuracy regarding the calculation of the medical loss ratio. Context: For one of eight managed care organizations selected for testing, the report did not contain an attestation of the accuracy regarding the calculation of the medical loss ratio. The attestation was subsequently received after it was selected for audit. Cause: The Department’s procedures were not sufficient to ensure that reports received from managed care providers were complete and contained an attestation statement of the accuracy of the calculation of the medical loss ratio. Effect: The Department did not obtain assurance from the provider regarding the accuracy of the medical loss ratio calculation. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that reports submitted by its managed care providers include all required elements. If a report is incomplete, the Department should immediately follow-up with the provider to obtain the missing elements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Medical Loss Ratio (MLR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not ensure that all reports contained an attestation of accuracy regarding the calculation of the medical loss ratio. Context: For one of eight managed care organizations selected for testing, the report did not contain an attestation of the accuracy regarding the calculation of the medical loss ratio. The attestation was subsequently received after it was selected for audit. Cause: The Department’s procedures were not sufficient to ensure that reports received from managed care providers were complete and contained an attestation statement of the accuracy of the calculation of the medical loss ratio. Effect: The Department did not obtain assurance from the provider regarding the accuracy of the medical loss ratio calculation. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that reports submitted by its managed care providers include all required elements. If a report is incomplete, the Department should immediately follow-up with the provider to obtain the missing elements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For six of thirty-two overpayments selected for testing, the federal share to be returned for the 6/30/2023, 9/30/2023 and 12/31/2023 quarters were calculated incorrectly due to spreadsheet errors. The amounts reported in Column A - Total Computable on Line 9C1 were understated by $256,221 and the amounts reported in Column E - Total Federal Share on Line 9C1 were understated by $140,922. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The overpayments to be refunded were understated when reported on the CMS-64. Questioned costs: $397,143, which represents the total understatement of the reported federal share of overpayments to be refunded. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For six of thirty-two overpayments selected for testing, the federal share to be returned for the 6/30/2023, 9/30/2023 and 12/31/2023 quarters were calculated incorrectly due to spreadsheet errors. The amounts reported in Column A - Total Computable on Line 9C1 were understated by $256,221 and the amounts reported in Column E - Total Federal Share on Line 9C1 were understated by $140,922. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The overpayments to be refunded were understated when reported on the CMS-64. Questioned costs: $397,143, which represents the total understatement of the reported federal share of overpayments to be refunded. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For six of thirty-two overpayments selected for testing, the federal share to be returned for the 6/30/2023, 9/30/2023 and 12/31/2023 quarters were calculated incorrectly due to spreadsheet errors. The amounts reported in Column A - Total Computable on Line 9C1 were understated by $256,221 and the amounts reported in Column E - Total Federal Share on Line 9C1 were understated by $140,922. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The overpayments to be refunded were understated when reported on the CMS-64. Questioned costs: $397,143, which represents the total understatement of the reported federal share of overpayments to be refunded. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For six of thirty-two overpayments selected for testing, the federal share to be returned for the 6/30/2023, 9/30/2023 and 12/31/2023 quarters were calculated incorrectly due to spreadsheet errors. The amounts reported in Column A - Total Computable on Line 9C1 were understated by $256,221 and the amounts reported in Column E - Total Federal Share on Line 9C1 were understated by $140,922. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The overpayments to be refunded were understated when reported on the CMS-64. Questioned costs: $397,143, which represents the total understatement of the reported federal share of overpayments to be refunded. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP22, XIX-MAP-23 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For six of thirty-two overpayments selected for testing, the federal share to be returned for the 6/30/2023, 9/30/2023 and 12/31/2023 quarters were calculated incorrectly due to spreadsheet errors. The amounts reported in Column A - Total Computable on Line 9C1 were understated by $256,221 and the amounts reported in Column E - Total Federal Share on Line 9C1 were understated by $140,922. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The overpayments to be refunded were understated when reported on the CMS-64. Questioned costs: $397,143, which represents the total understatement of the reported federal share of overpayments to be refunded. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-033 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information to FSRS within thirty days after issuing the award. Due to documented issues with the process, we noted that the Department did not complete the reporting process prior to the end of the fiscal year. The Department’s first attempt to complete the reporting process was in October 2023, which was fiscal year 2024. Therefore, we did not select a sample for testing. Context: None of the nine subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $60,394,558, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-034 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Department: Dukes County Sheriff’s Office Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) Compliance Requirement: Allowable Cost/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR Section 200.430(I)(1) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass federally-assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Reserved (vii) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Dukes County Sheriff’s Office (Department) was unable to provide supporting documentation for salaries and wages charged to the program and charged salaries and wages to the program that did not agree with supporting documentation. Context: Forty timesheets were selected for testing and the following exceptions were noted: • For 1 of 40 timesheets, the Department was unable to provide documentation that the timesheet had been reviewed and approved by the employee’s supervisor. • For 2 of 40 timesheets, the Department was unable to provide supporting documentation for the time and effort charged to the program. • For 4 of 40 timesheets, 100% of the employees’ time and effort was charged to the program, but supporting documentation indicated that actual time worked on the program was less than 100%. Questioned costs: $7,587, which represents the amount charged to the program for which supporting documentation was unavailable. $5,383, which represents the difference between the supporting documentation and the amounts charged to the program. Cause: Controls were not operating effectively to ensure that time and effort reporting was performed and documented in accordance with federal requirements. Effect: There is an increased risk of charging unallowed payroll costs to the program. Recommendation: We recommend the Department enhance its procedures and internal controls, perform additional training over time and effort reporting, and ensure that documentation is maintained and readily available for audit. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) Compliance Requirement: Reporting – Government Performance and Results (GPRA) Reporting – Programmatic Progress Reports (PPR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: GPRA - All SAMHSA recipients are required to collect and report certain data so that SAMHSA can meet its obligations under the Government Performance and Results (GPRA) Modernization Act of 2010. This information will be gathered using SAMHSA’s Performance Accountability and Reporting System (SPARS). Data is collected via face-to-face interview using this tool at three data collection points: intake to services, six months post intake, and at discharge. Recipients will be expected to do a GPRA interview on all clients in their specified unduplicated target number and are also expected to achieve a six-month follow-up rate of 80 percent. Recipients are also required to report program-level data on a quarterly basis in SPARS. Recipients should enter their data within 1 day—but no later than 7 days—after the GPRA interview is conducted. This guidance applies to recipients who manually enter their data and batch upload their data. Recipients are required to report a series of data elements that will enable SAMHSA to determine the impact of the program on opioid use, and opioid-related morbidity and mortality. Recipients are required to report client-level data on elements including but not limited to: demographic characteristics, substance use, diagnosis(es) services received, types of MOUD received; length of stay in treatment; employment status, criminal justice involvement, and housing. Additional data elements will also be required and will be provided upon award. PPR- Recipients are required to submit Programmatic Progress Reports (PPR) at 6 months and 12 months. The six-month report is due no later than 30 days after the end of the second quarter of the budget period. The annual report is due within 90 days of the end of the budget period. Recipients are required to report on their progress addressing the goals and objectives identified in the Notice of Funding Opportunity, major accomplishments, progress achieved in addressing the needs of diverse populations, barriers encountered, and efforts to overcome these barriers. Recipients are required, with each report, to document Administrative and Data Collection costs to ensure the costs are compliant and do not exceed the cap. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: GPRA- The Department of Public Health (Department) was unable to provide documentation that the GPRA reports were adequately supported and that the Department submitted the report by the grantor’s due date. The reports contain numerous data points which is submitted to the grantor in an electronic format. The Department did not maintain the original data files used to create the report, the original files were changed at the request of the grantor. As a result, CLA was unable to agree some of the reported data to the files provided by the Department. In addition, the Department did not maintain documentation to support the timeliness of the submitted report. PPR- The Department of Public Health (Department) was unable to provide documentation that the PPR reports were reasonably supported by documentation, nor that the Department was in compliance with the report due date. The Department did not maintain the original data files used to compile the report, CLA was unable to agree some of the reported information to the files provided by the Department. In addition, the Department did not maintain documentation to support the timeliness of the submitted report. Context: GPRA- Two of five quarterly reports selected for testing did not agree with supporting documentation, CLA was unable to test key line items. Forty client-level reports were selected for testing, and the following exceptions were noted: • For 14 of 40 client-level reports, the provided supporting documentation was the overwritten version-based edits made by the Department at the instruction of the grantor. • For 6 of 40 client-level reports evidence of timely submission was not provided. PPR- Three Programmatic Progress Reports were due during FY 2023 and were selected for testing. The following exceptions were noted: • For 3 of 3 reports, documentation supporting the timeliness of submission was not provided. Therefore, auditors were unable to verify if the reports were submitted timely. • For 3 of 3 reports, documentation that the reports had been reviewed and approved prior to submission was not provided. • 3 of 3 reports did not agree with supporting documentation. Questioned costs: None for GPRA and PPR, noncompliance did not affect the allowability of program costs or activities. Cause: The Department did not establish effective procedures or internal controls to maintain the original data files and evidence of the date of the submitted report. Effect: The Department was unable to support that the GPRA and PPR reports were filed timely, and that the accuracy of the reported data was adequately supported. Recommendation: We recommend the Department implement controls and procedures to ensure that the GPRA and PPR reports are submitted timely, are supported by adequate documentation, and that supporting documentation is maintained and is readily available for audit. Views of responsible officials: There is no disagreement with the audit finding.

Reference Number: 2023-036 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Department: Hampden County Sheriff’s Office Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI083328 (9/30/2020 – 9/29/2021) 5H79TI083328 (9/30/2021 – 9/29/2022) 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2023) Compliance Requirement: Suspension and Debarment Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. “Covered transactions” include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220. All non-procurement transactions entered into by a pass-through entity (i.e., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR section 180.215. When a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA), (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Hampden County Sheriff’s Office (Department) could not provide support that it ensured subrecipients were not suspended or debarred before issuing subawards to the entities. Context: The suspension and debarment status for 1 of 20 subrecipients selected for testing was not documented. Questioned costs: There are no questioned costs related to this finding as the vendors were not federally suspended or debarred. Cause: The Department did not establish effective internal controls for maintaining sufficient evidence that a suspension and debarment check was completed before issuing subawards. Effect: If the suspension and debarment status of subrecipients is not verified when entering into covered transactions, it is possible that a subaward could be issued to an ineligible entity. Recommendation: We recommend the Department implement controls and procedures to ensure it maintains documentation of suspension and debarments checks and that the documentation is available for audit. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-037 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Department of Public Health (Department) did not report subaward information to FSRS within thirty days after issuing the award. Due to documented issues with the process, we noted that the Department did not complete the reporting process prior to the end of the fiscal year. The Department’s first attempt to complete the reporting process was in October 2023, which was fiscal year 2024. Therefore, we did not select a sample for testing. Context: None of the nine subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $18,671,925, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2023-037 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: 1B08TI083946-01 and 9/1/2021-9/30/2025 08TI08350200-01 and 3/15/2021-3/14/2024 1B08TI084650-01 and 10/1/2021-9/30/2023 1B08TI085812-01 and 10/1/2021-9/30/2024 1B08TI083455-01 and 10/1/2020-9/30/2022 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Department of Public Health (Department) did not report subaward information to FSRS within thirty days after issuing the award. Due to documented issues with the process, we noted that the Department did not complete the reporting process prior to the end of the fiscal year. The Department’s first attempt to complete the reporting process was in October 2023, which was fiscal year 2024. Therefore, we did not select a sample for testing. Context: None of the nine subawards selected for testing were reported to FSRS during FY 2023. Total subawards selected were $18,671,925, and $0 was reported as required by FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS during FY 2023. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: Management agrees with the finding.