Audit 334898

Federal Agency: United States Department of the Treasury Federal Program: COVID-19 – State Small Business Credit Initiative Technical Assistance Grant Program (21.031) Federal Award Number: SSBCI-21031-0037 Federal Award Year: 2024 State Agency: Department of Economic Development and Office of the State Comptroller Reference: 2024-002 Criteria Reporting In accordance with Title 2 U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.510(b), The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with section 200.502. For reporting purposes, State Small Business Credit Initiative (SSBCI) capital funds are not considered federal financial assistance. The SSBCI statute, 12 U.S.C. section 5702(c)(5), specifically states that capital funds transferred to jurisdictions are not considered federal financial assistance for the purposes of 31 U.S.C. subtitle V. Funds given to provide technical assistance, however, are considered federal financial assistance. Internal controls Lastly, 2 CFR 200.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of the State Comptroller (OSC) is responsible for the preparation of the schedule of expenditures of federal awards (SEFA). Annually, OSC provides the New York State agencies with a proposed SEFA with their respective expenditures by assistance listing number and each agency is charged with reviewing and providing adjustments and feedback. The proposed agency SEFA subschedule for State fiscal year 2024 provided to the Department of Economic Development (DED) did not include the expenditures for the SSBCI program. Upon DED review of the proposed agency SEFA subschedule, DED did not identify and report any expenditures for the SBBCI program that had been disbursed by DED. OSC utilized information in the Statewide Financial System (SFS) to populate the SEFA and which included expenditures totaling $154,792,221 for the SSBCI program. The amount was comprised of $151,191,199 related to capital funds and $3,601,022 of technical assistance funds. In accordance with 12 U.S.C. § 5702(c)(5), capital funds are not considered Federal financial assistance and therefore for reporting purposes should not be included on the SEFA. The preliminary SEFA including SBBCI expenditures of $154,792,221 was provided to the auditors and the SBBCI program was selected as a high-risk B program to be audited as a major program for State fiscal year 2024. Upon audit inquiry, it was determined that $151,191,199 related to capital funds and should not have been included on the SEFA. OSC appropriately adjusted the SEFA prior to finalizing the audit. DED did not properly review and report expenditures related to the SSBCI program on their SEFA subschedule. The communication between the Agencies was not sufficient to uncover the improper reporting on the SEFA. Cause DED did not properly review and report expenditures related to the SSBCI program to OSC. Possible Asserted Effect The effect was the incorrect reporting of federal expenditures, which necessitated adjustments on the SEFA during the audit process and highlighted potential compliance and oversight issues. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Recommendation To address the identified issues and prevent future occurrences of improper reporting on the SEFA, we recommend that DED thoroughly review and report federal expenditures on their SEFA subschedule. We also recommend OSC review and enhance its guidelines provided to the Agencies to specifically highlight the Agencies responsibility to communicate to OSC any specific requirements of the programs, and the classification and reporting of different types of funds, such as capital funds and technical assistance funds, in accordance with relevant statutes and regulations. By implementing these recommendations, the State can enhance the accuracy and reliability of SEFA reporting, ensure compliance with federal regulations, and improve overall internal controls and communication between the Agencies.

Federal Agency: United States Department of Education Federal Program: Rehabilitation Services Vocational Rehabilitation Grants to States (84.126) Federal Award Number: H126A220047(SED) Federal Award Year: 2024 State Agency: State Education Department Reference: 2024-003 Criteria Period of Performance Under section 111(a)(1) of the Rehabilitation Act, the Department pays to each state each federal fiscal year an amount equal to the federal share of the cost of providing VR services and administering the VR program. Consistent with the definition of “period of performance” at 2 CFR section 200.1 and the requirements governing information that must be contained in a GAN at 2 CFR section 200.211, the VR GAN specifies the beginning and end dates for each VR grant award. Therefore, state VR agencies may incur obligations or make expenditures under a grant award if they are incurred during the period of performance for that award. Any obligations or expenditures incurred outside of that period of performance would need to be paid with funds available from a different VR grant award. Internal controls Lastly, 2 CFR 200.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The New York State Education Department (SED) did not maintain complete data along with the supporting documentation to ensure compliance over the period of performance requirements for the VR program. A sample of 40 transactions was selected from SED records. For each case, an invoice, pay period, and/or manual journal entries were tested to verify the data reported in the NYGR0302 report. It was also checked to ensure that the disbursement was properly reviewed, approved, and that the selected amount met the requirement of an allowable activity incurred during the period of performance and liquidated within the required time period. During our review of fiscal year 2024 transactions, we identified that 5 out of the 40 sampled transactions occurred outside the designated period of performance. The grant award period ended on September 30, 2023, with a liquidation period extending 120 days beyond that date, until January 28, 2024. Specifically, for grant number H126A220047, these 5 transactions were incurred in either October or December 2023, which is after the designated period of performance. The review process performed by SED did not detect these transactions were outside the period of performance. Cause The condition related to a deficiency in the operation of the review process not occurring at a precision necessary to identify missing information during the review that is required to be in compliance with the grant’s period of performance. Possible Asserted Effect The identified issue of a transaction occurring outside the period of performance and being liquidated beyond the required liquidation period results in questioned costs of the VR program administered by SED, may result in financial penalties, reduced future federal funding, and potential repayment of misused federal funds. Questioned Costs $12,332 (representing the 5 transactions found to have occurred outside the specified period of performance. The population amounted to $4,448,032, of which forty, totaling $2,081,429, were selected for test work.) Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Recommendation We recommend SED implement a new control mechanism for reviewing funds before distribution. This control should include a pre-distribution review process with a dedicated team or staff verifying the period of performance for each VR grant award, ensuring all obligations and expenditures fall within the specified dates. Additionally, an automated system or manual control is recommended to be developed or enhanced to flag any transactions outside the period of performance or liquidation period.

Federal Agency: United States Department of Education Federal Program: Rehabilitation Services Vocational Rehabilitation Grants to States (84.126) Federal Award Numbers: H126A210047 (SED), H126A220047(SED), H126A230047 (SED), H126A240047 (SED) Federal Award Years: 2021, 2022, 2023, 2024 State Agency: State Education Department Reference: 2024-004 Criteria Reporting RSA-911, Case Service Report (RSA-911) (OMB No. 1820 0508). The RSA-911 is a set of data elements that state Vocational Rehabilitation (VR) agencies must submit to ED. The data elements obtained from state VR agency service records and case management systems document the application for and/or provision of VR services to individuals with disabilities, including program outcomes and demographic information. The RSA-911 data set instructions are available at https://rsa.ed.gov/sites/default/files/subregulatory/pd-19-03.pdf. Key Line Items – Supporting documentation must be included in the service record or case management system for the data elements listed below. Dates reported in the case management system must match the supporting documentation. The following data elements contain critical information: 1. Date of Application (element 7) 2. Date of Eligibility Determination (element 38) 3. Date of Most Recent or Amended Individualized Plan for Employment (IPE) (element 398)* 4. Start Date of Employment in Primary Occupation (element 350) 5. Employment Outcome at Exit (element 356) 6. Date of Exit (element 353) 7. Hourly Wage at Exit (element 359) *In accordance with the RSA-911 data set instructions available https://rsa.ed.gov/sites/default/files/subregulatory/pd-19-03.pdf data element 398 above is listed as `Date of Initial IPE'. Internal controls Lastly, 2 CFR 200.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The SED did not maintain complete and accurate data with the quarterly submissions of the RSA-911. A sample of 60 cases was selected from the department. For each case, the seven key line items were tested to verify the data reported in the case management system matched supporting documentation. During the audit we noted an inconsistency between the compliance supplement requirement and the RSA-911 data set instructions for data element 398 as included above in the Criteria. For test-work purposes the RSA-911 data set instructions were utilized. For fiscal year 2024 the 60 cases selected for testing at SED, the list below summarizes the key line elements the department could not provide supporting documentation or discrepancies were noted as follows: • Date of Application (Element 7) - Two cases where the date the underlying application was received did not agree to the date reported on the RSA-911. • Date of Initial IPE (Element 398) - The RSA-911 data instructions policy directive RSA-PD-19-03 Attachment II: provides instructions to report this data element as the date on which the initial IPE was signed by both the VR Counselor and the individual. • Four cases where the date of Initial IPE reported in the RSA-911 did not agree to the date the underlying IPE. Eight cases where there was a date of initial IPE reported in the RSA-911 but a signed IPE could not be provided by management. • Start date of employment in primary occupation (Element 350) - Two cases where the start date of employment on the underlying support provided did not agree to the employment start date that was reported on the RSA-911. • Hourly Wage at Exit (Element 359) - Three cases where the hourly wage at exit on the underlying support provided did not agree to the hourly wage that was reported on the RSA-911. Cause The condition is due to deficiencies in the input and review process, which failed to correctly input information per the supporting documentation or identify missing information required for the RSA-91 Additionally, SED was transitioning to a new case management system and did not perform case reviews for the quarter ended March 31, 2024. This transition created operational challenges and resource constraints, further impacting the review process. Consequently, the combination of an imprecise review process and system transition led to reporting deficiencies. Possible Asserted Effect Failure to perform proper review of the data recorded in the case management system prior to the submission of the RSA-911 report can result in incorrect and/or missing data elements of the seven key line items noted for the RSA-911. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-010 at pages 40-42. Recommendation We recommend SED to ensure its review process of the underlying cases operates at a precision necessary to identify missing and incorrect data to ensure complete and accurate data is submitted on the RSA-911 reports. Additionally, SED should allocate adequate resources and implement review protocols, especially during system transitions, to maintain compliance with federal reporting requirements. This will help mitigate the risk of reporting deficiencies and ensure the reliability of the data used for decision-making and program evaluations.

Federal Agency: United States Department of Health and Human Services Federal Program: Child Support Services (93.563) Federal Award Numbers: 1901NYCEST, 2001NYCEST, 2101NYCSES, 2201NYCEST, 2301NYCSES, 2401NYSCSS, G1604NYCEST, and 2301NYCSES Federal Award Years: 2019, 2020, 2021, 2022, 2023, and 2024 State Agency: Office of Temporary and Disability Assistance Reference: 2024-005 Criteria Matching - Maintenance of Effort Title 45 U.S. Code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 75.306(b) requires for all Federal awards, any shared costs or matching funds and all contributions, including cash and third party in-kind contributions, must be accepted as part of the nonfederal entity’s cost sharing or matching when such contributions meet all of the following criteria: 8. Are verifiable from the nonfederal entity’s records; 9. Are not included as contributions for any other Federal award; 10. Are necessary and reasonable for accomplishment of project or program objectives; 11. Are allowable under subpart E of 45 CFR 75; 12. Are not paid by the Federal Government under another Federal award, except where the Federal statute authorizing a program specifically provides that Federal funds made available for such program can be applied to matching or cost sharing requirements of other Federal programs; 13. Are provided for in the approved budget when required by the HHS awarding agency; and 14. Conform to other provisions of this part, as applicable. Subrecipient Monitoring Additionally, 45 CFR 75.32(d) states all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward issued for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. Further, 45 CFR 75.203(c) requires the nonfederal entity to evaluate and monitor the nonfederal entity’s compliance with statutes, regulations and the terms of the Federal awards. The nonfederal entity assumes responsibility for administering Federal funds in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award (45 CF 75.400(b)). Each state must expend and account for the federal award in accordance with state laws and procedures for expending the state’s own funds. Such monitoring activities should ensure that the expended funds were for allowable costs in accordance with federal regulations. Also, 45 CFR 75.352(e) states, depending upon the pass-through entity’s assessment of risk posed by the subrecipient, the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: 1. Providing subrecipients with training and technical assistance on program-related matters; 2. Performing on-site reviews of the subrecipient’s program operations; and 3. Arranging for agreed-upon procedures engagements as described in 45 CFR 75.425. Internal controls Lastly, 45 CFR 75.303(a) states the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition The Office of Temporary and Disability Assistance (the Office) enters into grant agreements with local districts to provide programmatic services for the Child Support Enforcement program. Local districts initially cover 100% of costs incurred under the grant and periodically submit requests for reimbursement to the State of New York for services rendered. The Office reimburses local districts only for the federal share of the costs incurred, while the local districts provide the matching funds required by the State of New York. During the fiscal year ended March 31, 2024, the Office relied upon the local districts’ match rate of 34% to ensure the State met their matching requirements of the Child Support Services program. During our testwork over the Office’s subrecipient monitoring process, we noted that the Office does not have a process or internal controls in place to verify the sources of funds used by local districts to meet the matching requirements of the federal program awards, ensuring that these sources are allowable under federal regulations. Cause The condition caused is due to a lack of policies and procedures to ensure that funds utilized by the local districts for cost sharing or matching purposes are in accordance with 45 CFR 75.306(b) The Office’s subrecipient monitoring procedures implemented in November 2020 do not include a review of the local funds used for cost sharing or matching purposes. Possible Asserted Effect Failure to review the sources of the funds used by local districts for matching could result in the use of inappropriate funds for cost sharing or matching of expenditures. This noncompliance with the program laws, regulations, and terms and conditions of Federal awards could lead to questioned costs and potential disallowance of funds by federal agencies Questioned Costs Cannot be determined. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2021 Single Audit Report as finding number 2021-007 on pages 38–39. We recommend the Office and the State develop and implement policies and procedures over subrecipient monitoring which include monitoring procedures over the local districts. These policies and procedures should incorporate reviewing the source of the local district’s cost sharing or match to determine that the source is appropriate and in accordance with 45 CFR 75.306(b).

Federal Agency: United States Department of Health and Human Services Federal Program: Social Services Block Grant (93.667) Federal Award Numbers: 2201NYSOR, 2301NYSOR, 2021NYTANF, 2301NYTANF, 2401NYTANF Federal Award Years: 2022, 2023, and 2024 State Agency: Office of Children and Family Services Reference: 2024-006 Criteria Subrecipient Monitoring Title U.S. code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 75.32(d) states all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward issued for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved including ensuring that information related to eligible participants reported by district offices used to compile the annual Post Expenditure Report is complete and accurate. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. Performance Reporting - Post-Expenditure Report The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. Internal controls Lastly, 45 CFR 75.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During the fiscal year ended March 31, 2024, the Office of Children and Families (the Office) passed through $453,119,321 under the Social Services Block Grant (SSBG) program (ALN 93.667), to local districts (or subrecipients) to provide programmatic services under the SSBG program. As part of the funding arrangement, the local districts are responsible for the administration of the federal program, including ensuring that costs incurred under the federal program are in compliance with federal regulations. During the fiscal year ended March 31, 2024, we noted that on an annual basis, the Office submits the Post- Expenditure Report to the Federal Office of Community Services. As part of the federal reporting process, the Office is required to report the number of eligible individuals who received services paid for in part or in whole with federal funds under the SSBG program. All participant services are provided directly by the local district offices. In order to obtain the number of eligible individuals by services category to be included on the report, the Office obtains the information directly from the Welfare Reporting and Tracking Systems (WRTS). The WRTS system contains data from the State’s Welfare Management System (WMS) and the Benefits Issuance Control System (BICS). As it is the responsibility of the district offices to determine eligibility for services, the Office is relying on the district offices to have data entered complete and accurate information within the WMS and BICS systems. During our testwork, we identified that while monitoring procedures have been implemented by the Office to monitor that local districts are utilizing SSBG funds to provide services to participants that meet applicable eligibility criteria established for funded programs, the Office does not extend those monitoring procedures over the portion of funds transferred into the SSBG program by the Temporary Assistance for Needy Families (TANF) program. As a result, the Office does not have procedures in place to ensure that data related to claims paid using TANF transfer funds reported on the Post-Expenditure Report is complete and accurate Cause The condition found was primarily due to the monitoring procedures implemented by the Office do not include a review to ensure that the participant was eligible to receive services related to TANF transfer funds, which would assist in assuring that the data reported on the Post-Expenditure Report is accurate. Possible Asserted Effect The lack of executed monitoring procedures over subawards provided to subrecipients could result in the use of federal funding provided under the federal award not being in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-014 on pages 53-54. Questioned Costs None Recommendation We recommend the Office continue to enhance its subrecipient monitoring policies, procedures and internal control to help ensure the Office is monitoring subrecipients in accordance with 45 CFR 75.352(d) and 45 CFR 75.352(e). The Office should also review its monitoring procedures to ensure that they are reviewing to determine if participants were eligible to receive services paid for using TANF transfer funds to assist in assuring that the data reported within the annual Post-Expenditure Report is complete and accurate. Such monitoring activities should be performed at a precision level that would detect and identify errors in that could impact the accuracy of the annual Post-Expenditure Report.

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Community Mental Health Services (93.958) Federal Award Numbers: 21B1NYCMHSC6; 22B1NYCMHS; 23B1NYCMHS Federal Award Years: 2021, 2022, and 2023 State Agency: Office of Mental Health Reference: 2024-007 Criteria Maintenance of Effort Title 42 U.S. Code 300x, Formula grants to States (42 USC 300x) section 300x-4(b)(1) states a funding agreement for a grant under this title is that the State involved will maintain State expenditures for community mental health services at a level that is not less than the average level of such expenditures maintained by the State for the 2-year period preceding the fiscal year for which the State is applying for the grant. Internal controls Additionally, Title 45 Code of Federal Regulations Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards (45 CFR 75) section 303(a) states, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with federal statues, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of Mental Health (the Office) performed the annual maintenance of effort (MOE) calculation and submitted it to the Substance Abuse and Mental Health Services Administration. During our testing, we noted that management had been unable to timely provide the source data of the MOE requirement as well as the supporting detail for the federal fringe rate and the federal indirect cost rate. As we were not provided with underlying supporting detail, we were unable to assess the completeness and accuracy of the State expenditures utilized to support the Office meeting the MOE requirement. Cause The condition caused was due to the Office's policies and procedures, including its internal control not designed to maintain appropriate supporting documentation related to the Maintenance of Effort calculation. Possible Asserted Effect Failure to maintain appropriate supporting documentation could result in the Office's inability to appropriately assess the degree of accuracy with respect to the MOE calculations and the amounts determined are not accurate and complete as reported to the federal government. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-015 on pages 55-56. Recommendation We recommend that the Office review and enhance its policies, procedures, and internal controls to ensure that the sources of data be maintained to support the calculation of the MOE requirement for each grant.

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Community Mental Health Services (93.958) Federal Award Numbers: 21B1NYCMHSC6; 22B1NYCMHS; 23B1NYCMHS Federal Award Years: 2021, 2022, and 2023 State Agency: Office of Mental Health Reference: 2024-008 Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, (Transparency Act) that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first- tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 45 U.S. Code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards for HHS Awards, section 75.2 defines Subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 45 CFR 75.2 defines Subrecipient as a non-federal entity that receives a subaward from a passthrough entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Internal controls Lastly, 45 CFR 75.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of Mental Health (the Office or OMH) did not report awards granted to subrecipients for the Block Grants for Community Mental Health Services program for the period April 2023 through March 2024 as required by FFATA. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the Office did not establish internal control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testwork of 40 subawards, we noted the following exceptions: Cause The condition found was due the timing of the implementation of the OMH corrective action plan for a finding that was identified in the previous audit of the program. The condition found was due to the Office not having internal controls in place to ensure that FFATA reporting was being performed for the period April 2023 – March 2024. Resource constraints have been a challenge throughout the current fiscal year, which prevented OMH from fully implementing its corrective action plan during this period. Possible Asserted Effect Failure to submit all subawards passed-through to subrecipients and subcontractors under subawards as defined by 45 CFR 75.2 in the Office's FFATA reporting could result in the Office reporting inaccurate and incomplete amounts to the federal government. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-016 on pages 57-59. Recommendation We recommend that the Office implement policies, procedures, and internal controls to ensure that all amounts passed-through to subrecipients and subcontractors under subawards as defined in 45 CFR 75.2 are reported in accordance with the FFATA federal regulations

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Community Mental Health Services (93.958) Federal Award Numbers: 21B1NYCMHSC6; 22B1NYCMHS; 23B1NYCMHS Federal Award Years: 2021, 2022, and 2023 State Agency: Office of Mental Health Reference: 2024-009 Criteria Subrecipient monitoring Title 45 U.S. Code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, Section 352(a) states all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information include: 1. Federal Award Identification. i) Subrecipient name (which must match the name associated with its unique entity identifier; ii) Subrecipient’s unique entity identifier; iii) Federal Award Identification Number (FAIN); iv) Federal Award Date (see Section 75.2 Federal award date) of award to the recipient by the HHS awarding agency; v) Subaward Period of Performance Start and End Date; vi) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; vii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current obligation; viii) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; ix) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); x) Name of HHS awarding agency, pass-through entity, and contract information for awarding official of the pass-through entity; xi) sAssistance Listing Number (ALN) and Name; the pass-through entity must identify the dollar amount made available under each Federal award and the ALN number at time of disbursement; xii) Identification of whether the award is R&D; and xiii) Indirect cost rate for the Federal award (including if the de minimis rate is charged per Section 75.414). 2. All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; 3. Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass- through entity to meet its own responsibility to the HHS awarding agency including identification of any required financial and performance reports; 4. An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government or, if no such rate exists, either a rate negotiated between the pass-through entity and the subrecipient (in compliance with this part), or a deminimis indirect cost rate as defined in § 75.414(f); 5. A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and 6. Appropriate terms and conditions concerning closeout of the subaward. Title 45 Code of Federal Regulations Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards (45 CFR 75), section 352(b) states all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal Statues, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring as described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of HHS awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a HHS awarding agency). Additionally, 45 CFR 75.352(d) states all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by Section 75.521. 45 CFR 74.352(e) states depending upon the pass-through entity's assessment of risk posed by the sub recipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: 4. Providing subrecipients with training and technical assistance on program related matters; and 5. Performing on-site reviews of the subrecipient's program operations; 6. Arranging for agreed-upon-procedures engagements as described in § 75.425 Further, 45 CFR 75.352(f) states the pass-through entity must verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Internal controls Lastly, 45 CFR 75.303 (a) states the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal Entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During the fiscal year ended March 31, 2024, the Office of Mental Health (the Office) passed through $62,549,685 under the Block Grants for Community Mental Health Services program, to local districts and providers (subrecipients) to provide programmatic and administrative services. As part of the funding arrangement, the local districts and providers (subrecipients) are responsible for carrying out the programmatic services and use the funds to provide comprehensive, community‐based mental health services to adults with serious mental illnesses and to children with serious emotional disturbances and to monitor progress in implementing a comprehensive, community based mental health system. Funds are used for prevention, treatment, recovery support, and other services to supplement Medicaid, Medicare, and private insurance services. When subawards are made to subrecipients, the pass-through entities are required to communicate certain award information. The Office’s policies and procedures are not designed to ensure that award notifications are provided to subrecipients as required by 45 CFR 75.352(a). During our testwork of 40 subrecipient award notifications, we noted the following: 1. For 4 subrecipients, the Federal Award Identification Number (FAIN) was not provided. 2. For 10 subrecipients, which are all New York State Counties, there was no notification of access to records. 3. For 17 of the subrecipients, there was no notification of the DUNS number. All pass-through entities are required to perform a risk assessment over each subrecipient’s risk of noncompliance for purposes of determining appropriate subrecipient monitoring procedures. The Office did not perform an annual risk assessment process related to its subrecipients as required by 45 CFR 75.352(b). Additionally, all pass-through entities must monitor the activities of the subrecipient which must include review of financial and performance reports, follow up to ensure the subrecipient takes timely and appropriate action on any deficiencies identified, and issue a management decision for audit findings. The Office did not monitor and retain documentation of review of financial and performance reports, follow up to ensure appropriate action on any deficiencies identified, nor issue a management decision for audit findings. Lastly, all pass-through entities are required to verify each subrecipient is audited, if required. The Office did not ensure that all required single audits of the program’s subrecipients were received, reviewed, followed-up, or appropriate action was taken and as necessary issued a management decision pertaining to the audit finding in accordance with 45 CFR 75, as applicable. Cause The condition found was due the timing of the implementation of the OMH corrective action plan for a finding that was identified in the previous fiscal year. The condition found was primarily due to the lack of written policies and procedures to ensure that: 1. all required award identification information per 45 CFR 75.352(a) is communicated to the subrecipients for each federal subaward period; 2. an appropriate risk assessment process is in place per 45 CFR 75.352(b); 3. during award monitoring procedures are performed per 45 CFR 75.352(d); and 4. review of the subrecipient single audit reports are performed per 45 CFR 75.352(f). Resource constraints have been a challenge throughout the current fiscal year, which prevented OMH from fully implementing its corrective action plan during this period. Possible Asserted Effect Failure to adequately communicate award identification information could result in the subrecipient not being able to adequately track and report the subawards received, resulting in errors being reported on the schedule of expenditures of federal awards within a subrecipient’s annual single audit report and not being able to comply with required terms and conditions of the federal award. Failure to perform an annual risk assessment to determine appropriate subrecipient monitoring procedures, failure to review financial and performance reports of subrecipients, as well as failure to obtain and review subrecipient single audit reports may result in insufficient monitoring procedures being performed to detect subrecipient noncompliance with federal statutes, regulations, and the terms and conditions of the award. Questioned Costs Cannot be determined. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-017 on pages 60-63. Recommendation We recommend that the Office enhance its processes and internal controls over its reporting to the subrecipients of the federal program to ensure all award identification information required under 45 CFR 75.352(a) is provided to the subrecipients of the Office as data elements change or funding is passed-through. We recommend that the Office implement policies, procedures, and internal controls to ensure that risk assessments of subrecipients are performed on an annual basis to determine appropriate monitoring of subrecipients is performed in accordance with 45 CFR 75.352(d) and 45 CFR 75.352(e). Lastly, we recommend that the Office implement policies, procedures, and internal controls to track and review all subrecipients’ single audit submissions per 45 CFR 75.252(f).

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Community Mental Health Services (93.958) Federal Award Numbers: 21B1NYCMHSC6; 22B1NYCMHSC6; 23B1NYCMHSC6 Federal Award Years: 2021, 2022, and 2023, State Agency: Office of Mental Health Reference: 2024-010 Criteria Activities Allowed or Unallowed Title 45 Code of Federal Regulations Part 96, Block Grants, Fiscal and administrative requirements (45 CFR 96) section 30(a) states, except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures applicable to the obligation and expenditure of its own funds. Fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. Internal controls Lastly, 45 CFR 75.303 (a) states the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal Entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During the fiscal year ended March 31, 2024, the Office of Mental Health (the Office) passed through $62,549,685 under the Block Grants for Community Mental Health program to subrecipients, of which during our testwork, we selected 40 invoices across 32 subrecipients totaling $11,606,972. For one of the 40 invoices selected, a payment of $189,000 was made to a subrecipient that did not have an executed contract and was erroneously paid. In reviewing the total population, an additional $231,090 were made to the subrecipient across 3 additional payments without an executed contract. Cause The condition caused was due to the Office's implementation of a new grants management system during the fiscal period where contracts were moved from the prior system (Grants Gateway) to the new system (Statewide Financial System) which resulted in the contract being erroneously designated as executed within the new system. The contract had not been signed by the Office or by the subrecipient. As the contract was denoted as executed within the system, the Office payment team approved the expenditure of funds without an approved contract. The Office did not have policies and procedures, including its internal control designed to appropriately ensure that a contract was approved by the appropriate personnel after transfer to the new grants management system prior to the expenditure of funds. Possible Asserted Effect Failure to ensure that subrecipients have an executed contract could result in the Office expending program funds with subrecipients that are not an appropriate, qualified, community program or on activities that are unallowed. Questioned Costs $420,090 (Represents four invoices paid to a subrecipient without an approved contract.) Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample, Recommendation We recommend that the Office review and enhance its policies, procedures, and internal controls to ensure that grant funds are not expended to reimburse subrecipients prior to a written contract between the Office and the subrecipient has been approved by appropriate personnel.

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse (93.959) Federal Award Numbers: 21B1NYSAPTC5; 21B1NYSAPTC6; 22B1NYSAPT; 23B1NYSAPT Federal Award Years: 2021, 2022, and 2023 State Agency: Office of Addiction Services and Supports Reference: 2024-011 Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, (Transparency Act) that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 45 U.S. Code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards for HHS Awards, section 75.2 defines Subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 45 CFR 75.2 defines Subrecipient as a non-federal entity that receives a subaward from a passthrough entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Internal controls Lastly, 45 CFR 75.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of Addiction Services and Support (OASAS) did not report awards granted to subrecipients for the Block Grants for Prevention and Treatment of Substance Abuse program for the period April 2023 through March 2024 as required by FFATA. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testwork, we noted OASAS did not establish control procedures to submit FFATA reports for all subawards. We noted the following exceptions: Cause The condition found was due the timing of the implementation of the OASAS corrective action plan for a finding that was identified in the previous audit of the program. As a result of staffing changes and constraints brought about by the COVID-19 pandemic, the FFATA reporting requirements were not adequately considered, and FFATA reporting was not completed in the prior year. Resource constraints continued to be a challenge throughout the current fiscal year, which prevented OASAS from fully implementing its corrective action plan during this period. Possible Asserted Effect Failure to submit all subawards passed-through to subrecipients and subcontractors under subawards as defined by 45 CFR 75.2 in OASAS’s FFATA reporting could result in OASAS reporting inaccurate and incomplete amounts to the federal government. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-018 on pages 64–66. Recommendation We recommend OASAS review and enhance its policies, procedures, and internal controls to ensure that all amounts passed-through to subrecipients and subcontractors under subawards as defined in 45 CFR 75.2 are reported in accordance with the FFATA federal regulations.

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse (93.959) Federal Award Numbers: 21B1NYSAPTC5; 21B1NYSAPTC6; 22B1NYSAPT; 23B1NYSAPT Federal Award Years: 2021, 2022, and 2023 State Agency: Office of Addiction Services and Supports Reference: 2024-012 Criteria Subrecipient monitoring Title 45 Code of Federal Regulations Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards (45 CFR 75), section 352(b) states all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal Statues, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring as described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of HHS awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a HHS awarding agency). Internal controls Further, 45 CFR 75.303 (a) states the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal Entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our testwork, we noted the Office of Addiction Services and Support (OASAS) had developed and implemented a risk assessment process to help identify entities with higher risks that required additional monitoring procedures. Initially the risk assessment process begins with the programmatic input and is provided to the Fiscal Audit and Review Unit (FARU) to provide additional risk assessment factors. However, the agency was unable to provide documentation to support the additional risk factors considered by FARU. The documentation provided indicated that entities determined to be higher risk did not align with the entities selected and for which additional monitoring procedures were performed. Cause The condition found was because OASAS was not able to provide documentation to support the additional risk factors considered by FARU that determined the higher risk entities reviewed for the fiscal year. Possible Asserted Effect Failure to properly document all program and fiscal risk factors considered in identifying higher risk subrecipients may result in inadequate incremental monitoring procedures being performed and subrecipients not being in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-019 on pages 67–68. Recommendation We recommend OASAS continue to enhance its subrecipient monitoring policies, procedures and internal control to help ensure OASAS is monitoring subrecipients in accordance with 45 CFR 75.352(d) and 45 CFR 75.352(e). Such monitoring activities should be performed and documented to show all considerations made when determining which subrecipients would be subject to additional monitoring procedures.

Federal Agency: United States Department of the Treasury Federal Program: COVID-19 – State Small Business Credit Initiative Technical Assistance Grant Program (21.031) Federal Award Number: SSBCI-21031-0037 Federal Award Year: 2024 State Agency: Department of Economic Development and Office of the State Comptroller Reference: 2024-002 Criteria Reporting In accordance with Title 2 U.S. Code of Federal Regulations Part 200 (2 CFR 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 200.510(b), The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with section 200.502. For reporting purposes, State Small Business Credit Initiative (SSBCI) capital funds are not considered federal financial assistance. The SSBCI statute, 12 U.S.C. section 5702(c)(5), specifically states that capital funds transferred to jurisdictions are not considered federal financial assistance for the purposes of 31 U.S.C. subtitle V. Funds given to provide technical assistance, however, are considered federal financial assistance. Internal controls Lastly, 2 CFR 200.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of the State Comptroller (OSC) is responsible for the preparation of the schedule of expenditures of federal awards (SEFA). Annually, OSC provides the New York State agencies with a proposed SEFA with their respective expenditures by assistance listing number and each agency is charged with reviewing and providing adjustments and feedback. The proposed agency SEFA subschedule for State fiscal year 2024 provided to the Department of Economic Development (DED) did not include the expenditures for the SSBCI program. Upon DED review of the proposed agency SEFA subschedule, DED did not identify and report any expenditures for the SBBCI program that had been disbursed by DED. OSC utilized information in the Statewide Financial System (SFS) to populate the SEFA and which included expenditures totaling $154,792,221 for the SSBCI program. The amount was comprised of $151,191,199 related to capital funds and $3,601,022 of technical assistance funds. In accordance with 12 U.S.C. § 5702(c)(5), capital funds are not considered Federal financial assistance and therefore for reporting purposes should not be included on the SEFA. The preliminary SEFA including SBBCI expenditures of $154,792,221 was provided to the auditors and the SBBCI program was selected as a high-risk B program to be audited as a major program for State fiscal year 2024. Upon audit inquiry, it was determined that $151,191,199 related to capital funds and should not have been included on the SEFA. OSC appropriately adjusted the SEFA prior to finalizing the audit. DED did not properly review and report expenditures related to the SSBCI program on their SEFA subschedule. The communication between the Agencies was not sufficient to uncover the improper reporting on the SEFA. Cause DED did not properly review and report expenditures related to the SSBCI program to OSC. Possible Asserted Effect The effect was the incorrect reporting of federal expenditures, which necessitated adjustments on the SEFA during the audit process and highlighted potential compliance and oversight issues. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Recommendation To address the identified issues and prevent future occurrences of improper reporting on the SEFA, we recommend that DED thoroughly review and report federal expenditures on their SEFA subschedule. We also recommend OSC review and enhance its guidelines provided to the Agencies to specifically highlight the Agencies responsibility to communicate to OSC any specific requirements of the programs, and the classification and reporting of different types of funds, such as capital funds and technical assistance funds, in accordance with relevant statutes and regulations. By implementing these recommendations, the State can enhance the accuracy and reliability of SEFA reporting, ensure compliance with federal regulations, and improve overall internal controls and communication between the Agencies.

Federal Agency: United States Department of Education Federal Program: Rehabilitation Services Vocational Rehabilitation Grants to States (84.126) Federal Award Number: H126A220047(SED) Federal Award Year: 2024 State Agency: State Education Department Reference: 2024-003 Criteria Period of Performance Under section 111(a)(1) of the Rehabilitation Act, the Department pays to each state each federal fiscal year an amount equal to the federal share of the cost of providing VR services and administering the VR program. Consistent with the definition of “period of performance” at 2 CFR section 200.1 and the requirements governing information that must be contained in a GAN at 2 CFR section 200.211, the VR GAN specifies the beginning and end dates for each VR grant award. Therefore, state VR agencies may incur obligations or make expenditures under a grant award if they are incurred during the period of performance for that award. Any obligations or expenditures incurred outside of that period of performance would need to be paid with funds available from a different VR grant award. Internal controls Lastly, 2 CFR 200.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The New York State Education Department (SED) did not maintain complete data along with the supporting documentation to ensure compliance over the period of performance requirements for the VR program. A sample of 40 transactions was selected from SED records. For each case, an invoice, pay period, and/or manual journal entries were tested to verify the data reported in the NYGR0302 report. It was also checked to ensure that the disbursement was properly reviewed, approved, and that the selected amount met the requirement of an allowable activity incurred during the period of performance and liquidated within the required time period. During our review of fiscal year 2024 transactions, we identified that 5 out of the 40 sampled transactions occurred outside the designated period of performance. The grant award period ended on September 30, 2023, with a liquidation period extending 120 days beyond that date, until January 28, 2024. Specifically, for grant number H126A220047, these 5 transactions were incurred in either October or December 2023, which is after the designated period of performance. The review process performed by SED did not detect these transactions were outside the period of performance. Cause The condition related to a deficiency in the operation of the review process not occurring at a precision necessary to identify missing information during the review that is required to be in compliance with the grant’s period of performance. Possible Asserted Effect The identified issue of a transaction occurring outside the period of performance and being liquidated beyond the required liquidation period results in questioned costs of the VR program administered by SED, may result in financial penalties, reduced future federal funding, and potential repayment of misused federal funds. Questioned Costs $12,332 (representing the 5 transactions found to have occurred outside the specified period of performance. The population amounted to $4,448,032, of which forty, totaling $2,081,429, were selected for test work.) Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Recommendation We recommend SED implement a new control mechanism for reviewing funds before distribution. This control should include a pre-distribution review process with a dedicated team or staff verifying the period of performance for each VR grant award, ensuring all obligations and expenditures fall within the specified dates. Additionally, an automated system or manual control is recommended to be developed or enhanced to flag any transactions outside the period of performance or liquidation period.

Federal Agency: United States Department of Education Federal Program: Rehabilitation Services Vocational Rehabilitation Grants to States (84.126) Federal Award Numbers: H126A210047 (SED), H126A220047(SED), H126A230047 (SED), H126A240047 (SED) Federal Award Years: 2021, 2022, 2023, 2024 State Agency: State Education Department Reference: 2024-004 Criteria Reporting RSA-911, Case Service Report (RSA-911) (OMB No. 1820 0508). The RSA-911 is a set of data elements that state Vocational Rehabilitation (VR) agencies must submit to ED. The data elements obtained from state VR agency service records and case management systems document the application for and/or provision of VR services to individuals with disabilities, including program outcomes and demographic information. The RSA-911 data set instructions are available at https://rsa.ed.gov/sites/default/files/subregulatory/pd-19-03.pdf. Key Line Items – Supporting documentation must be included in the service record or case management system for the data elements listed below. Dates reported in the case management system must match the supporting documentation. The following data elements contain critical information: 1. Date of Application (element 7) 2. Date of Eligibility Determination (element 38) 3. Date of Most Recent or Amended Individualized Plan for Employment (IPE) (element 398)* 4. Start Date of Employment in Primary Occupation (element 350) 5. Employment Outcome at Exit (element 356) 6. Date of Exit (element 353) 7. Hourly Wage at Exit (element 359) *In accordance with the RSA-911 data set instructions available https://rsa.ed.gov/sites/default/files/subregulatory/pd-19-03.pdf data element 398 above is listed as `Date of Initial IPE'. Internal controls Lastly, 2 CFR 200.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The SED did not maintain complete and accurate data with the quarterly submissions of the RSA-911. A sample of 60 cases was selected from the department. For each case, the seven key line items were tested to verify the data reported in the case management system matched supporting documentation. During the audit we noted an inconsistency between the compliance supplement requirement and the RSA-911 data set instructions for data element 398 as included above in the Criteria. For test-work purposes the RSA-911 data set instructions were utilized. For fiscal year 2024 the 60 cases selected for testing at SED, the list below summarizes the key line elements the department could not provide supporting documentation or discrepancies were noted as follows: • Date of Application (Element 7) - Two cases where the date the underlying application was received did not agree to the date reported on the RSA-911. • Date of Initial IPE (Element 398) - The RSA-911 data instructions policy directive RSA-PD-19-03 Attachment II: provides instructions to report this data element as the date on which the initial IPE was signed by both the VR Counselor and the individual. • Four cases where the date of Initial IPE reported in the RSA-911 did not agree to the date the underlying IPE. Eight cases where there was a date of initial IPE reported in the RSA-911 but a signed IPE could not be provided by management. • Start date of employment in primary occupation (Element 350) - Two cases where the start date of employment on the underlying support provided did not agree to the employment start date that was reported on the RSA-911. • Hourly Wage at Exit (Element 359) - Three cases where the hourly wage at exit on the underlying support provided did not agree to the hourly wage that was reported on the RSA-911. Cause The condition is due to deficiencies in the input and review process, which failed to correctly input information per the supporting documentation or identify missing information required for the RSA-91 Additionally, SED was transitioning to a new case management system and did not perform case reviews for the quarter ended March 31, 2024. This transition created operational challenges and resource constraints, further impacting the review process. Consequently, the combination of an imprecise review process and system transition led to reporting deficiencies. Possible Asserted Effect Failure to perform proper review of the data recorded in the case management system prior to the submission of the RSA-911 report can result in incorrect and/or missing data elements of the seven key line items noted for the RSA-911. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-010 at pages 40-42. Recommendation We recommend SED to ensure its review process of the underlying cases operates at a precision necessary to identify missing and incorrect data to ensure complete and accurate data is submitted on the RSA-911 reports. Additionally, SED should allocate adequate resources and implement review protocols, especially during system transitions, to maintain compliance with federal reporting requirements. This will help mitigate the risk of reporting deficiencies and ensure the reliability of the data used for decision-making and program evaluations.

Federal Agency: United States Department of Health and Human Services Federal Program: Child Support Services (93.563) Federal Award Numbers: 1901NYCEST, 2001NYCEST, 2101NYCSES, 2201NYCEST, 2301NYCSES, 2401NYSCSS, G1604NYCEST, and 2301NYCSES Federal Award Years: 2019, 2020, 2021, 2022, 2023, and 2024 State Agency: Office of Temporary and Disability Assistance Reference: 2024-005 Criteria Matching - Maintenance of Effort Title 45 U.S. Code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 75.306(b) requires for all Federal awards, any shared costs or matching funds and all contributions, including cash and third party in-kind contributions, must be accepted as part of the nonfederal entity’s cost sharing or matching when such contributions meet all of the following criteria: 8. Are verifiable from the nonfederal entity’s records; 9. Are not included as contributions for any other Federal award; 10. Are necessary and reasonable for accomplishment of project or program objectives; 11. Are allowable under subpart E of 45 CFR 75; 12. Are not paid by the Federal Government under another Federal award, except where the Federal statute authorizing a program specifically provides that Federal funds made available for such program can be applied to matching or cost sharing requirements of other Federal programs; 13. Are provided for in the approved budget when required by the HHS awarding agency; and 14. Conform to other provisions of this part, as applicable. Subrecipient Monitoring Additionally, 45 CFR 75.32(d) states all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward issued for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. Further, 45 CFR 75.203(c) requires the nonfederal entity to evaluate and monitor the nonfederal entity’s compliance with statutes, regulations and the terms of the Federal awards. The nonfederal entity assumes responsibility for administering Federal funds in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award (45 CF 75.400(b)). Each state must expend and account for the federal award in accordance with state laws and procedures for expending the state’s own funds. Such monitoring activities should ensure that the expended funds were for allowable costs in accordance with federal regulations. Also, 45 CFR 75.352(e) states, depending upon the pass-through entity’s assessment of risk posed by the subrecipient, the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: 1. Providing subrecipients with training and technical assistance on program-related matters; 2. Performing on-site reviews of the subrecipient’s program operations; and 3. Arranging for agreed-upon procedures engagements as described in 45 CFR 75.425. Internal controls Lastly, 45 CFR 75.303(a) states the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition The Office of Temporary and Disability Assistance (the Office) enters into grant agreements with local districts to provide programmatic services for the Child Support Enforcement program. Local districts initially cover 100% of costs incurred under the grant and periodically submit requests for reimbursement to the State of New York for services rendered. The Office reimburses local districts only for the federal share of the costs incurred, while the local districts provide the matching funds required by the State of New York. During the fiscal year ended March 31, 2024, the Office relied upon the local districts’ match rate of 34% to ensure the State met their matching requirements of the Child Support Services program. During our testwork over the Office’s subrecipient monitoring process, we noted that the Office does not have a process or internal controls in place to verify the sources of funds used by local districts to meet the matching requirements of the federal program awards, ensuring that these sources are allowable under federal regulations. Cause The condition caused is due to a lack of policies and procedures to ensure that funds utilized by the local districts for cost sharing or matching purposes are in accordance with 45 CFR 75.306(b) The Office’s subrecipient monitoring procedures implemented in November 2020 do not include a review of the local funds used for cost sharing or matching purposes. Possible Asserted Effect Failure to review the sources of the funds used by local districts for matching could result in the use of inappropriate funds for cost sharing or matching of expenditures. This noncompliance with the program laws, regulations, and terms and conditions of Federal awards could lead to questioned costs and potential disallowance of funds by federal agencies Questioned Costs Cannot be determined. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2021 Single Audit Report as finding number 2021-007 on pages 38–39. We recommend the Office and the State develop and implement policies and procedures over subrecipient monitoring which include monitoring procedures over the local districts. These policies and procedures should incorporate reviewing the source of the local district’s cost sharing or match to determine that the source is appropriate and in accordance with 45 CFR 75.306(b).

Federal Agency: United States Department of Health and Human Services Federal Program: Social Services Block Grant (93.667) Federal Award Numbers: 2201NYSOR, 2301NYSOR, 2021NYTANF, 2301NYTANF, 2401NYTANF Federal Award Years: 2022, 2023, and 2024 State Agency: Office of Children and Family Services Reference: 2024-006 Criteria Subrecipient Monitoring Title U.S. code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 75.32(d) states all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward issued for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved including ensuring that information related to eligible participants reported by district offices used to compile the annual Post Expenditure Report is complete and accurate. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. Performance Reporting - Post-Expenditure Report The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. Internal controls Lastly, 45 CFR 75.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government,” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During the fiscal year ended March 31, 2024, the Office of Children and Families (the Office) passed through $453,119,321 under the Social Services Block Grant (SSBG) program (ALN 93.667), to local districts (or subrecipients) to provide programmatic services under the SSBG program. As part of the funding arrangement, the local districts are responsible for the administration of the federal program, including ensuring that costs incurred under the federal program are in compliance with federal regulations. During the fiscal year ended March 31, 2024, we noted that on an annual basis, the Office submits the Post- Expenditure Report to the Federal Office of Community Services. As part of the federal reporting process, the Office is required to report the number of eligible individuals who received services paid for in part or in whole with federal funds under the SSBG program. All participant services are provided directly by the local district offices. In order to obtain the number of eligible individuals by services category to be included on the report, the Office obtains the information directly from the Welfare Reporting and Tracking Systems (WRTS). The WRTS system contains data from the State’s Welfare Management System (WMS) and the Benefits Issuance Control System (BICS). As it is the responsibility of the district offices to determine eligibility for services, the Office is relying on the district offices to have data entered complete and accurate information within the WMS and BICS systems. During our testwork, we identified that while monitoring procedures have been implemented by the Office to monitor that local districts are utilizing SSBG funds to provide services to participants that meet applicable eligibility criteria established for funded programs, the Office does not extend those monitoring procedures over the portion of funds transferred into the SSBG program by the Temporary Assistance for Needy Families (TANF) program. As a result, the Office does not have procedures in place to ensure that data related to claims paid using TANF transfer funds reported on the Post-Expenditure Report is complete and accurate Cause The condition found was primarily due to the monitoring procedures implemented by the Office do not include a review to ensure that the participant was eligible to receive services related to TANF transfer funds, which would assist in assuring that the data reported on the Post-Expenditure Report is accurate. Possible Asserted Effect The lack of executed monitoring procedures over subawards provided to subrecipients could result in the use of federal funding provided under the federal award not being in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-014 on pages 53-54. Questioned Costs None Recommendation We recommend the Office continue to enhance its subrecipient monitoring policies, procedures and internal control to help ensure the Office is monitoring subrecipients in accordance with 45 CFR 75.352(d) and 45 CFR 75.352(e). The Office should also review its monitoring procedures to ensure that they are reviewing to determine if participants were eligible to receive services paid for using TANF transfer funds to assist in assuring that the data reported within the annual Post-Expenditure Report is complete and accurate. Such monitoring activities should be performed at a precision level that would detect and identify errors in that could impact the accuracy of the annual Post-Expenditure Report.

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Community Mental Health Services (93.958) Federal Award Numbers: 21B1NYCMHSC6; 22B1NYCMHS; 23B1NYCMHS Federal Award Years: 2021, 2022, and 2023 State Agency: Office of Mental Health Reference: 2024-007 Criteria Maintenance of Effort Title 42 U.S. Code 300x, Formula grants to States (42 USC 300x) section 300x-4(b)(1) states a funding agreement for a grant under this title is that the State involved will maintain State expenditures for community mental health services at a level that is not less than the average level of such expenditures maintained by the State for the 2-year period preceding the fiscal year for which the State is applying for the grant. Internal controls Additionally, Title 45 Code of Federal Regulations Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards (45 CFR 75) section 303(a) states, the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with federal statues, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of Mental Health (the Office) performed the annual maintenance of effort (MOE) calculation and submitted it to the Substance Abuse and Mental Health Services Administration. During our testing, we noted that management had been unable to timely provide the source data of the MOE requirement as well as the supporting detail for the federal fringe rate and the federal indirect cost rate. As we were not provided with underlying supporting detail, we were unable to assess the completeness and accuracy of the State expenditures utilized to support the Office meeting the MOE requirement. Cause The condition caused was due to the Office's policies and procedures, including its internal control not designed to maintain appropriate supporting documentation related to the Maintenance of Effort calculation. Possible Asserted Effect Failure to maintain appropriate supporting documentation could result in the Office's inability to appropriately assess the degree of accuracy with respect to the MOE calculations and the amounts determined are not accurate and complete as reported to the federal government. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-015 on pages 55-56. Recommendation We recommend that the Office review and enhance its policies, procedures, and internal controls to ensure that the sources of data be maintained to support the calculation of the MOE requirement for each grant.

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Community Mental Health Services (93.958) Federal Award Numbers: 21B1NYCMHSC6; 22B1NYCMHS; 23B1NYCMHS Federal Award Years: 2021, 2022, and 2023 State Agency: Office of Mental Health Reference: 2024-008 Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, (Transparency Act) that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first- tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 45 U.S. Code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards for HHS Awards, section 75.2 defines Subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 45 CFR 75.2 defines Subrecipient as a non-federal entity that receives a subaward from a passthrough entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Internal controls Lastly, 45 CFR 75.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of Mental Health (the Office or OMH) did not report awards granted to subrecipients for the Block Grants for Community Mental Health Services program for the period April 2023 through March 2024 as required by FFATA. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that the Office did not establish internal control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testwork of 40 subawards, we noted the following exceptions: Cause The condition found was due the timing of the implementation of the OMH corrective action plan for a finding that was identified in the previous audit of the program. The condition found was due to the Office not having internal controls in place to ensure that FFATA reporting was being performed for the period April 2023 – March 2024. Resource constraints have been a challenge throughout the current fiscal year, which prevented OMH from fully implementing its corrective action plan during this period. Possible Asserted Effect Failure to submit all subawards passed-through to subrecipients and subcontractors under subawards as defined by 45 CFR 75.2 in the Office's FFATA reporting could result in the Office reporting inaccurate and incomplete amounts to the federal government. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-016 on pages 57-59. Recommendation We recommend that the Office implement policies, procedures, and internal controls to ensure that all amounts passed-through to subrecipients and subcontractors under subawards as defined in 45 CFR 75.2 are reported in accordance with the FFATA federal regulations

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Community Mental Health Services (93.958) Federal Award Numbers: 21B1NYCMHSC6; 22B1NYCMHS; 23B1NYCMHS Federal Award Years: 2021, 2022, and 2023 State Agency: Office of Mental Health Reference: 2024-009 Criteria Subrecipient monitoring Title 45 U.S. Code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, Section 352(a) states all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information include: 1. Federal Award Identification. i) Subrecipient name (which must match the name associated with its unique entity identifier; ii) Subrecipient’s unique entity identifier; iii) Federal Award Identification Number (FAIN); iv) Federal Award Date (see Section 75.2 Federal award date) of award to the recipient by the HHS awarding agency; v) Subaward Period of Performance Start and End Date; vi) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; vii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current obligation; viii) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; ix) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); x) Name of HHS awarding agency, pass-through entity, and contract information for awarding official of the pass-through entity; xi) sAssistance Listing Number (ALN) and Name; the pass-through entity must identify the dollar amount made available under each Federal award and the ALN number at time of disbursement; xii) Identification of whether the award is R&D; and xiii) Indirect cost rate for the Federal award (including if the de minimis rate is charged per Section 75.414). 2. All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; 3. Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass- through entity to meet its own responsibility to the HHS awarding agency including identification of any required financial and performance reports; 4. An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government or, if no such rate exists, either a rate negotiated between the pass-through entity and the subrecipient (in compliance with this part), or a deminimis indirect cost rate as defined in § 75.414(f); 5. A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and 6. Appropriate terms and conditions concerning closeout of the subaward. Title 45 Code of Federal Regulations Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards (45 CFR 75), section 352(b) states all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal Statues, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring as described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of HHS awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a HHS awarding agency). Additionally, 45 CFR 75.352(d) states all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by Section 75.521. 45 CFR 74.352(e) states depending upon the pass-through entity's assessment of risk posed by the sub recipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: 4. Providing subrecipients with training and technical assistance on program related matters; and 5. Performing on-site reviews of the subrecipient's program operations; 6. Arranging for agreed-upon-procedures engagements as described in § 75.425 Further, 45 CFR 75.352(f) states the pass-through entity must verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Internal controls Lastly, 45 CFR 75.303 (a) states the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal Entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During the fiscal year ended March 31, 2024, the Office of Mental Health (the Office) passed through $62,549,685 under the Block Grants for Community Mental Health Services program, to local districts and providers (subrecipients) to provide programmatic and administrative services. As part of the funding arrangement, the local districts and providers (subrecipients) are responsible for carrying out the programmatic services and use the funds to provide comprehensive, community‐based mental health services to adults with serious mental illnesses and to children with serious emotional disturbances and to monitor progress in implementing a comprehensive, community based mental health system. Funds are used for prevention, treatment, recovery support, and other services to supplement Medicaid, Medicare, and private insurance services. When subawards are made to subrecipients, the pass-through entities are required to communicate certain award information. The Office’s policies and procedures are not designed to ensure that award notifications are provided to subrecipients as required by 45 CFR 75.352(a). During our testwork of 40 subrecipient award notifications, we noted the following: 1. For 4 subrecipients, the Federal Award Identification Number (FAIN) was not provided. 2. For 10 subrecipients, which are all New York State Counties, there was no notification of access to records. 3. For 17 of the subrecipients, there was no notification of the DUNS number. All pass-through entities are required to perform a risk assessment over each subrecipient’s risk of noncompliance for purposes of determining appropriate subrecipient monitoring procedures. The Office did not perform an annual risk assessment process related to its subrecipients as required by 45 CFR 75.352(b). Additionally, all pass-through entities must monitor the activities of the subrecipient which must include review of financial and performance reports, follow up to ensure the subrecipient takes timely and appropriate action on any deficiencies identified, and issue a management decision for audit findings. The Office did not monitor and retain documentation of review of financial and performance reports, follow up to ensure appropriate action on any deficiencies identified, nor issue a management decision for audit findings. Lastly, all pass-through entities are required to verify each subrecipient is audited, if required. The Office did not ensure that all required single audits of the program’s subrecipients were received, reviewed, followed-up, or appropriate action was taken and as necessary issued a management decision pertaining to the audit finding in accordance with 45 CFR 75, as applicable. Cause The condition found was due the timing of the implementation of the OMH corrective action plan for a finding that was identified in the previous fiscal year. The condition found was primarily due to the lack of written policies and procedures to ensure that: 1. all required award identification information per 45 CFR 75.352(a) is communicated to the subrecipients for each federal subaward period; 2. an appropriate risk assessment process is in place per 45 CFR 75.352(b); 3. during award monitoring procedures are performed per 45 CFR 75.352(d); and 4. review of the subrecipient single audit reports are performed per 45 CFR 75.352(f). Resource constraints have been a challenge throughout the current fiscal year, which prevented OMH from fully implementing its corrective action plan during this period. Possible Asserted Effect Failure to adequately communicate award identification information could result in the subrecipient not being able to adequately track and report the subawards received, resulting in errors being reported on the schedule of expenditures of federal awards within a subrecipient’s annual single audit report and not being able to comply with required terms and conditions of the federal award. Failure to perform an annual risk assessment to determine appropriate subrecipient monitoring procedures, failure to review financial and performance reports of subrecipients, as well as failure to obtain and review subrecipient single audit reports may result in insufficient monitoring procedures being performed to detect subrecipient noncompliance with federal statutes, regulations, and the terms and conditions of the award. Questioned Costs Cannot be determined. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-017 on pages 60-63. Recommendation We recommend that the Office enhance its processes and internal controls over its reporting to the subrecipients of the federal program to ensure all award identification information required under 45 CFR 75.352(a) is provided to the subrecipients of the Office as data elements change or funding is passed-through. We recommend that the Office implement policies, procedures, and internal controls to ensure that risk assessments of subrecipients are performed on an annual basis to determine appropriate monitoring of subrecipients is performed in accordance with 45 CFR 75.352(d) and 45 CFR 75.352(e). Lastly, we recommend that the Office implement policies, procedures, and internal controls to track and review all subrecipients’ single audit submissions per 45 CFR 75.252(f).

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Community Mental Health Services (93.958) Federal Award Numbers: 21B1NYCMHSC6; 22B1NYCMHSC6; 23B1NYCMHSC6 Federal Award Years: 2021, 2022, and 2023, State Agency: Office of Mental Health Reference: 2024-010 Criteria Activities Allowed or Unallowed Title 45 Code of Federal Regulations Part 96, Block Grants, Fiscal and administrative requirements (45 CFR 96) section 30(a) states, except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures applicable to the obligation and expenditure of its own funds. Fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. Internal controls Lastly, 45 CFR 75.303 (a) states the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal Entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During the fiscal year ended March 31, 2024, the Office of Mental Health (the Office) passed through $62,549,685 under the Block Grants for Community Mental Health program to subrecipients, of which during our testwork, we selected 40 invoices across 32 subrecipients totaling $11,606,972. For one of the 40 invoices selected, a payment of $189,000 was made to a subrecipient that did not have an executed contract and was erroneously paid. In reviewing the total population, an additional $231,090 were made to the subrecipient across 3 additional payments without an executed contract. Cause The condition caused was due to the Office's implementation of a new grants management system during the fiscal period where contracts were moved from the prior system (Grants Gateway) to the new system (Statewide Financial System) which resulted in the contract being erroneously designated as executed within the new system. The contract had not been signed by the Office or by the subrecipient. As the contract was denoted as executed within the system, the Office payment team approved the expenditure of funds without an approved contract. The Office did not have policies and procedures, including its internal control designed to appropriately ensure that a contract was approved by the appropriate personnel after transfer to the new grants management system prior to the expenditure of funds. Possible Asserted Effect Failure to ensure that subrecipients have an executed contract could result in the Office expending program funds with subrecipients that are not an appropriate, qualified, community program or on activities that are unallowed. Questioned Costs $420,090 (Represents four invoices paid to a subrecipient without an approved contract.) Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample, Recommendation We recommend that the Office review and enhance its policies, procedures, and internal controls to ensure that grant funds are not expended to reimburse subrecipients prior to a written contract between the Office and the subrecipient has been approved by appropriate personnel.

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse (93.959) Federal Award Numbers: 21B1NYSAPTC5; 21B1NYSAPTC6; 22B1NYSAPT; 23B1NYSAPT Federal Award Years: 2021, 2022, and 2023 State Agency: Office of Addiction Services and Supports Reference: 2024-011 Criteria Special Reporting for Federal Funding Accountability and Transparency Act Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, (Transparency Act) that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Aspects of the Transparency Act that relate to subaward reporting (1) under grants and cooperative agreements were implemented in OMB in 2 CFR Part 170 and (2) under contracts, by the regulatory agencies responsible for the Federal Acquisition Regulation (FAR at 5 FR 39414 et seq., July 8, 2010). The requirements pertain to recipients (i.e., direct recipients) of grants or cooperative agreements who make first-tier subawards and contractors (i.e., prime contractors) that award first-tier subcontracts. Title 45 U.S. Code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards for HHS Awards, section 75.2 defines Subaward as an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Further, 45 CFR 75.2 defines Subrecipient as a non-federal entity that receives a subaward from a passthrough entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Internal controls Lastly, 45 CFR 75.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of Addiction Services and Support (OASAS) did not report awards granted to subrecipients for the Block Grants for Prevention and Treatment of Substance Abuse program for the period April 2023 through March 2024 as required by FFATA. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee DUNS number 3. Amount of subaward 4. Subaward obligation/action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testwork, we noted OASAS did not establish control procedures to submit FFATA reports for all subawards. We noted the following exceptions: Cause The condition found was due the timing of the implementation of the OASAS corrective action plan for a finding that was identified in the previous audit of the program. As a result of staffing changes and constraints brought about by the COVID-19 pandemic, the FFATA reporting requirements were not adequately considered, and FFATA reporting was not completed in the prior year. Resource constraints continued to be a challenge throughout the current fiscal year, which prevented OASAS from fully implementing its corrective action plan during this period. Possible Asserted Effect Failure to submit all subawards passed-through to subrecipients and subcontractors under subawards as defined by 45 CFR 75.2 in OASAS’s FFATA reporting could result in OASAS reporting inaccurate and incomplete amounts to the federal government. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-018 on pages 64–66. Recommendation We recommend OASAS review and enhance its policies, procedures, and internal controls to ensure that all amounts passed-through to subrecipients and subcontractors under subawards as defined in 45 CFR 75.2 are reported in accordance with the FFATA federal regulations.

Federal Agency: United States Department of Health and Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse (93.959) Federal Award Numbers: 21B1NYSAPTC5; 21B1NYSAPTC6; 22B1NYSAPT; 23B1NYSAPT Federal Award Years: 2021, 2022, and 2023 State Agency: Office of Addiction Services and Supports Reference: 2024-012 Criteria Subrecipient monitoring Title 45 Code of Federal Regulations Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards (45 CFR 75), section 352(b) states all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal Statues, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring as described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of HHS awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a HHS awarding agency). Internal controls Further, 45 CFR 75.303 (a) states the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal Entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our testwork, we noted the Office of Addiction Services and Support (OASAS) had developed and implemented a risk assessment process to help identify entities with higher risks that required additional monitoring procedures. Initially the risk assessment process begins with the programmatic input and is provided to the Fiscal Audit and Review Unit (FARU) to provide additional risk assessment factors. However, the agency was unable to provide documentation to support the additional risk factors considered by FARU. The documentation provided indicated that entities determined to be higher risk did not align with the entities selected and for which additional monitoring procedures were performed. Cause The condition found was because OASAS was not able to provide documentation to support the additional risk factors considered by FARU that determined the higher risk entities reviewed for the fiscal year. Possible Asserted Effect Failure to properly document all program and fiscal risk factors considered in identifying higher risk subrecipients may result in inadequate incremental monitoring procedures being performed and subrecipients not being in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Questioned Costs None Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding A similar finding was included in the 2023 Single Audit Report as finding number 2023-019 on pages 67–68. Recommendation We recommend OASAS continue to enhance its subrecipient monitoring policies, procedures and internal control to help ensure OASAS is monitoring subrecipients in accordance with 45 CFR 75.352(d) and 45 CFR 75.352(e). Such monitoring activities should be performed and documented to show all considerations made when determining which subrecipients would be subject to additional monitoring procedures.