Audit 337153

DEPARTMENT OF EMPLOYMENT SECURITY SPECIAL TESTS AND PROVISIONS - UI BENEFIT PAYMENTS Significant Deficiency 2023-009 Strengthen Controls to Ensure Compliance with Special Test - UI Benefit Payment Requirements for Unemployment Insurance ALN Number (s) 17.225 Unemployment Insurance Federal Award No. UI-37232-22-55-A-28 Questioned Costs N/A Criteria The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that case reviews were reviewed and approved by investigator staff. Cause The Department’s internal controls were not sufficient to ensure that it maintained documentation of investigator review and approval for all BAM case reviews Effect Incomplete documentation of BAM case reviews could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation We recommend the Department review and enhance procedures and controls to ensure that documentation of investigator review and approval of all BAM case reviews is maintained. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY SPECIAL TESTS AND PROVISIONS - UI BENEFIT PAYMENTS Significant Deficiency 2023-009 Strengthen Controls to Ensure Compliance with Special Test - UI Benefit Payment Requirements for Unemployment Insurance ALN Number (s) 17.225 Unemployment Insurance Federal Award No. UI-37232-22-55-A-28 Questioned Costs N/A Criteria The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that case reviews were reviewed and approved by investigator staff. Cause The Department’s internal controls were not sufficient to ensure that it maintained documentation of investigator review and approval for all BAM case reviews Effect Incomplete documentation of BAM case reviews could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation We recommend the Department review and enhance procedures and controls to ensure that documentation of investigator review and approval of all BAM case reviews is maintained. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY SPECIAL TESTS AND PROVISIONS - UI BENEFIT PAYMENTS Significant Deficiency 2023-009 Strengthen Controls to Ensure Compliance with Special Test - UI Benefit Payment Requirements for Unemployment Insurance ALN Number (s) 17.225 Unemployment Insurance Federal Award No. UI-37232-22-55-A-28 Questioned Costs N/A Criteria The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that case reviews were reviewed and approved by investigator staff. Cause The Department’s internal controls were not sufficient to ensure that it maintained documentation of investigator review and approval for all BAM case reviews Effect Incomplete documentation of BAM case reviews could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation We recommend the Department review and enhance procedures and controls to ensure that documentation of investigator review and approval of all BAM case reviews is maintained. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY ELIGIBILITY Significant Deficiency 2023-012 Strengthen controls to ensure compliance with eligibility requirements for the WIOA assistance program. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per The Code of Federal Regulations (20 CFR 680-683), state workforce agencies must ensure that individuals are eligible to participate in the program. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that the eligibility determination for a participant had been reviewed and approved. Cause Internal controls were not sufficient to ensure that documentation supporting participant eligibility was reviewed and approved by a supervisor. Effect Failure to ensure that all eligibility documentation is properly reviewed and approved could result in ineligible individuals participating in the program. Recommendation MDES should review and enhance internal controls and procedures to ensure that participant eligibility documentation is properly reviewed and approved by a supervisor. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY REPORTING Material Weakness Material Noncompliance 2023-010 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) did not report subaward information to FSRS within thirty days after issuing the subaward or subaward amendment. Cause MDES’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS no later than the end of the month following the month of issuance. Effect Subawards were not reported to FSRS in accordance with FFATA requirements. Recommendation We recommend MDES establish procedures and internal controls to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance of each subaward. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY SUBRECIPIENT MONITORING Material Weakness Immaterial Noncompliance 2023-011 Strengthen Controls to Ensure Compliance with Subrecipient Monitoring Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. UI-34724-20-55-A-28 Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 200.332(a)), states all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. The Code of Federal Regulations (2 CFR 200.332) also states that pass-through entities must: d) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; 4. The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation of subaward agreements and monitoring activities performed. Cause Internal controls were not sufficient to ensure that copies of subaward agreements were maintained and available for audit, nor that it maintained documentation of subrecipient monitoring activities performed. Effect Auditors were unable to verify that subawards were issued in accordance with Federal requirements nor that the subrecipients had been adequately monitored and were audited as required by Subpart F. Recommendation MDES should review and enhance internal controls and procedures to ensure that it maintains copies of all subaward agreements, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed for all subrecipients. Copies of subawards and documentation of subrecipient monitoring activities should be readily available for audit. Repeat Finding Yes; 2022-023. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY ELIGIBILITY Significant Deficiency 2023-012 Strengthen controls to ensure compliance with eligibility requirements for the WIOA assistance program. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per The Code of Federal Regulations (20 CFR 680-683), state workforce agencies must ensure that individuals are eligible to participate in the program. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that the eligibility determination for a participant had been reviewed and approved. Cause Internal controls were not sufficient to ensure that documentation supporting participant eligibility was reviewed and approved by a supervisor. Effect Failure to ensure that all eligibility documentation is properly reviewed and approved could result in ineligible individuals participating in the program. Recommendation MDES should review and enhance internal controls and procedures to ensure that participant eligibility documentation is properly reviewed and approved by a supervisor. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY REPORTING Material Weakness Material Noncompliance 2023-010 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) did not report subaward information to FSRS within thirty days after issuing the subaward or subaward amendment. Cause MDES’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS no later than the end of the month following the month of issuance. Effect Subawards were not reported to FSRS in accordance with FFATA requirements. Recommendation We recommend MDES establish procedures and internal controls to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance of each subaward. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY SUBRECIPIENT MONITORING Material Weakness Immaterial Noncompliance 2023-011 Strengthen Controls to Ensure Compliance with Subrecipient Monitoring Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. UI-34724-20-55-A-28 Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 200.332(a)), states all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. The Code of Federal Regulations (2 CFR 200.332) also states that pass-through entities must: d) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; 4. The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation of subaward agreements and monitoring activities performed. Cause Internal controls were not sufficient to ensure that copies of subaward agreements were maintained and available for audit, nor that it maintained documentation of subrecipient monitoring activities performed. Effect Auditors were unable to verify that subawards were issued in accordance with Federal requirements nor that the subrecipients had been adequately monitored and were audited as required by Subpart F. Recommendation MDES should review and enhance internal controls and procedures to ensure that it maintains copies of all subaward agreements, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed for all subrecipients. Copies of subawards and documentation of subrecipient monitoring activities should be readily available for audit. Repeat Finding Yes; 2022-023. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY ELIGIBILITY Significant Deficiency 2023-012 Strengthen controls to ensure compliance with eligibility requirements for the WIOA assistance program. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per The Code of Federal Regulations (20 CFR 680-683), state workforce agencies must ensure that individuals are eligible to participate in the program. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that the eligibility determination for a participant had been reviewed and approved. Cause Internal controls were not sufficient to ensure that documentation supporting participant eligibility was reviewed and approved by a supervisor. Effect Failure to ensure that all eligibility documentation is properly reviewed and approved could result in ineligible individuals participating in the program. Recommendation MDES should review and enhance internal controls and procedures to ensure that participant eligibility documentation is properly reviewed and approved by a supervisor. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY REPORTING Material Weakness Material Noncompliance 2023-010 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) did not report subaward information to FSRS within thirty days after issuing the subaward or subaward amendment. Cause MDES’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS no later than the end of the month following the month of issuance. Effect Subawards were not reported to FSRS in accordance with FFATA requirements. Recommendation We recommend MDES establish procedures and internal controls to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance of each subaward. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY SUBRECIPIENT MONITORING Material Weakness Immaterial Noncompliance 2023-011 Strengthen Controls to Ensure Compliance with Subrecipient Monitoring Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. UI-34724-20-55-A-28 Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 200.332(a)), states all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. The Code of Federal Regulations (2 CFR 200.332) also states that pass-through entities must: d) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; 4. The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation of subaward agreements and monitoring activities performed. Cause Internal controls were not sufficient to ensure that copies of subaward agreements were maintained and available for audit, nor that it maintained documentation of subrecipient monitoring activities performed. Effect Auditors were unable to verify that subawards were issued in accordance with Federal requirements nor that the subrecipients had been adequately monitored and were audited as required by Subpart F. Recommendation MDES should review and enhance internal controls and procedures to ensure that it maintains copies of all subaward agreements, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed for all subrecipients. Copies of subawards and documentation of subrecipient monitoring activities should be readily available for audit. Repeat Finding Yes; 2022-023. Statistically Valid No.

DEPARTMENT OF FINANCE AND ADMINISTRATION ELIGIBILITY Material Weakness Material Noncompliance 2023-025 Strengthen Controls to Ensure Compliance with Eligibility Requirements for the Emergency Rental Assistance Program. ALN Number(s) 21.023 COVID-19 Emergency Rental Assistance (ERA) Federal Award No. N/A Questioned Costs N/A Criteria Code of Federal Regulations (2 CFR 200.303(a)) states that the Non-federal entity should establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee Sponsoring Organizations of the Treadway Commission (COSO). Frequently Asked Questions (FAQ’s) as guidance regarding the requirements of the Emergency Rental Assistance program (ERA1) established by section 501 of Division N of the Consolidated Appropriation Act, 2021, Pub. L. No. 116-260 (December 27, 2020) and the Emergency Rental Assistance Program (ERA2) established by section 3201 of the American Rescue Plan Act of 2021, Pub. L. No. 117-2 (March 11, 2021) states that grantees must require all applications for assistance to include an attestation from the applicant household that all information included is correct and complete. In all cases, grantees must document their policies and procedures for determining household eligibility to include policies and procedures for determining the prioritization of households in compliance with the statute and maintain records of their determinations. Grantees must also have controls in place to ensure compliance with their policies and procedures and prevent fraud. Condition The Department of Finance and Administration (DFA) did not review and assess procedures over eligibility determination to prevent fraudulent applications from being approved and funds disbursed. DFA’s third-party administrator, Mississippi Home Corporation (MHC), fiscal year 2023 single audit report identified a finding related to the approval of fraudulent applications due to the self-attestation process. DFA did not implement nor ensure that corrective action was implemented to mitigate the fraud from reoccurring. Cause DFA does not consider MHC as a subrecipient nor does DFA assume responsibility for the direct and material compliance requirements. The program is administered without any responsibility and oversight from the State of Mississippi, the grant recipient. Effect Without proper monitoring and administration of the grant, the risk of non-compliance due to fraud is increased and could result in questioned costs. Recommendation We recommend the Department of Finance and Administration strengthen controls to ensure compliance with eligibility requirements for the Emergency Rental Assistance Program. Repeat Finding Yes; 2022-031 Statistically Valid No.

DEPARTMENT OF FINANCE AND ADMINISTRATION MONITORING Material Weakness Material Noncompliance 2023-026 Strengthen Controls to Ensure Compliance with Federal Monitoring Requirements. ALN Number(s) 21.023 COVID-19 Emergency Rental Assistance (ERA) Federal Award No. N/A Questioned Costs N/A Criteria Code of Federal Regulations (2 CFR 200.400) requires the non-federal entity: • To be responsible for the efficient and effective administration of the Federal award through the application of sound management practices. • Assume responsibility for administering Federal funds in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the Federal award. • Ensure the cost allocation plans or indirect cost proposals, the cognizant agency for indirect costs should generally assure that the non-Federal entity is applying these cost accounting principles on a consistent basis during the review and negotiation of indirect cost proposals. Where wide variations exist in the treatment of a given cost item by the non-Federal entity, the reasonableness and equity of such treatments should be fully considered. Code of Federal Regulations (2 CFR 200.303) requires the Non-federal entity: • Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). • Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations and terms and conditions of Federal awards. Condition The Department of Finance and Administration (DFA) passed federal funds to a third-party administrator, Mississippi Home Corporation (MHC) but did not document this subrecipient relationship via a subaward agreement, nor did DFA monitor and support MHC as a subrecipient. MHC is a quasi-governmental agency and not part of the State of Mississippi’s financial reporting structure. Therefore, due to lack of support of the subrecipient relationship, we the deemed the programs to be administered by DFA. During testing we noted that DFA did not assume responsibility for the administration of the federal award as required by 2 CFR 200.400, nor did they establish and maintain effective internal controls over the federal award as required by 2 CFR 200.303. DFA did not document their review and approval of program costs which included payroll cost charged to the program based on a billing methodology used for program cost charged to U.S. Department of Housing and Urban Development (HUD) housing counseling grants. There was no evidence of DFA’s review and approval over eligibility determined by the MHC or financial and programmatic reports prepared by MHC. Cause The Mississippi Department of Finance and Administration (DFA) does not consider Mississippi Home Corporation as a subrecipient nor does DFA assume responsibility for the direct and material compliance requirements. The program is administered without any responsibility and oversight from the State of Mississippi, the grant recipient. Effect Without proper monitoring there is an increased risk of charging unallowed costs and activity to the program and noncompliance with direct and material compliance requirements. Recommendation We recommend the Department of Finance and Administration strengthen controls to ensure compliance with monitoring processes in order to ensure federal compliance requirements are being met. Repeat Finding Yes; 2022-032. Statistically Valid No.

DEPARTMENT OF EDUCATION REPORTING Significant Deficiency Immaterial Noncompliance 2023-014 Strengthen Controls to Ensure Compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements ALN Number(s) 84.425 Education Stabilization Fund Federal Award No. S425W210025-ARP-HCY Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. Condition During testwork performed for the Federal Funding Accountability and Transparency Act (FFATA) reporting fiscal year 2023, the auditor noted the following exceptions: • Ten instances out of 10 reports (or 100%) tested for ARP - Elementary and Secondary School Emergency Relief for Homeless Children and Youth (ARP-HCY), in which the reports were not submitted within the required timeframe. Cause MDE personnel did not ensure timely submission of FFATA reports. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Education (MDE) strengthen controls to ensure compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. Repeat Finding Yes; 2022-028. Statistically Valid Yes.

DEPARTMENT OF EDUCATION REPORTING Significant Deficiency Immaterial Noncompliance 2023-014 Strengthen Controls to Ensure Compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements ALN Number(s) 84.425 Education Stabilization Fund Federal Award No. S425W210025-ARP-HCY Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. Condition During testwork performed for the Federal Funding Accountability and Transparency Act (FFATA) reporting fiscal year 2023, the auditor noted the following exceptions: • Ten instances out of 10 reports (or 100%) tested for ARP - Elementary and Secondary School Emergency Relief for Homeless Children and Youth (ARP-HCY), in which the reports were not submitted within the required timeframe. Cause MDE personnel did not ensure timely submission of FFATA reports. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Education (MDE) strengthen controls to ensure compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. Repeat Finding Yes; 2022-028. Statistically Valid Yes.

DEPARTMENT OF EDUCATION REPORTING Significant Deficiency Immaterial Noncompliance 2023-014 Strengthen Controls to Ensure Compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements ALN Number(s) 84.425 Education Stabilization Fund Federal Award No. S425W210025-ARP-HCY Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. Condition During testwork performed for the Federal Funding Accountability and Transparency Act (FFATA) reporting fiscal year 2023, the auditor noted the following exceptions: • Ten instances out of 10 reports (or 100%) tested for ARP - Elementary and Secondary School Emergency Relief for Homeless Children and Youth (ARP-HCY), in which the reports were not submitted within the required timeframe. Cause MDE personnel did not ensure timely submission of FFATA reports. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Education (MDE) strengthen controls to ensure compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. Repeat Finding Yes; 2022-028. Statistically Valid Yes.

DEPARTMENT OF EDUCATION REPORTING Significant Deficiency Immaterial Noncompliance 2023-014 Strengthen Controls to Ensure Compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements ALN Number(s) 84.425 Education Stabilization Fund Federal Award No. S425W210025-ARP-HCY Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. Condition During testwork performed for the Federal Funding Accountability and Transparency Act (FFATA) reporting fiscal year 2023, the auditor noted the following exceptions: • Ten instances out of 10 reports (or 100%) tested for ARP - Elementary and Secondary School Emergency Relief for Homeless Children and Youth (ARP-HCY), in which the reports were not submitted within the required timeframe. Cause MDE personnel did not ensure timely submission of FFATA reports. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Education (MDE) strengthen controls to ensure compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. Repeat Finding Yes; 2022-028. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-017 Strengthen Controls over On-Site Monitoring for the Low Income Home Energy Assistance Program (LIHEAP). ALN Number(s) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSLIEA G2101MSCCDF G2101MSCCDD Questioned Costs N/A Criteria The auditor evaluated the Mississippi Department of Human Services’ (MDHS’s) compliance with subrecipient monitoring requirements based on written policies and procedures designed by MDHS’s Office of Compliance – Division of Monitoring (DM) to satisfy during-the-award monitoring requirements. DM procedures require: an on-site monitoring review of each subrecipient contract at least once during the subgrant period. Monitoring tools/checklists are used during each on-site monitoring review to provide guidance and to document a review was performed. The on-site monitoring workpapers are reviewed and approved by DM supervisory personnel prior to issuance of a written report, the Initial Report of Findings & Recommendations, which is used for communicating finding(s) and/or questioned costs to subrecipients. The written report should be issued within 60 days from the date of the exit conference, which is normally held on the last day of the on-site review. Additionally, if the initial report identifies any administrative findings or questioned costs, a response to the findings is required to be submitted by the subrecipient to DM within thirty (30) working days from the date the report was issued. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Manual specifies that a satisfactory control environment is only effective when there are adequate control activities in place. Effective control activities dictate that: the agency perform appropriate multi-level reviews over the monitoring process and the agency ensures timely communication from the subgrantees and timely resolution of findings in order to prevent; detect; and deter fraud, waste, and abuse or the misuse of federal funds. Condition When performing testwork over subrecipient on-site monitoring for 125 subgrant contracts during state fiscal year 2022, we noted the following: • Two instances (or 2 percent) in which subgrant contracts were not monitored annually; • One instance (or 1 percent) in which no documentation for a corrective action plan was provided. Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect MDHS programmatic funding divisions rely upon DM monitoring procedures to verify compliance with program regulations and to identify potential problem areas needing corrective action. Failure to properly monitor subrecipients in an effective manner could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in questioned costs. Recommendation We recommend the Mississippi Department of Human Services’ Division of Program Integrity – Division of Monitoring (DM) strengthen controls over subrecipient monitoring. We also recommend the Mississippi Department of Human Services’ Office of Compliance - Division of Monitoring perform monitoring reviews over subrecipients as prescribed by the Code of Federal Regulations and MDHS’ monitoring policies and procedures. Repeat Finding Yes; 2022-017. Statistically Valid No

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-017 Strengthen Controls over On-Site Monitoring for the Low Income Home Energy Assistance Program (LIHEAP). ALN Number(s) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSLIEA G2101MSCCDF G2101MSCCDD Questioned Costs N/A Criteria The auditor evaluated the Mississippi Department of Human Services’ (MDHS’s) compliance with subrecipient monitoring requirements based on written policies and procedures designed by MDHS’s Office of Compliance – Division of Monitoring (DM) to satisfy during-the-award monitoring requirements. DM procedures require: an on-site monitoring review of each subrecipient contract at least once during the subgrant period. Monitoring tools/checklists are used during each on-site monitoring review to provide guidance and to document a review was performed. The on-site monitoring workpapers are reviewed and approved by DM supervisory personnel prior to issuance of a written report, the Initial Report of Findings & Recommendations, which is used for communicating finding(s) and/or questioned costs to subrecipients. The written report should be issued within 60 days from the date of the exit conference, which is normally held on the last day of the on-site review. Additionally, if the initial report identifies any administrative findings or questioned costs, a response to the findings is required to be submitted by the subrecipient to DM within thirty (30) working days from the date the report was issued. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Manual specifies that a satisfactory control environment is only effective when there are adequate control activities in place. Effective control activities dictate that: the agency perform appropriate multi-level reviews over the monitoring process and the agency ensures timely communication from the subgrantees and timely resolution of findings in order to prevent; detect; and deter fraud, waste, and abuse or the misuse of federal funds. Condition When performing testwork over subrecipient on-site monitoring for 125 subgrant contracts during state fiscal year 2022, we noted the following: • Two instances (or 2 percent) in which subgrant contracts were not monitored annually; • One instance (or 1 percent) in which no documentation for a corrective action plan was provided. Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect MDHS programmatic funding divisions rely upon DM monitoring procedures to verify compliance with program regulations and to identify potential problem areas needing corrective action. Failure to properly monitor subrecipients in an effective manner could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in questioned costs. Recommendation We recommend the Mississippi Department of Human Services’ Division of Program Integrity – Division of Monitoring (DM) strengthen controls over subrecipient monitoring. We also recommend the Mississippi Department of Human Services’ Office of Compliance - Division of Monitoring perform monitoring reviews over subrecipients as prescribed by the Code of Federal Regulations and MDHS’ monitoring policies and procedures. Repeat Finding Yes; 2022-017. Statistically Valid No

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-017 Strengthen Controls over On-Site Monitoring for the Low Income Home Energy Assistance Program (LIHEAP). ALN Number(s) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSLIEA G2101MSCCDF G2101MSCCDD Questioned Costs N/A Criteria The auditor evaluated the Mississippi Department of Human Services’ (MDHS’s) compliance with subrecipient monitoring requirements based on written policies and procedures designed by MDHS’s Office of Compliance – Division of Monitoring (DM) to satisfy during-the-award monitoring requirements. DM procedures require: an on-site monitoring review of each subrecipient contract at least once during the subgrant period. Monitoring tools/checklists are used during each on-site monitoring review to provide guidance and to document a review was performed. The on-site monitoring workpapers are reviewed and approved by DM supervisory personnel prior to issuance of a written report, the Initial Report of Findings & Recommendations, which is used for communicating finding(s) and/or questioned costs to subrecipients. The written report should be issued within 60 days from the date of the exit conference, which is normally held on the last day of the on-site review. Additionally, if the initial report identifies any administrative findings or questioned costs, a response to the findings is required to be submitted by the subrecipient to DM within thirty (30) working days from the date the report was issued. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Manual specifies that a satisfactory control environment is only effective when there are adequate control activities in place. Effective control activities dictate that: the agency perform appropriate multi-level reviews over the monitoring process and the agency ensures timely communication from the subgrantees and timely resolution of findings in order to prevent; detect; and deter fraud, waste, and abuse or the misuse of federal funds. Condition When performing testwork over subrecipient on-site monitoring for 125 subgrant contracts during state fiscal year 2022, we noted the following: • Two instances (or 2 percent) in which subgrant contracts were not monitored annually; • One instance (or 1 percent) in which no documentation for a corrective action plan was provided. Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect MDHS programmatic funding divisions rely upon DM monitoring procedures to verify compliance with program regulations and to identify potential problem areas needing corrective action. Failure to properly monitor subrecipients in an effective manner could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in questioned costs. Recommendation We recommend the Mississippi Department of Human Services’ Division of Program Integrity – Division of Monitoring (DM) strengthen controls over subrecipient monitoring. We also recommend the Mississippi Department of Human Services’ Office of Compliance - Division of Monitoring perform monitoring reviews over subrecipients as prescribed by the Code of Federal Regulations and MDHS’ monitoring policies and procedures. Repeat Finding Yes; 2022-017. Statistically Valid No

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-017 Strengthen Controls over On-Site Monitoring for the Low Income Home Energy Assistance Program (LIHEAP). ALN Number(s) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSLIEA G2101MSCCDF G2101MSCCDD Questioned Costs N/A Criteria The auditor evaluated the Mississippi Department of Human Services’ (MDHS’s) compliance with subrecipient monitoring requirements based on written policies and procedures designed by MDHS’s Office of Compliance – Division of Monitoring (DM) to satisfy during-the-award monitoring requirements. DM procedures require: an on-site monitoring review of each subrecipient contract at least once during the subgrant period. Monitoring tools/checklists are used during each on-site monitoring review to provide guidance and to document a review was performed. The on-site monitoring workpapers are reviewed and approved by DM supervisory personnel prior to issuance of a written report, the Initial Report of Findings & Recommendations, which is used for communicating finding(s) and/or questioned costs to subrecipients. The written report should be issued within 60 days from the date of the exit conference, which is normally held on the last day of the on-site review. Additionally, if the initial report identifies any administrative findings or questioned costs, a response to the findings is required to be submitted by the subrecipient to DM within thirty (30) working days from the date the report was issued. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Manual specifies that a satisfactory control environment is only effective when there are adequate control activities in place. Effective control activities dictate that: the agency perform appropriate multi-level reviews over the monitoring process and the agency ensures timely communication from the subgrantees and timely resolution of findings in order to prevent; detect; and deter fraud, waste, and abuse or the misuse of federal funds. Condition When performing testwork over subrecipient on-site monitoring for 125 subgrant contracts during state fiscal year 2022, we noted the following: • Two instances (or 2 percent) in which subgrant contracts were not monitored annually; • One instance (or 1 percent) in which no documentation for a corrective action plan was provided. Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect MDHS programmatic funding divisions rely upon DM monitoring procedures to verify compliance with program regulations and to identify potential problem areas needing corrective action. Failure to properly monitor subrecipients in an effective manner could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in questioned costs. Recommendation We recommend the Mississippi Department of Human Services’ Division of Program Integrity – Division of Monitoring (DM) strengthen controls over subrecipient monitoring. We also recommend the Mississippi Department of Human Services’ Office of Compliance - Division of Monitoring perform monitoring reviews over subrecipients as prescribed by the Code of Federal Regulations and MDHS’ monitoring policies and procedures. Repeat Finding Yes; 2022-017. Statistically Valid No

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-017 Strengthen Controls over On-Site Monitoring for the Low Income Home Energy Assistance Program (LIHEAP). ALN Number(s) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSLIEA G2101MSCCDF G2101MSCCDD Questioned Costs N/A Criteria The auditor evaluated the Mississippi Department of Human Services’ (MDHS’s) compliance with subrecipient monitoring requirements based on written policies and procedures designed by MDHS’s Office of Compliance – Division of Monitoring (DM) to satisfy during-the-award monitoring requirements. DM procedures require: an on-site monitoring review of each subrecipient contract at least once during the subgrant period. Monitoring tools/checklists are used during each on-site monitoring review to provide guidance and to document a review was performed. The on-site monitoring workpapers are reviewed and approved by DM supervisory personnel prior to issuance of a written report, the Initial Report of Findings & Recommendations, which is used for communicating finding(s) and/or questioned costs to subrecipients. The written report should be issued within 60 days from the date of the exit conference, which is normally held on the last day of the on-site review. Additionally, if the initial report identifies any administrative findings or questioned costs, a response to the findings is required to be submitted by the subrecipient to DM within thirty (30) working days from the date the report was issued. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Manual specifies that a satisfactory control environment is only effective when there are adequate control activities in place. Effective control activities dictate that: the agency perform appropriate multi-level reviews over the monitoring process and the agency ensures timely communication from the subgrantees and timely resolution of findings in order to prevent; detect; and deter fraud, waste, and abuse or the misuse of federal funds. Condition When performing testwork over subrecipient on-site monitoring for 125 subgrant contracts during state fiscal year 2022, we noted the following: • Two instances (or 2 percent) in which subgrant contracts were not monitored annually; • One instance (or 1 percent) in which no documentation for a corrective action plan was provided. Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect MDHS programmatic funding divisions rely upon DM monitoring procedures to verify compliance with program regulations and to identify potential problem areas needing corrective action. Failure to properly monitor subrecipients in an effective manner could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in questioned costs. Recommendation We recommend the Mississippi Department of Human Services’ Division of Program Integrity – Division of Monitoring (DM) strengthen controls over subrecipient monitoring. We also recommend the Mississippi Department of Human Services’ Office of Compliance - Division of Monitoring perform monitoring reviews over subrecipients as prescribed by the Code of Federal Regulations and MDHS’ monitoring policies and procedures. Repeat Finding Yes; 2022-017. Statistically Valid No

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DEPARTMENT OF REHABILITATION SERVICES ALLOWABLE COSTS / ACTIVITIES ALLOWED Significant Deficiency 2023-008 Strengthen Controls to Ensure Compliance with Allowable Costs Requirements for the Social Security Disability Insurance Program ALN Number(s) 96.001 Social Security-Disability Insurance 96.006 Supplemental Security Income Federal Award No. 2104MSD100 Questioned Costs $14 Criteria Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: “Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition During the period of performance testing, we noted that an expenditure was issued to the wrong provider. Upon review of the approved claim and general ledger, we noted that the disbursement was issued to a different provider. Cause The error was due to a manual data entry error that occurred when the provider payment request was entered in State’s account payable module. The error was not identified as a part of the review and approval process. Effect The disbursement to the wrong provider was not determined as an allowable since the provider did not submit a payment request. In addition, the Department did not approve the payment to that provider. Recommendation We recommend that the department enhance its internal controls to ensure that disbursements are issued to the correct provider. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF REHABILITATION SERVICES PERIOD OF PERFORMANCE Significant Deficiency 2023-007 Strengthen Controls to Ensure Compliance with the Period of Performance for the Social Security Disability Insurance Program. ALN Number(s) 96.001 Social Security-Disability Insurance 96.006 Supplemental Security Income Federal Award No. 2104MSD100 2204MSD100 2304MSD100 Questioned Costs $13,517 Criteria Per the Code of Federal Regulations (2 CFR 200.308, 200.309, and 200.403(h)), A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity. A period of performance may contain one or more budget periods. Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: “Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition Program expenditures were not charged to the grant within the period of performance. We identified the following: • Two instances in which the expenditure was charged to the grant prior to the start of the grant, • Three instances in which the expenditure was charged after the grant’s end date. Cause The Department charging the grants outside of the period of performance was due to an error that was not identified during the review process. In addition, one expenditure supported costs for an annual agreement in which the service period started in one grant period and ended in another grant period. The Department elected to charge the costs to the grant starting after to expenditure incurred date, since most of the service would occur during that grant’s period. Effect The grantor may deem the costs charged outside of the period of performance as unallowable. Recommendation We recommend that the department enhance its internal controls to ensure all costs are incurred within the period of performance specified in the notice of award. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY SPECIAL TESTS AND PROVISIONS - UI BENEFIT PAYMENTS Significant Deficiency 2023-009 Strengthen Controls to Ensure Compliance with Special Test - UI Benefit Payment Requirements for Unemployment Insurance ALN Number (s) 17.225 Unemployment Insurance Federal Award No. UI-37232-22-55-A-28 Questioned Costs N/A Criteria The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that case reviews were reviewed and approved by investigator staff. Cause The Department’s internal controls were not sufficient to ensure that it maintained documentation of investigator review and approval for all BAM case reviews Effect Incomplete documentation of BAM case reviews could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation We recommend the Department review and enhance procedures and controls to ensure that documentation of investigator review and approval of all BAM case reviews is maintained. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY SPECIAL TESTS AND PROVISIONS - UI BENEFIT PAYMENTS Significant Deficiency 2023-009 Strengthen Controls to Ensure Compliance with Special Test - UI Benefit Payment Requirements for Unemployment Insurance ALN Number (s) 17.225 Unemployment Insurance Federal Award No. UI-37232-22-55-A-28 Questioned Costs N/A Criteria The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that case reviews were reviewed and approved by investigator staff. Cause The Department’s internal controls were not sufficient to ensure that it maintained documentation of investigator review and approval for all BAM case reviews Effect Incomplete documentation of BAM case reviews could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation We recommend the Department review and enhance procedures and controls to ensure that documentation of investigator review and approval of all BAM case reviews is maintained. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY SPECIAL TESTS AND PROVISIONS - UI BENEFIT PAYMENTS Significant Deficiency 2023-009 Strengthen Controls to Ensure Compliance with Special Test - UI Benefit Payment Requirements for Unemployment Insurance ALN Number (s) 17.225 Unemployment Insurance Federal Award No. UI-37232-22-55-A-28 Questioned Costs N/A Criteria The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that case reviews were reviewed and approved by investigator staff. Cause The Department’s internal controls were not sufficient to ensure that it maintained documentation of investigator review and approval for all BAM case reviews Effect Incomplete documentation of BAM case reviews could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation We recommend the Department review and enhance procedures and controls to ensure that documentation of investigator review and approval of all BAM case reviews is maintained. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY ELIGIBILITY Significant Deficiency 2023-012 Strengthen controls to ensure compliance with eligibility requirements for the WIOA assistance program. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per The Code of Federal Regulations (20 CFR 680-683), state workforce agencies must ensure that individuals are eligible to participate in the program. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that the eligibility determination for a participant had been reviewed and approved. Cause Internal controls were not sufficient to ensure that documentation supporting participant eligibility was reviewed and approved by a supervisor. Effect Failure to ensure that all eligibility documentation is properly reviewed and approved could result in ineligible individuals participating in the program. Recommendation MDES should review and enhance internal controls and procedures to ensure that participant eligibility documentation is properly reviewed and approved by a supervisor. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY REPORTING Material Weakness Material Noncompliance 2023-010 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) did not report subaward information to FSRS within thirty days after issuing the subaward or subaward amendment. Cause MDES’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS no later than the end of the month following the month of issuance. Effect Subawards were not reported to FSRS in accordance with FFATA requirements. Recommendation We recommend MDES establish procedures and internal controls to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance of each subaward. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY SUBRECIPIENT MONITORING Material Weakness Immaterial Noncompliance 2023-011 Strengthen Controls to Ensure Compliance with Subrecipient Monitoring Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. UI-34724-20-55-A-28 Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 200.332(a)), states all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. The Code of Federal Regulations (2 CFR 200.332) also states that pass-through entities must: d) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; 4. The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation of subaward agreements and monitoring activities performed. Cause Internal controls were not sufficient to ensure that copies of subaward agreements were maintained and available for audit, nor that it maintained documentation of subrecipient monitoring activities performed. Effect Auditors were unable to verify that subawards were issued in accordance with Federal requirements nor that the subrecipients had been adequately monitored and were audited as required by Subpart F. Recommendation MDES should review and enhance internal controls and procedures to ensure that it maintains copies of all subaward agreements, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed for all subrecipients. Copies of subawards and documentation of subrecipient monitoring activities should be readily available for audit. Repeat Finding Yes; 2022-023. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY ELIGIBILITY Significant Deficiency 2023-012 Strengthen controls to ensure compliance with eligibility requirements for the WIOA assistance program. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per The Code of Federal Regulations (20 CFR 680-683), state workforce agencies must ensure that individuals are eligible to participate in the program. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that the eligibility determination for a participant had been reviewed and approved. Cause Internal controls were not sufficient to ensure that documentation supporting participant eligibility was reviewed and approved by a supervisor. Effect Failure to ensure that all eligibility documentation is properly reviewed and approved could result in ineligible individuals participating in the program. Recommendation MDES should review and enhance internal controls and procedures to ensure that participant eligibility documentation is properly reviewed and approved by a supervisor. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY REPORTING Material Weakness Material Noncompliance 2023-010 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) did not report subaward information to FSRS within thirty days after issuing the subaward or subaward amendment. Cause MDES’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS no later than the end of the month following the month of issuance. Effect Subawards were not reported to FSRS in accordance with FFATA requirements. Recommendation We recommend MDES establish procedures and internal controls to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance of each subaward. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY SUBRECIPIENT MONITORING Material Weakness Immaterial Noncompliance 2023-011 Strengthen Controls to Ensure Compliance with Subrecipient Monitoring Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. UI-34724-20-55-A-28 Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 200.332(a)), states all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. The Code of Federal Regulations (2 CFR 200.332) also states that pass-through entities must: d) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; 4. The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation of subaward agreements and monitoring activities performed. Cause Internal controls were not sufficient to ensure that copies of subaward agreements were maintained and available for audit, nor that it maintained documentation of subrecipient monitoring activities performed. Effect Auditors were unable to verify that subawards were issued in accordance with Federal requirements nor that the subrecipients had been adequately monitored and were audited as required by Subpart F. Recommendation MDES should review and enhance internal controls and procedures to ensure that it maintains copies of all subaward agreements, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed for all subrecipients. Copies of subawards and documentation of subrecipient monitoring activities should be readily available for audit. Repeat Finding Yes; 2022-023. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY ELIGIBILITY Significant Deficiency 2023-012 Strengthen controls to ensure compliance with eligibility requirements for the WIOA assistance program. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per The Code of Federal Regulations (20 CFR 680-683), state workforce agencies must ensure that individuals are eligible to participate in the program. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation that the eligibility determination for a participant had been reviewed and approved. Cause Internal controls were not sufficient to ensure that documentation supporting participant eligibility was reviewed and approved by a supervisor. Effect Failure to ensure that all eligibility documentation is properly reviewed and approved could result in ineligible individuals participating in the program. Recommendation MDES should review and enhance internal controls and procedures to ensure that participant eligibility documentation is properly reviewed and approved by a supervisor. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY REPORTING Material Weakness Material Noncompliance 2023-010 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. AA-38538-22-55-A-28 Questioned Costs N/A Criteria Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) did not report subaward information to FSRS within thirty days after issuing the subaward or subaward amendment. Cause MDES’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS no later than the end of the month following the month of issuance. Effect Subawards were not reported to FSRS in accordance with FFATA requirements. Recommendation We recommend MDES establish procedures and internal controls to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance of each subaward. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF EMPLOYMENT SECURITY SUBRECIPIENT MONITORING Material Weakness Immaterial Noncompliance 2023-011 Strengthen Controls to Ensure Compliance with Subrecipient Monitoring Requirements. ALN Number (s) 17.258, 17.259, 17.278 – Workforce Innovation and Opportunity Act Federal Award No. UI-34724-20-55-A-28 Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 200.332(a)), states all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. The Code of Federal Regulations (2 CFR 200.332) also states that pass-through entities must: d) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; 4. The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Mississippi Department of Employment Security (MDES) was unable to provide documentation of subaward agreements and monitoring activities performed. Cause Internal controls were not sufficient to ensure that copies of subaward agreements were maintained and available for audit, nor that it maintained documentation of subrecipient monitoring activities performed. Effect Auditors were unable to verify that subawards were issued in accordance with Federal requirements nor that the subrecipients had been adequately monitored and were audited as required by Subpart F. Recommendation MDES should review and enhance internal controls and procedures to ensure that it maintains copies of all subaward agreements, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed for all subrecipients. Copies of subawards and documentation of subrecipient monitoring activities should be readily available for audit. Repeat Finding Yes; 2022-023. Statistically Valid No.

DEPARTMENT OF FINANCE AND ADMINISTRATION ELIGIBILITY Material Weakness Material Noncompliance 2023-025 Strengthen Controls to Ensure Compliance with Eligibility Requirements for the Emergency Rental Assistance Program. ALN Number(s) 21.023 COVID-19 Emergency Rental Assistance (ERA) Federal Award No. N/A Questioned Costs N/A Criteria Code of Federal Regulations (2 CFR 200.303(a)) states that the Non-federal entity should establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee Sponsoring Organizations of the Treadway Commission (COSO). Frequently Asked Questions (FAQ’s) as guidance regarding the requirements of the Emergency Rental Assistance program (ERA1) established by section 501 of Division N of the Consolidated Appropriation Act, 2021, Pub. L. No. 116-260 (December 27, 2020) and the Emergency Rental Assistance Program (ERA2) established by section 3201 of the American Rescue Plan Act of 2021, Pub. L. No. 117-2 (March 11, 2021) states that grantees must require all applications for assistance to include an attestation from the applicant household that all information included is correct and complete. In all cases, grantees must document their policies and procedures for determining household eligibility to include policies and procedures for determining the prioritization of households in compliance with the statute and maintain records of their determinations. Grantees must also have controls in place to ensure compliance with their policies and procedures and prevent fraud. Condition The Department of Finance and Administration (DFA) did not review and assess procedures over eligibility determination to prevent fraudulent applications from being approved and funds disbursed. DFA’s third-party administrator, Mississippi Home Corporation (MHC), fiscal year 2023 single audit report identified a finding related to the approval of fraudulent applications due to the self-attestation process. DFA did not implement nor ensure that corrective action was implemented to mitigate the fraud from reoccurring. Cause DFA does not consider MHC as a subrecipient nor does DFA assume responsibility for the direct and material compliance requirements. The program is administered without any responsibility and oversight from the State of Mississippi, the grant recipient. Effect Without proper monitoring and administration of the grant, the risk of non-compliance due to fraud is increased and could result in questioned costs. Recommendation We recommend the Department of Finance and Administration strengthen controls to ensure compliance with eligibility requirements for the Emergency Rental Assistance Program. Repeat Finding Yes; 2022-031 Statistically Valid No.

DEPARTMENT OF FINANCE AND ADMINISTRATION MONITORING Material Weakness Material Noncompliance 2023-026 Strengthen Controls to Ensure Compliance with Federal Monitoring Requirements. ALN Number(s) 21.023 COVID-19 Emergency Rental Assistance (ERA) Federal Award No. N/A Questioned Costs N/A Criteria Code of Federal Regulations (2 CFR 200.400) requires the non-federal entity: • To be responsible for the efficient and effective administration of the Federal award through the application of sound management practices. • Assume responsibility for administering Federal funds in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the Federal award. • Ensure the cost allocation plans or indirect cost proposals, the cognizant agency for indirect costs should generally assure that the non-Federal entity is applying these cost accounting principles on a consistent basis during the review and negotiation of indirect cost proposals. Where wide variations exist in the treatment of a given cost item by the non-Federal entity, the reasonableness and equity of such treatments should be fully considered. Code of Federal Regulations (2 CFR 200.303) requires the Non-federal entity: • Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). • Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations and terms and conditions of Federal awards. Condition The Department of Finance and Administration (DFA) passed federal funds to a third-party administrator, Mississippi Home Corporation (MHC) but did not document this subrecipient relationship via a subaward agreement, nor did DFA monitor and support MHC as a subrecipient. MHC is a quasi-governmental agency and not part of the State of Mississippi’s financial reporting structure. Therefore, due to lack of support of the subrecipient relationship, we the deemed the programs to be administered by DFA. During testing we noted that DFA did not assume responsibility for the administration of the federal award as required by 2 CFR 200.400, nor did they establish and maintain effective internal controls over the federal award as required by 2 CFR 200.303. DFA did not document their review and approval of program costs which included payroll cost charged to the program based on a billing methodology used for program cost charged to U.S. Department of Housing and Urban Development (HUD) housing counseling grants. There was no evidence of DFA’s review and approval over eligibility determined by the MHC or financial and programmatic reports prepared by MHC. Cause The Mississippi Department of Finance and Administration (DFA) does not consider Mississippi Home Corporation as a subrecipient nor does DFA assume responsibility for the direct and material compliance requirements. The program is administered without any responsibility and oversight from the State of Mississippi, the grant recipient. Effect Without proper monitoring there is an increased risk of charging unallowed costs and activity to the program and noncompliance with direct and material compliance requirements. Recommendation We recommend the Department of Finance and Administration strengthen controls to ensure compliance with monitoring processes in order to ensure federal compliance requirements are being met. Repeat Finding Yes; 2022-032. Statistically Valid No.

DEPARTMENT OF EDUCATION REPORTING Significant Deficiency Immaterial Noncompliance 2023-014 Strengthen Controls to Ensure Compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements ALN Number(s) 84.425 Education Stabilization Fund Federal Award No. S425W210025-ARP-HCY Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. Condition During testwork performed for the Federal Funding Accountability and Transparency Act (FFATA) reporting fiscal year 2023, the auditor noted the following exceptions: • Ten instances out of 10 reports (or 100%) tested for ARP - Elementary and Secondary School Emergency Relief for Homeless Children and Youth (ARP-HCY), in which the reports were not submitted within the required timeframe. Cause MDE personnel did not ensure timely submission of FFATA reports. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Education (MDE) strengthen controls to ensure compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. Repeat Finding Yes; 2022-028. Statistically Valid Yes.

DEPARTMENT OF EDUCATION REPORTING Significant Deficiency Immaterial Noncompliance 2023-014 Strengthen Controls to Ensure Compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements ALN Number(s) 84.425 Education Stabilization Fund Federal Award No. S425W210025-ARP-HCY Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. Condition During testwork performed for the Federal Funding Accountability and Transparency Act (FFATA) reporting fiscal year 2023, the auditor noted the following exceptions: • Ten instances out of 10 reports (or 100%) tested for ARP - Elementary and Secondary School Emergency Relief for Homeless Children and Youth (ARP-HCY), in which the reports were not submitted within the required timeframe. Cause MDE personnel did not ensure timely submission of FFATA reports. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Education (MDE) strengthen controls to ensure compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. Repeat Finding Yes; 2022-028. Statistically Valid Yes.

DEPARTMENT OF EDUCATION REPORTING Significant Deficiency Immaterial Noncompliance 2023-014 Strengthen Controls to Ensure Compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements ALN Number(s) 84.425 Education Stabilization Fund Federal Award No. S425W210025-ARP-HCY Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. Condition During testwork performed for the Federal Funding Accountability and Transparency Act (FFATA) reporting fiscal year 2023, the auditor noted the following exceptions: • Ten instances out of 10 reports (or 100%) tested for ARP - Elementary and Secondary School Emergency Relief for Homeless Children and Youth (ARP-HCY), in which the reports were not submitted within the required timeframe. Cause MDE personnel did not ensure timely submission of FFATA reports. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Education (MDE) strengthen controls to ensure compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. Repeat Finding Yes; 2022-028. Statistically Valid Yes.

DEPARTMENT OF EDUCATION REPORTING Significant Deficiency Immaterial Noncompliance 2023-014 Strengthen Controls to Ensure Compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements ALN Number(s) 84.425 Education Stabilization Fund Federal Award No. S425W210025-ARP-HCY Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. Condition During testwork performed for the Federal Funding Accountability and Transparency Act (FFATA) reporting fiscal year 2023, the auditor noted the following exceptions: • Ten instances out of 10 reports (or 100%) tested for ARP - Elementary and Secondary School Emergency Relief for Homeless Children and Youth (ARP-HCY), in which the reports were not submitted within the required timeframe. Cause MDE personnel did not ensure timely submission of FFATA reports. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Education (MDE) strengthen controls to ensure compliance with Federal Funding Accountability and Transparency Act (FFATA) requirements. Repeat Finding Yes; 2022-028. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-017 Strengthen Controls over On-Site Monitoring for the Low Income Home Energy Assistance Program (LIHEAP). ALN Number(s) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSLIEA G2101MSCCDF G2101MSCCDD Questioned Costs N/A Criteria The auditor evaluated the Mississippi Department of Human Services’ (MDHS’s) compliance with subrecipient monitoring requirements based on written policies and procedures designed by MDHS’s Office of Compliance – Division of Monitoring (DM) to satisfy during-the-award monitoring requirements. DM procedures require: an on-site monitoring review of each subrecipient contract at least once during the subgrant period. Monitoring tools/checklists are used during each on-site monitoring review to provide guidance and to document a review was performed. The on-site monitoring workpapers are reviewed and approved by DM supervisory personnel prior to issuance of a written report, the Initial Report of Findings & Recommendations, which is used for communicating finding(s) and/or questioned costs to subrecipients. The written report should be issued within 60 days from the date of the exit conference, which is normally held on the last day of the on-site review. Additionally, if the initial report identifies any administrative findings or questioned costs, a response to the findings is required to be submitted by the subrecipient to DM within thirty (30) working days from the date the report was issued. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Manual specifies that a satisfactory control environment is only effective when there are adequate control activities in place. Effective control activities dictate that: the agency perform appropriate multi-level reviews over the monitoring process and the agency ensures timely communication from the subgrantees and timely resolution of findings in order to prevent; detect; and deter fraud, waste, and abuse or the misuse of federal funds. Condition When performing testwork over subrecipient on-site monitoring for 125 subgrant contracts during state fiscal year 2022, we noted the following: • Two instances (or 2 percent) in which subgrant contracts were not monitored annually; • One instance (or 1 percent) in which no documentation for a corrective action plan was provided. Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect MDHS programmatic funding divisions rely upon DM monitoring procedures to verify compliance with program regulations and to identify potential problem areas needing corrective action. Failure to properly monitor subrecipients in an effective manner could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in questioned costs. Recommendation We recommend the Mississippi Department of Human Services’ Division of Program Integrity – Division of Monitoring (DM) strengthen controls over subrecipient monitoring. We also recommend the Mississippi Department of Human Services’ Office of Compliance - Division of Monitoring perform monitoring reviews over subrecipients as prescribed by the Code of Federal Regulations and MDHS’ monitoring policies and procedures. Repeat Finding Yes; 2022-017. Statistically Valid No

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-017 Strengthen Controls over On-Site Monitoring for the Low Income Home Energy Assistance Program (LIHEAP). ALN Number(s) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSLIEA G2101MSCCDF G2101MSCCDD Questioned Costs N/A Criteria The auditor evaluated the Mississippi Department of Human Services’ (MDHS’s) compliance with subrecipient monitoring requirements based on written policies and procedures designed by MDHS’s Office of Compliance – Division of Monitoring (DM) to satisfy during-the-award monitoring requirements. DM procedures require: an on-site monitoring review of each subrecipient contract at least once during the subgrant period. Monitoring tools/checklists are used during each on-site monitoring review to provide guidance and to document a review was performed. The on-site monitoring workpapers are reviewed and approved by DM supervisory personnel prior to issuance of a written report, the Initial Report of Findings & Recommendations, which is used for communicating finding(s) and/or questioned costs to subrecipients. The written report should be issued within 60 days from the date of the exit conference, which is normally held on the last day of the on-site review. Additionally, if the initial report identifies any administrative findings or questioned costs, a response to the findings is required to be submitted by the subrecipient to DM within thirty (30) working days from the date the report was issued. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Manual specifies that a satisfactory control environment is only effective when there are adequate control activities in place. Effective control activities dictate that: the agency perform appropriate multi-level reviews over the monitoring process and the agency ensures timely communication from the subgrantees and timely resolution of findings in order to prevent; detect; and deter fraud, waste, and abuse or the misuse of federal funds. Condition When performing testwork over subrecipient on-site monitoring for 125 subgrant contracts during state fiscal year 2022, we noted the following: • Two instances (or 2 percent) in which subgrant contracts were not monitored annually; • One instance (or 1 percent) in which no documentation for a corrective action plan was provided. Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect MDHS programmatic funding divisions rely upon DM monitoring procedures to verify compliance with program regulations and to identify potential problem areas needing corrective action. Failure to properly monitor subrecipients in an effective manner could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in questioned costs. Recommendation We recommend the Mississippi Department of Human Services’ Division of Program Integrity – Division of Monitoring (DM) strengthen controls over subrecipient monitoring. We also recommend the Mississippi Department of Human Services’ Office of Compliance - Division of Monitoring perform monitoring reviews over subrecipients as prescribed by the Code of Federal Regulations and MDHS’ monitoring policies and procedures. Repeat Finding Yes; 2022-017. Statistically Valid No

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-017 Strengthen Controls over On-Site Monitoring for the Low Income Home Energy Assistance Program (LIHEAP). ALN Number(s) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSLIEA G2101MSCCDF G2101MSCCDD Questioned Costs N/A Criteria The auditor evaluated the Mississippi Department of Human Services’ (MDHS’s) compliance with subrecipient monitoring requirements based on written policies and procedures designed by MDHS’s Office of Compliance – Division of Monitoring (DM) to satisfy during-the-award monitoring requirements. DM procedures require: an on-site monitoring review of each subrecipient contract at least once during the subgrant period. Monitoring tools/checklists are used during each on-site monitoring review to provide guidance and to document a review was performed. The on-site monitoring workpapers are reviewed and approved by DM supervisory personnel prior to issuance of a written report, the Initial Report of Findings & Recommendations, which is used for communicating finding(s) and/or questioned costs to subrecipients. The written report should be issued within 60 days from the date of the exit conference, which is normally held on the last day of the on-site review. Additionally, if the initial report identifies any administrative findings or questioned costs, a response to the findings is required to be submitted by the subrecipient to DM within thirty (30) working days from the date the report was issued. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Manual specifies that a satisfactory control environment is only effective when there are adequate control activities in place. Effective control activities dictate that: the agency perform appropriate multi-level reviews over the monitoring process and the agency ensures timely communication from the subgrantees and timely resolution of findings in order to prevent; detect; and deter fraud, waste, and abuse or the misuse of federal funds. Condition When performing testwork over subrecipient on-site monitoring for 125 subgrant contracts during state fiscal year 2022, we noted the following: • Two instances (or 2 percent) in which subgrant contracts were not monitored annually; • One instance (or 1 percent) in which no documentation for a corrective action plan was provided. Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect MDHS programmatic funding divisions rely upon DM monitoring procedures to verify compliance with program regulations and to identify potential problem areas needing corrective action. Failure to properly monitor subrecipients in an effective manner could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in questioned costs. Recommendation We recommend the Mississippi Department of Human Services’ Division of Program Integrity – Division of Monitoring (DM) strengthen controls over subrecipient monitoring. We also recommend the Mississippi Department of Human Services’ Office of Compliance - Division of Monitoring perform monitoring reviews over subrecipients as prescribed by the Code of Federal Regulations and MDHS’ monitoring policies and procedures. Repeat Finding Yes; 2022-017. Statistically Valid No

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-017 Strengthen Controls over On-Site Monitoring for the Low Income Home Energy Assistance Program (LIHEAP). ALN Number(s) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSLIEA G2101MSCCDF G2101MSCCDD Questioned Costs N/A Criteria The auditor evaluated the Mississippi Department of Human Services’ (MDHS’s) compliance with subrecipient monitoring requirements based on written policies and procedures designed by MDHS’s Office of Compliance – Division of Monitoring (DM) to satisfy during-the-award monitoring requirements. DM procedures require: an on-site monitoring review of each subrecipient contract at least once during the subgrant period. Monitoring tools/checklists are used during each on-site monitoring review to provide guidance and to document a review was performed. The on-site monitoring workpapers are reviewed and approved by DM supervisory personnel prior to issuance of a written report, the Initial Report of Findings & Recommendations, which is used for communicating finding(s) and/or questioned costs to subrecipients. The written report should be issued within 60 days from the date of the exit conference, which is normally held on the last day of the on-site review. Additionally, if the initial report identifies any administrative findings or questioned costs, a response to the findings is required to be submitted by the subrecipient to DM within thirty (30) working days from the date the report was issued. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Manual specifies that a satisfactory control environment is only effective when there are adequate control activities in place. Effective control activities dictate that: the agency perform appropriate multi-level reviews over the monitoring process and the agency ensures timely communication from the subgrantees and timely resolution of findings in order to prevent; detect; and deter fraud, waste, and abuse or the misuse of federal funds. Condition When performing testwork over subrecipient on-site monitoring for 125 subgrant contracts during state fiscal year 2022, we noted the following: • Two instances (or 2 percent) in which subgrant contracts were not monitored annually; • One instance (or 1 percent) in which no documentation for a corrective action plan was provided. Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect MDHS programmatic funding divisions rely upon DM monitoring procedures to verify compliance with program regulations and to identify potential problem areas needing corrective action. Failure to properly monitor subrecipients in an effective manner could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in questioned costs. Recommendation We recommend the Mississippi Department of Human Services’ Division of Program Integrity – Division of Monitoring (DM) strengthen controls over subrecipient monitoring. We also recommend the Mississippi Department of Human Services’ Office of Compliance - Division of Monitoring perform monitoring reviews over subrecipients as prescribed by the Code of Federal Regulations and MDHS’ monitoring policies and procedures. Repeat Finding Yes; 2022-017. Statistically Valid No

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DEPARTMENT OF HUMAN SERVICES REPORTING Material Weakness Material Noncompliance 2023-016 Strengthen Controls to Ensure Compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSTANF G2301MSLIEA G2101MSCCDF G2001MSTANF Questioned Costs N/A Criteria The Code of Federal Regulations (2 CFR 170, Appendix A((I)(a)(2)(ii)) states a subaward must be reported in FSRS by the last day of the month following the obligation date, which is defined as the date the subaward is signed. The Code of Federal Regulations (2 CFR 170, Appendix A(I)(b)(1)(i)) sets forth the reporting requirements of the Transparency Act that related to subawards under grants. Direct recipients of grants who make first-tier subawards equal to or exceeding $30,000 are required to report each subaward obligating action equal to $30,000 or more in Federal funds. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the U.S. Government Accountability Office Standards for Internal Control in the Federal Government (Green Book) specifies that a satisfactory control environment is only effective when control activities exist. This includes but is not limited to the entity determining which laws and regulations apply to the entity and setting objectives that incorporate these requirements. Condition When performing testwork related to Federal Funding Accountability and Transparency Act (FFATA) Reporting as of June 30, 2023, the auditor noted to following exceptions: • Six instances (or 100 percent) tested for TANF in which the reports were not submitted within the required timeframe; • One instance (or 100 percent) tested for CCDF in which the report was not submitted within the required timeframe; • One instance (or 100 percent) tested for LIHEAP in which the report was not submitted within the required timeframe Cause MDHS personnel did not ensure timely submission of FFATA reporting. Effect Failure to submit reports timely can undermine transparency and accountability since the public will not know about these grant awards in an appropriate manner. Recommendation We recommend the Mississippi Department of Human Services strengthen controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) Reporting. Repeat Finding Yes; 2022-019. Statistically Valid Yes.

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-017 Strengthen Controls over On-Site Monitoring for the Low Income Home Energy Assistance Program (LIHEAP). ALN Number(s) 93.568 Low Income Home Energy Assistance (LIHEAP) 93.489, 93.575, and 93.596 Child Care Development Fund (CCDF) Federal Award G2101MSLIEA G2101MSCCDF G2101MSCCDD Questioned Costs N/A Criteria The auditor evaluated the Mississippi Department of Human Services’ (MDHS’s) compliance with subrecipient monitoring requirements based on written policies and procedures designed by MDHS’s Office of Compliance – Division of Monitoring (DM) to satisfy during-the-award monitoring requirements. DM procedures require: an on-site monitoring review of each subrecipient contract at least once during the subgrant period. Monitoring tools/checklists are used during each on-site monitoring review to provide guidance and to document a review was performed. The on-site monitoring workpapers are reviewed and approved by DM supervisory personnel prior to issuance of a written report, the Initial Report of Findings & Recommendations, which is used for communicating finding(s) and/or questioned costs to subrecipients. The written report should be issued within 60 days from the date of the exit conference, which is normally held on the last day of the on-site review. Additionally, if the initial report identifies any administrative findings or questioned costs, a response to the findings is required to be submitted by the subrecipient to DM within thirty (30) working days from the date the report was issued. The Internal Control – Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Manual specifies that a satisfactory control environment is only effective when there are adequate control activities in place. Effective control activities dictate that: the agency perform appropriate multi-level reviews over the monitoring process and the agency ensures timely communication from the subgrantees and timely resolution of findings in order to prevent; detect; and deter fraud, waste, and abuse or the misuse of federal funds. Condition When performing testwork over subrecipient on-site monitoring for 125 subgrant contracts during state fiscal year 2022, we noted the following: • Two instances (or 2 percent) in which subgrant contracts were not monitored annually; • One instance (or 1 percent) in which no documentation for a corrective action plan was provided. Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect MDHS programmatic funding divisions rely upon DM monitoring procedures to verify compliance with program regulations and to identify potential problem areas needing corrective action. Failure to properly monitor subrecipients in an effective manner could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in questioned costs. Recommendation We recommend the Mississippi Department of Human Services’ Division of Program Integrity – Division of Monitoring (DM) strengthen controls over subrecipient monitoring. We also recommend the Mississippi Department of Human Services’ Office of Compliance - Division of Monitoring perform monitoring reviews over subrecipients as prescribed by the Code of Federal Regulations and MDHS’ monitoring policies and procedures. Repeat Finding Yes; 2022-017. Statistically Valid No

DEPARTMENT OF HUMAN SERVICES SUBRECIPIENT MONITORING Material Weakness Material Noncompliance 2023-018 Strengthen Controls over Subrecipient Monitoring to Ensure Compliance with Uniform Guidance Auditing Requirements. ALN Number(s) 93.558 Temporary Assistance for Needy Families (TANF) 93.489, 93.575, 93.596 Child Care Development Fund (CCDF) 93.568 Low Income Household Energy Assistance (LIHEAP) Federal Award No. G2101MSTANF G2101MSCCDF G2101MSLIEA Questioned Costs N/A Criteria The Code of Federal Regulations (2 cfr §200.331(f)) states all pass-through entities (PTE’s) must verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501 Audit requirements. The Code of Federal Regulations (2 cfr § 200.512(a)(1)) states the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Additionally, per the MDHS Subgrant/Agreement Manual: All MDHS subgrantees are required to complete the MDHS Subgrantee Audit Information Form (MDHS-DPI-002). This form must be submitted to the Division of Monitoring no later than ninety (90) calendar days after the end of the subgrantee’s fiscal year. This form is necessary to certify the sources and amounts of all Federal awards received and expended by the subgrantee. Condition When performing testwork related to OMB Single Audit Monitoring as of June 30, 2023, the auditor noted 16 instances in which the Mississippi Department of Human Services (MDHS) did not ascertain whether Single Audit Requirements were being met by subgrantees Cause Staff were either unaware or did not follow identified policies and procedures for monitoring requirements. Effect Failure to properly monitor subrecipients could allow noncompliance with federal regulations to occur and go undetected, potentially resulting in fraud, waste, and abuse within the agency. Recommendation We recommend the Mississippi Department of Human Services' Office of Compliance - Division of Monitoring (DM) strengthen controls over subrecipient monitoring for Uniform Guidance audits to ensure recipients expending $750,000 or more in Federal funds during their fiscal year are meeting Uniform Guidance Audit requirements. Repeat Finding Yes; 2022-018. Statistically Valid No.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DIVISION OF MEDICAID ELIGIBILITY Material Weakness Material Noncompliance 2023-024 Strengthen Controls to Ensure Compliance with Eligibility Requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program ALN Number(s) 93.767 – Children’s Health Insurance Program (CHIP) 93.775 – State Medicaid Fraud Control Units 93.777 – State Survey and Certification of Health Care Providers and Suppliers 93.778 – Medical Assistance Program (Medicaid; Title XIX) Federal Award No. All Current Active Grants Questioned Costs $26,131 Criteria Code of Federal Regulations (42 CFR § 435.948(a)(1)) states, “The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying the financial eligibility of an individual: Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act." Code of Federal Regulations (42 CFR § 435.949(b)) states, "To the extent that information related to eligibility for Medicaid is available through the electronic service established by the Secretary, States must obtain the information through such service, subject to the requirements in subpart C of part 433 of this chapter, except as provided for in §435.945(k) of this subpart." The Center for Medicaid and CHIP Services (CMCS) Informational Bulletin - Subject: MAGI-Based Eligibility Verification Plans states, "To the extent that information related to Medicaid or CHIP eligibility is available through the electronic data services hub established by the Secretary, states must obtain the information through this data services hub. Subject to Secretarial approval and the conditions described in §435.945(k) and 457.380(i), states can obtain information through a mechanism other than the data services hub." The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 201.03.04A requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Per the Mississippi Division of Medicaid MAGI based Eligibility Verification Plan, Mississippi Division of Medicaid has determined Mississippi Department of Employment Security (MDES) to be a useful electronic data source. Per the Mississippi Medicaid State Plan Attachment 4.32-A, applicants are submitted weekly to MDES to verify wage and unemployment benefits. Renewals are submitted once per month for the same data. Renewal files are processed in the month prior to the scheduled review due date. Code of Federal Regulations (42 CFR § 435.914(a)) states, “The agency must include in each applicant's and beneficiary's case record the information and documentation described in § 431.17(b)(1) of this chapter.” Per Code of Federal Regulations (42 CFR § 431.17(b)(1)), a State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include individual records on each applicant and beneficiary that contain all information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application. Further, the records must contain the disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source. The Mississippi Division of Medicaid Eligibility Policy and Procedures Manual Section 101.08.01 states, “All cases must be thoroughly documented. Documentation is the written record of all information pertaining to the eligibility decision. Case documentation includes the completed application form, the specialist’s verbal and written contacts with the applicant, information requested and received from electronic data sources, the applicant or third-party sources, such as governmental or nongovernmental agencies, businesses and individuals, and notification of the eligibility decision." Miss. Code Ann (1972) Section 43-13-116.1(2) states, “In accordance with Section 1940 of the federal Social Security Act (42 USCS Section 1396w), the Division of Medicaid shall implement an asset verification program requiring each applicant for or recipient of Medicaid assistance on the basis of being aged, blind or disabled, to provide authorization by the applicant or recipient, their spouse, and by any other person whose resources are required by law to be disclosed to determine the eligibility of the applicant or recipient for Medicaid assistance, for the division to obtain from any financial institution financial records and information held by any such financial institution with respect to the applicant, recipient, spouse or such other person, as applicable, that the division determines are needed to verify the financial resources of the applicant, recipient or such other person in connection with a determination or redetermination with respect to eligibility for, or the amount or extent of, Medicaid assistance. Each aged, blind or disabled Medicaid applicant or recipient, their spouse, and any other applicable person described in this section shall provide authorization (as specified by 42 USCS Section 1396w(c)) to the division to obtain from any financial institution, any financial record, whenever the division determines that the record is needed in connection with a determination or redetermination of eligibility for Medicaid assistance.” The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03 states, “Section 1940 of the Social Security Act and Mississippi state law requires the verification of liquid assets held in financial institutions for purposes of determining Medicaid eligibility for applicants and beneficiaries in programs with an asset test, i.e., Aged, Blind, and Disabled (ABD) Medicaid programs.” Per The Mississippi Division of Medicaid Eligibility Policy and Procedure Manual Section 303.03, implementation of MDOM’s Asset Verification System (AVS) is on/after November 1, 2018. The AVS contractor will perform electronic matches with financial institutions to detect and verify bank accounts based on identifiers including Social Security Numbers for the following COEs: 010 through 015, 019, 025, 045, 062 through 066, and 094 through 096. At each application and redetermination, a request will be submitted through AVS for information on an individual’s financial accounts. The AVS must be used as a primary data source when verifying resources. Code of Federal Regulations (42 CFR § 435.945(d)) states, “All State eligibility determination systems must conduct data matching through the Public Assistance Reporting Information System (PARIS).” The Mississippi Division of Medicaid MAGI-Based Eligibility Verification Plan states, “The state uses quarterly PARIS data matches to resolve duplicate Medicaid participation in another state and residency discrepancies.” Per the Mississippi Medicaid State Plan Attachment 4.32-A, quarterly file transmissions of Medicaid recipients active in the previous quarter are submitted for matching purposes with applicable federal databases (PARIS) to identify benefit information on matching Federal civilian employees and military members, both active and retired, and to identify duplicate participation across state lines. Condition During testwork performed over eligibility requirements for CHIP and the Medical Assistance Program as of June 30, 2023, the auditor tested 300 total beneficiaries (180 Modified Adjusted Gross Income (MAGI) beneficiaries and 120 aged, blind, and disabled (ABD) beneficiaries) and noted the following: • Mississippi Division of Medicaid (MDOM) did not use federal tax and/or state tax returns to verify income, including self-employment income, out-of-state income, and various types of unearned income when these types of income were not reported by the beneficiary. The Medicaid State Plan requires the verification of all income for MAGI-based eligibility determinations, and MDOM’s Eligibility Policy and Procedure Manual (Section 201.03.04a) requires the use of an individual’s most recent tax return to verify self-employment income. This section further states, if tax returns are not filed, not available, or if there is a change in income anticipated for the current tax year, refer to Chapter 200, Net Earnings from Self-Employment at 200.09.08, for policy on estimating net earnings from self-employment. The MDOM’s State Plan does not allow for accepting self-attested income. Therefore, if an applicant indicates zero for self-employment income, the amount of zero must be verified like any other income amount. • 20 of the 180 MAGI beneficiaries (or 11.11 percent) reported self-employment income, out-of-state income, or unearned income on the Mississippi income tax return, but the income was not reported on the recipient’s application. Of the 20 instances, seven instances (or 35.00 percent) were noted in which the total income per the most recent tax return available at the time of determination exceeded the applicable income limit for the recipient’s category of eligibility. Due to MDOM not verifying self-employment income on the applicant’s tax return, MDOM was not aware income exceeded eligibility limits, and did not request any additional information that might have explained why income was not self-reported; therefore, auditor could not determine with certainty that individuals are, in fact, ineligible. However, information that MDOM used at the time of the eligibility determination did not support eligibility. The auditor acknowledges that the self-employment income reported on the income tax returns does not, in and of itself, make the seven cited beneficiaries ineligible, it does indicate that they had self-employment income during the year of eligibility determination that was, potentially, not accurately reported on their application. Furthermore, MDOM did not perform any procedures to verify that zero self-employment income reported on the applications was accurate. MDOM’s policy requires the use of the individual’s most recent tax return to verify income for individuals considered self-employed, a shareholder in an S Corporation, or a partner in a business or one who has income from a partnership, LLP, LLC or S Corporation. Due to the timing of tax returns filings, including allowable extensions, MDOM requires the use of prior year income verification in these circumstances. Additionally, due to the COVID-19 pandemic, some beneficiaries did not have a redetermination performed in FY 2023, so the auditor tested the prior year redetermination (which made the beneficiary eligible as of June 30, 2023). The auditor used tax return data from the following years: 2018 for 2019 determinations, 2019 for 2020 determinations, 2020 for 2021 determinations, 2021 for 2022 determinations, and 2022 for 2023 determinations. The fiscal year payments for these seven beneficiaries that might not have been eligible to receive the benefits totaled $15,250 of questioned costs. Based on the error rate calculated using the fee for service (FFS) and capitation payments of our sample, the projected amount of payments made for beneficiaries who it is reasonably possible were ineligible would fall between $53,462,373 (projected costs based on average monthly payments sampled) and $113,426,443 (projected costs based on actual month payment sampled). The following is a breakdown of these costs by category: CHIP: Between $3,538,857 (average monthly) to $7,417,429 (actual monthly) MAGI Managed Care: Between $28,214,804 (average monthly) to $77,872,775 (actual monthly) MAGI Fee for Service: Between $21,708,712 (average monthly) to $28,136,240 (actual monthly) • For four of the 180 MAGI beneficiaries (or 2.22 percent), income was not verified through Mississippi Department of Employment Security (MDES) at the time of the redetermination for the eligibility period that covered June 30, 2023. This resulted in questioned costs of $10,639. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • For two of the 300 beneficiaries (or 0.67 percent), the beneficiary’s case file did not contain a completed application. • For one of the 300 beneficiaries (or 0.33 percent), MDOM was unable to provide auditors with the beneficiary’s case file. This resulted in questioned costs of $242. Questioned costs were not projected for this item due to the inability to statistically validate the sample. • 80 ABD beneficiaries required resource verifications through the Asset Verification system (AVS). Of the 80, 15 instances (or 18.75 percent) in which resources were not verified through AVS at the time of redetermination. • 195 out of 300 beneficiaries (or 65.00 percent) were not included on all of the required quarterly Public Assistance Reporting Information System (PARIS) file transmissions for fiscal year 2023. Of the 195 beneficiaries, one beneficiary (or 0.51 percent) was not included on any quarterly PARIS file transmissions during fiscal year 2023. Cause The Mississippi Division of Medicaid (MDOM) did not have adequate internal controls to ensure compliance with eligibility requirements. Additionally, MDOM did not have policies in place to verify certain types of income on applicant’s tax returns, as required by its own policy and procedures, for eligibility determinations. Effect Failure to comply with eligibility requirements could result in ineligible beneficiaries being determined eligible, resulting in questioned costs and the possible recoupment of funds by the federal granting agency. Recommendation We recommend the Mississippi Division of Medicaid strengthen controls to ensure compliance with eligibility requirements of the Children’s Health Insurance Program (CHIP) and the Medical Assistance Program. Repeat Finding Yes; 2022-025. Statistically Valid Portions of these findings were based on statistically valid samples.

DEPARTMENT OF REHABILITATION SERVICES ALLOWABLE COSTS / ACTIVITIES ALLOWED Significant Deficiency 2023-008 Strengthen Controls to Ensure Compliance with Allowable Costs Requirements for the Social Security Disability Insurance Program ALN Number(s) 96.001 Social Security-Disability Insurance 96.006 Supplemental Security Income Federal Award No. 2104MSD100 Questioned Costs $14 Criteria Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: “Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition During the period of performance testing, we noted that an expenditure was issued to the wrong provider. Upon review of the approved claim and general ledger, we noted that the disbursement was issued to a different provider. Cause The error was due to a manual data entry error that occurred when the provider payment request was entered in State’s account payable module. The error was not identified as a part of the review and approval process. Effect The disbursement to the wrong provider was not determined as an allowable since the provider did not submit a payment request. In addition, the Department did not approve the payment to that provider. Recommendation We recommend that the department enhance its internal controls to ensure that disbursements are issued to the correct provider. Repeat Finding No. Statistically Valid No.

DEPARTMENT OF REHABILITATION SERVICES PERIOD OF PERFORMANCE Significant Deficiency 2023-007 Strengthen Controls to Ensure Compliance with the Period of Performance for the Social Security Disability Insurance Program. ALN Number(s) 96.001 Social Security-Disability Insurance 96.006 Supplemental Security Income Federal Award No. 2104MSD100 2204MSD100 2304MSD100 Questioned Costs $13,517 Criteria Per the Code of Federal Regulations (2 CFR 200.308, 200.309, and 200.403(h)), A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity. A period of performance may contain one or more budget periods. Code of Federal Regulations (2 CFR 200.303(a)), a non-Federal entity must: “Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition Program expenditures were not charged to the grant within the period of performance. We identified the following: • Two instances in which the expenditure was charged to the grant prior to the start of the grant, • Three instances in which the expenditure was charged after the grant’s end date. Cause The Department charging the grants outside of the period of performance was due to an error that was not identified during the review process. In addition, one expenditure supported costs for an annual agreement in which the service period started in one grant period and ended in another grant period. The Department elected to charge the costs to the grant starting after to expenditure incurred date, since most of the service would occur during that grant’s period. Effect The grantor may deem the costs charged outside of the period of performance as unallowable. Recommendation We recommend that the department enhance its internal controls to ensure all costs are incurred within the period of performance specified in the notice of award. Repeat Finding No. Statistically Valid No.